diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 043f9bd50..4ce352921 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -7,9 +7,9 @@ jobs: pre-commit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v3 with: fetch-depth: 0 - - uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507 + - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd #3.0.1 with: extra_args: --show-diff-on-failure --from-ref ${{ github.event.pull_request.base.sha }} --to-ref ${{ github.event.pull_request.head.sha }} diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 346fc7c53..ed3b668e0 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -4,10 +4,10 @@ repos: hooks: - id: prettier additional_dependencies: - - 'prettier@2.7.1' + - 'prettier@3.4.2' files: ^content\/.*$ - exclude: content/docs/k8s/reference.md + exclude: content/docs/deploy/k8s/reference.md - repo: https://github.com/streetsidesoftware/cspell-cli - rev: v6.2.0 + rev: v8.17.0 hooks: - id: cspell diff --git a/README.md b/README.md index b28e2e3af..2bb4b9e7a 100644 --- a/README.md +++ b/README.md @@ -6,8 +6,6 @@ Pomerium's documentation is built using [Docusaurus 2](https://docusaurus.io/). ## Contributing -See [Contributing](https://pomerium.com/docs/community/contributing) for more information on contributing to this project. - The steps below detail the installation of this site locally for development. ### Installation diff --git a/content/_generate-recovery-token.md b/content/docs/admonitions/_generate-recovery-token.md similarity index 93% rename from content/_generate-recovery-token.md rename to content/docs/admonitions/_generate-recovery-token.md index fce2b2717..c8340fc98 100644 --- a/content/_generate-recovery-token.md +++ b/content/docs/admonitions/_generate-recovery-token.md @@ -1,6 +1,6 @@ In the event that you lose access to the console via delegated access (the policy defined in Pomerium), there exists a fallback procedure to regain access to the console via a generated recovery token. -![Pomerium Enterprise Recovery Sign In](docs/img/recovery-token.png) +![Pomerium Enterprise Recovery Sign In](./img/recovery-token.png) To generate a token, run the `pomerium-console generate-recovery token` command with the following flags: diff --git a/content/docs/admonitions/_handle-self-signed-certificate-warning.mdx b/content/docs/admonitions/_handle-self-signed-certificate-warning.mdx index 6f46af73f..ba24bf8b2 100644 --- a/content/docs/admonitions/_handle-self-signed-certificate-warning.mdx +++ b/content/docs/admonitions/_handle-self-signed-certificate-warning.mdx @@ -1 +1 @@ -If you notice a self-signed certificate warning, see [Handle Self-Signed Certificate Warning](/docs/troubleshooting#handle-self-signed-certificate-warning) to bypass it. +If you notice a self-signed certificate warning, see [Handle Self-Signed Certificate Warning](/docs/internals/troubleshooting) to bypass it. diff --git a/content/docs/admonitions/_import-core-config-to-zero.mdx b/content/docs/admonitions/_import-core-config-to-zero.mdx index 66cbe1900..d40f21920 100644 --- a/content/docs/admonitions/_import-core-config-to-zero.mdx +++ b/content/docs/admonitions/_import-core-config-to-zero.mdx @@ -1,3 +1,3 @@ Pomerium Zero provides a hosted configuration UI for managing your Pomerium configurations. You can migrate to Pomerium Zero by importing your existing configuration. -See [**Import Core Config to Zero**](/docs/zero/import) for more information. +See [**Import Core Config to Zero**](/docs/deploy/cloud/import) for more information. diff --git a/content/_install-mkcert.md b/content/docs/admonitions/_install-mkcert.md similarity index 100% rename from content/_install-mkcert.md rename to content/docs/admonitions/_install-mkcert.md diff --git a/content/docs/admonitions/_long-lived-connections.mdx b/content/docs/admonitions/_long-lived-connections.mdx index b5ab1b295..86d376bf3 100644 --- a/content/docs/admonitions/_long-lived-connections.mdx +++ b/content/docs/admonitions/_long-lived-connections.mdx @@ -1,3 +1,3 @@ -When you create a [TCP](/docs/capabilities/tcp) or [Websocket](/docs/reference/routes/timeouts#websocket-connections) connection, Pomerium validates the access policy at the time the connection is made. +When you create a [TCP](/docs/capabilities/non-http) or [Websocket](/docs/reference/routes/timeouts#websocket-connections) connection, Pomerium validates the access policy at the time the connection is made. Currently, there is no mechanism in place to terminate long-running connections if a policy becomes invalid. diff --git a/content/docs/admonitions/_pomerium-authenticate-services.mdx b/content/docs/admonitions/_pomerium-authenticate-services.mdx index 876ee5e0b..00ca75b05 100644 --- a/content/docs/admonitions/_pomerium-authenticate-services.mdx +++ b/content/docs/admonitions/_pomerium-authenticate-services.mdx @@ -1,3 +1,3 @@ -Pomerium will use the [**Hosted Authenticate Service**](/docs/capabilities/hosted-authenticate-service) by default in configurations that don't specify an authenticate service URL. +Pomerium will use the [**Hosted Authenticate Service**](/docs/capabilities/authentication) by default in configurations that don't specify an authenticate service URL. -See the [**Self-Hosted Authenticate Service**](/docs/capabilities/self-hosted-authenticate-service) page if you prefer to use your own authenticate service. +See the [**Self-Hosted Authenticate Service**](/docs/capabilities/authentication) page if you prefer to use your own authenticate service. diff --git a/content/docs/admonitions/img/recovery-token.png b/content/docs/admonitions/img/recovery-token.png new file mode 100644 index 000000000..0144ebdc1 Binary files /dev/null and b/content/docs/admonitions/img/recovery-token.png differ diff --git a/content/docs/capabilities/audit-logs.mdx b/content/docs/capabilities/audit-logs.mdx index 9a4a23af9..e742b5671 100644 --- a/content/docs/capabilities/audit-logs.mdx +++ b/content/docs/capabilities/audit-logs.mdx @@ -1,8 +1,8 @@ --- -title: Audit Logs +title: Auditing & Privilege Access Management description: Learn how to read Pomerium authorization logs. lang: en-US -sidebar_label: Audit logs +sidebar_label: 'Audit logging' keywords: [pomerium, troubleshooting, auth, authorization, logs] sidebar_class_name: enterprise --- @@ -126,6 +126,6 @@ The keys described below usually contain the relevant information when debugging ## Understanding Authorization Logs -The most confusing keys for new users to understand are likely `allow-why-false` and `deny-why-false`. To better understand them, we should first discuss how [Pomerium Policy Language](/docs/capabilities/ppl) (**PPL**) works. +The most confusing keys for new users to understand are likely `allow-why-false` and `deny-why-false`. To better understand them, we should first discuss how [Pomerium Policy Language](/docs/internals/ppl) (**PPL**) works. PPL allows a request to a route if the claim matches at least one **allow** policy rule, and matches zero **deny** policy rules. With that in mind, `allow-why-false` and `allow-why-true` will describe a situation where the request either does or not not meet the requirements of an **allow** block a policy applied to that route. Conversely, `deny-why-true` and `deny-why-false` will describe why a request did or did not match a **deny** block for a policy assigned to the route. diff --git a/content/docs/capabilities/authentication.mdx b/content/docs/capabilities/authentication.mdx index 41d405bd7..4d69456d4 100644 --- a/content/docs/capabilities/authentication.mdx +++ b/content/docs/capabilities/authentication.mdx @@ -22,7 +22,7 @@ While Pomerium itself is not an IdP, it supports conventional IdP solutions and :::tip -See [identity providers](/docs/identity-providers) for step-by-step guides on how to integrate supported IdPs with Pomerium. +See [identity providers](/docs/integrations/user-identity/identity-providers) for step-by-step guides on how to integrate supported IdPs with Pomerium. ::: @@ -34,11 +34,11 @@ After Pomerium has verified and authenticated the user, the Authentication servi ### JWT verification and upstream applications -After Pomerium’s Authentication service obtains OAuth and ID tokens and OIDC claims from your IdP, it stores that session data in the Databroker service, never leaking it to the client or the upstream application. This provides an extra layer of security, as it prevents the application from using OAuth tokens provided by the IdP. +After Pomerium's Authentication service obtains OAuth and ID tokens and OIDC claims from your IdP, it stores that session data in the Databroker service, never leaking it to the client or the upstream application. This provides an extra layer of security, as it prevents the application from using OAuth tokens provided by the IdP. Pomerium mints a new Pomerium JWT based on the claims and scopes in the OAuth and ID tokens and signs the JWT with a private key so the upstream application can verify the incoming request came from Pomerium. -Although [JWT verification](/docs/guides/verify-jwt) is optional, Pomerium provides a way for you to [verify a user’s identity](/docs/capabilities/getting-users-identity) on the application level by forwarding [JWT claim headers](/docs/reference/jwt-claim-headers) with proxied requests to upstream applications. +Although [JWT verification](/docs/capabilities/getting-users-identity.mdx) is optional, Pomerium provides a way for you to [verify a user's identity](/docs/capabilities/getting-users-identity) on the application level by forwarding [JWT claim headers](/docs/reference/jwt-claim-headers) with proxied requests to upstream applications. Pomerium offers frontend and backend SDKs to simplify JWT verification for application developers: @@ -50,14 +50,265 @@ Pomerium offers frontend and backend SDKs to simplify JWT verification for appli Legacy apps that may not directly support SSO are still compatible with Pomerium. As a reverse proxy, Pomerium is designed to sit in front of your applications. -By configuring your applications to route requests to Pomerium’s Proxy service, Pomerium can manage the authentication flow and secure your legacy app with minimal to no work on your end. +By configuring your applications to route requests to Pomerium's Proxy service, Pomerium can manage the authentication flow and secure your legacy app with minimal to no work on your end. ## External data sources (Enterprise) :::enterprise -[Enterprise customers](https://www.pomerium.com/enterprise-sales/) can enforce context-aware access with Pomerium’s [external data sources](/docs/capabilities/integrations) feature (directory sync). +[Enterprise customers](https://www.pomerium.com/enterprise-sales/) can enforce context-aware access with Pomerium's [external data sources](/docs/capabilities/integrations) feature (directory sync). ::: From the Enterprise Console, you can import external data from sources other than your IdP. User identity context such as users, groups, roles, language, time zones, location, and more can be included into your authorization policy so you can make granular access control decisions. + +## Hosted Authenticate Service + +Pomerium's **Hosted Authenticate Service** provides a hosted alternative to the self-hosted authenticate service. + +Introduced in Pomerium v0.22, the hosted authenticate service is available for open-source Pomerium, Pomerium Zero, and Pomerium Enterprise. + +## How the hosted authenticate service works + +Pomerium's hosted authenticate service includes a **Hosted Authenticate Service URL** and a **Hosted Identity Provider** that handle authentication and authorization using OAuth 2.0 and OIDC protocols. + +Pomerium Zero, Core, and Enterprise configurations that do not include the self-hosted authenticate service URL or identity provider settings default to the hosted authenticate service settings. See [Configure the hosted authenticate service](#configure-the-hosted-authenticate-service) section for more information. + +## Why use the hosted authenticate service + +The hosted authenticate service offers a quicker way for users to deploy and test Pomerium. + +### No configuration + +The hosted authenticate service doesn't require an authenticate service URL or identity provider settings to use. + +### Less time to deploy + +Pomerium's hosted authenticate service removes the tedium of configuring your own identity provider (IdP) and authenticate service URL so you can deploy Pomerium in less time. + +### Faster proof of concept + +If you're testing Pomerium for the first time, run [Pomerium with Docker](/docs/get-started/fundamentals/core/get-started) using our hosted authenticate service – you can run Pomerium Core in **under 5 minutes** with minimal setup. + +:::enterprise + +Pomerium users who are interested in [Pomerium Enterprise](https://www.pomerium.com/enterprise-sales/) can test out the [Docker Enterprise quickstart](/docs/deploy/enterprise/quickstart) using our hosted authenticate service as well. + +::: + +## Configure the hosted authenticate service + +The hosted authenticate service requires no configuration to use. + +Add the following route and policy to your configuration file: + +```yaml title="pomerium-config.yaml" +routes: + - from: https://verify.localhost.pomerium.io + to: http://verify:8000 + policy: + - allow: + or: + - email: + is: user@example.com + pass_identity_headers: true +``` + +This minimal configuration is all you need to connect to an upstream service with Pomerium's hosted services. + +If you want, you can still include the hosted URL in your configuration: + +```yaml title="pomerium-config.yaml" +authenticate_service_url: https://authenticate.pomerium.app + +routes: + - from: https://verify.localhost.pomerium.io + to: http://verify:8000 + policy: + - allow: + or: + - email: + is: user@example.com + pass_identity_headers: true +``` + +If you use the hosted URL and include your own IdP settings, Pomerium will override your IdP configuration and use the hosted IdP instead: + +```yaml title="pomerium-config.yaml" +authenticate_service_url: https://authenticate.pomerium.app + +idp_provider: google +idp_client_id: my_client_id +idp_client_secret: my_client_secret + +routes: + - from: https://verify.localhost.pomerium.io + to: http://verify:8000 + policy: + - allow: + or: + - email: + is: user@example.com + pass_identity_headers: true +``` + +## Limitations + +**Limited sign-in options** + +Currently, you can only authenticate with Google single-sign on or with email and password credentials. + +**Session management** + +The hosted authenticate service is separate from your Pomerium installation. This means you can't refresh session tokens, so users must re-authenticate after roughly one hour. + +**Uptime commitment** + +We make no commitments to uptime for our free hosted authenticate service. + +## Privacy considerations + +Users that take advantage of our hosted authenticate service should review the [Terms of Service agreement](https://www.pomerium.com/pomerium-zero-user-agreement/). + +Specifically, you should be aware that by using our hosted services, you agree to Pomerium collecting the following data: + +- IP address +- OS version +- Internal domain name +- Session details (email, name, and domain) + +We collect this information to better understand how our users interact with and use Pomerium's services. + +## Self-Hosted Authenticate Service + +Pomerium's **Self-Hosted Authenticate Service** allows you to configure Pomerium with the identity provider of your choice. + +The self-hosted authenticate service is available for open-source Pomerium, Pomerium Zero, and Pomerium Enterprise. + +:::info + +The _authenticate service_ is one of the [four logical services](/docs/internals/architecture#component-level) that make up Pomerium. The authenticate service is unique in that Pomerium can either run this service itself, or instead use the [Hosted Authenticate Service](/docs/capabilities/authentication). + +::: + +## How the self-hosted authenticate service works + +To configure the self-hosted authenticate service, you will need to set up: + +- a URL for the authenticate service +- an identity provider (IdP) + +### Authenticate service URL + +The authenticate service URL is a public-facing URL that should resolve to your Pomerium instance. (If running in split service mode, this URL should resolve to the authenticate service.) Whenever a user is required to log in to access a route, Pomerium will redirect the user to the authenticate service using this URL. + +This URL should not contain a path or query parameters. For example, `https://authenticate.corp.example.com`. + +This URL must be different from any of the route URLs you use with Pomerium. + +See the [Authenticate Service URL](/docs/reference/service-urls#authenticate-service-url) reference page for details on how to configure this setting. + +:::info Why does Pomerium use a separate authenticate service URL? + +In a typical OIDC authentication flow, all redirect URLs must be pre-registered with the IdP. Pomerium uses a single authenticate service URL so that you need to register only one redirect URL with your IdP. This way, Pomerium can protect multiple upstream services without requiring you to update your IdP client whenever you add a new service. + +::: + +### Identity provider + +Pomerium relies on an IdP to authenticate users. Pomerium can use any IdP that implements the OpenID Connect (OIDC) protocol. + +The steps to configure your IdP will vary depending on the specific provider. See [**Identity Providers**](/docs/integrations/user-identity/identity-providers) for a list of guides to configure commonly-used IdPs. + +You will generally need to configure your IdP client to allow an OAuth redirect URL based on your chosen authenticate service URL, with the path `/oauth2/callback` appended to it. + +For example, if your authenticate service URL is `https://authenticate.corp.example.com`, you should configure your identity provider to allow the redirect URI `https://authenticate.corp.example.com/oauth2/callback`. + +:::tip + +If you require a different callback path than `/oauth2/callback`, you can use the [Authenticate Callback Path](/docs/reference/authenticate-callback-path) setting to change the callback path. + +::: + +Once you have set up an IdP client, you will need to configure Pomerium with the IdP name, client ID and client secret, and possibly a URL assigned to your individual IdP client. + +See the [Identity Provider Settings](/docs/reference/identity-provider-settings#identity-provider-client-id) reference page for details on how to configure these settings. + +## Single sign-out (SSO) + +signs a user out of a secured application and clears both the remote application session generated by the identity provider and the local Pomerium session. + +## OIDC Front-Channel Logout + +Pomerium supports Front-Channel Logout as described in [OpenID Connect Front-Channel Logout 1.0](https://openid.net/specs/openid-connect-frontchannel-1_0.html). + +### Identity provider support + +See if your identity provider (IdP) supports Front-Channel Logout by checking your IdP's `/.well-known/openid-configuration` endpoint. If your IdP supports it, you may see something similar to the JSON data below: + +```json +{ + "frontchannel_logout_session_supported": true +} +``` + +### Configure single sign-out + +To correctly implement SSO, you must register a `frontchannel_logout_uri` for your application that includes the path `/.pomerium/sign_out`. + +The `frontchannel_logout_uri` must match the external route in your policy. For example, `app.corp.example.com/.pomerium/sign_out`. + +If configured correctly, the following actions occur: + +1. The proxy service receives the sign-out request and clears the local Pomerium session +2. The proxy service redirects the request to the authenticate service URL's `/.pomerium/sign_out` endpoint +3. The authentication service clears the remote application session + +![Single sign-out flow](./img/single-sign-out/sign-out-flow.svg) + +:::caution + +While it is possible to implement SSO using the **authenticate service URL** and the `/.pomerium/sign_out` endpoint, this method is not recommended. + +Signing out with the authenticate service URL won't delete the session cookie on the route itself. To terminate the remote application and Pomerium sessions, you must point sign-out requests to the external route. + +::: + +
+ Well-known Pomerium endpoint +
+ +See Pomerium's `/.well-known/pomerium` endpoint to view OAuth, OIDC, and JWKS data. + +For example: + +```json +{ + "authentication_callback_endpoint": "https://authenticate.localhost.pomerium.io/oauth2/callback", + "jwks_uri": "https://authenticate.localhost.pomerium.io/.well-known/pomerium/jwks.json", + "frontchannel_logout_uri": "https://authenticate.localhost.pomerium.io/.pomerium/sign_out" +} +``` + +Note, a CSRF token is required for the single sign out endpoint (despite supporting `GET` and `POST`) and can be retrieved from the `X-CSRF-Token` response header on the well known endpoint above or using the `_pomerium_csrf` session set. + +
+
+ +### Single sign-out example with Pomerium + +The example below demonstrates how to correctly implement SSO using the [JavaScript SDK](/docs/capabilities/getting-users-identity.mdx): + +```js +export const signOut = (redirectUrl) => { + let location = window.location.origin + '/.pomerium/sign_out'; + if (redirectUrl) { + location += '?pomerium_redirect_uri=' + encodeURIComponent(redirectUrl); + } + window.location.href = location; +}; +``` + +In the example above, the `signOut` function appends the `/.pomerium/sign_out` endpoint to the external route URL, then redirects the user. + +From here, the proxy service clears the external route session and redirects the user to the authenticate service URL to clear the Pomerium session. diff --git a/content/docs/capabilities/authorization.mdx b/content/docs/capabilities/authorization.mdx index 71ac701d8..4ead23a62 100644 --- a/content/docs/capabilities/authorization.mdx +++ b/content/docs/capabilities/authorization.mdx @@ -1,162 +1,183 @@ --- -# cSpell:ignore abac, gset, nxon, unvalidated - -title: Authorization & Policy +title: 'Authorization and Policy Enforcement with Pomerium' +sidebar_label: 'Authorization' lang: en-US -sidebar_label: Authorization -description: Build authorization policy with Pomerium and apply them to routes and namespaces. +description: 'Learn how Pomerium enforces context-aware, continuous authorization using route-level policies, namespaces, device-based constraints, and more.' keywords: [ pomerium, - context-aware proxy, - authorization proxy, - access decision point, - rbac, - abac, - dynamic access, + authorization, + zero trust, + policy enforcement, ppl, + rego, namespaces, + device identity, + clusters, ] --- import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem'; +import SelfSignedCertWarning from '@site/content/docs/admonitions/_handle-self-signed-certificate-warning.mdx'; -# Authorization Policy + -An authorization policy defines what resources a user or group can access within an organization. When applying an authorization policy, factors like access management to on-premises or cloud services, authentication flows, and device identity introduce complexity that only scales with organization size. +Pomerium enforces dynamic, context-aware authorization on every request. This capability extends across deployments of any size or complexity, from single-route use cases to multi-namespace or multi-cluster enterprise environments. -Pomerium meets you where you are by allowing you to configure granular policies that support or extend your existing policies on a per-route, per-request basis. +Below, we cover how to write and apply policies with **Pomerium Policy Language (PPL)**, when to use **Rego**, and how **Namespaces** (Enterprise) and **Clusters** (Pomerium Zero) fit into the picture. -## Pomerium authorization policy +## Introduction: Authorization at Every Layer -You can apply policies in Pomerium to [Namespaces](/docs/capabilities/namespacing) or [Routes](/docs/capabilities/routing). +Pomerium's approach to authorization is continuous and context-aware, integrating identity information from your IdP, device identity, or external data sources. -### Namespaces +- **Route-based** control in all editions +- **Namespace-based** and **cluster-based** organization in Enterprise and Zero +- **Policy languages**: [PPL](#pomerium-policy-language-ppl) for most use cases, [Rego](#rego-policies) for advanced logic -:::enterprise +## Where Policies Live -Namespace support is available only for [Enterprise customers](https://www.pomerium.com/enterprise-sales/). +1. **Routes** + Policies can be attached to each route, controlling who and what can access the upstream service. -::: +2. **Namespaces** + A namespace is an organizational unit. Policy can be applied once and inherited by child namespaces or routes. Admins can delegate control so teams manage their own routes without harming global security. -Administrators can create a namespace, add users, groups, and routes to it, and configure a policy that applies to that specific namespace. +3. **Clusters** + Zero-managed clusters pull their config (routes, policies, certificates) from a hosted control plane. Each cluster has its own environment. You can define policies in the Zero console, and they're synced to local Pomerium Core replicas. -### Routes +## Policy Configuration Approaches -You can build TLS-encrypted routes to upstream applications and configure policy that restricts access based on the policy criteria. - -Pomerium Enterprise and Core customers can configure and apply policies to routes. +### Pomerium Policy Language (PPL) -### Continuous verification +[Pomerium Policy Language](/docs/internals/ppl) is YAML-based and covers the majority of use cases. + +- **Actions**: `allow` or `deny` +- **Logical Operators**: `and`, `or`, `not`, `nor` +- **Criteria**: email, domain, groups, day of week, device, etc. + +A minimal example: + +```yaml +allow: + and: + - domain: + is: example.com +deny: + or: + - email: + is: spammer@example.com + - email: + is: malicious@example.com +``` - +**Deny** overrides **allow**. Requests must pass at least one `allow` rule and no `deny` rules. -Pomerium continuously evaluates policy on every request. +#### PPL in Pomerium Enterprise -Policy applied to any route or namespace will enforce authorization checks throughout a session, ensuring that only the intended user with the right context can access a protected resource. +Enterprise adds a visual **Policy Builder** and extended criteria (like time-of-day or external data records). You can build policy via GUI or raw PPL: -## Apply authorization policy +![Build an authorization policy with PPL in the Enterprise Console](./img/authorization/ppl-edit-policy.png) -Pomerium offers three methods to configure and apply policies: +Reapply policies across multiple routes or namespaces: -- [Pomerium Policy Language (PPL)](#pomerium-policy-language-ppl) -- [Enterprise Console GUI](#enterprise-console-gui) -- [Rego](/docs/capabilities/rego) +![Reapply policies to multiple routes or namespaces](./img/authorization/apply-policies-to-routes.png) -### Pomerium Policy Language (PPL) +### Rego Policies -[Pomerium Policy Language (PPL)](/docs/capabilities/ppl) is a declarative, YAML-based access control policy language you can use to configure authorization policies. +:::enterprise -PPL is intuitive by design and defines policy with one or more rules composed of actions, logical operators, and criteria. Each criterion has a name and corresponding data. +**Rego** is available to Enterprise customers who need advanced, custom logic beyond what PPL offers. - - +::: -In Pomerium Core, you can build a policy with PPL and apply it to a route in your configuration file: +[Rego](https://www.openpolicyagent.org/docs/latest/#rego) is the language used by [Open Policy Agent (OPA)](https://www.openpolicyagent.org/). In Pomerium, you can write Rego modules that produce `allow` or `deny` outcomes. For example: -```yaml title="pomerium-config.yaml" -policy: - - allow: - or: - - email: - is: user@example.com +```rego +allow := true ``` -In this example, only a user with the email `user@example.com` can access the target application. - - - +or: -In the Enterprise Console, you can use the **EDITOR** to manually configure policy with PPL: +```rego +deny := [true, "unauthorized"] +``` -![Build an authorization policy with PPL in the Enterprise Console](./img/authorization/ppl-edit-policy.png) +You can inspect request data under `input.http` (method, headers, path), or session details under `input.http.session`. Learn more in the [Rego docs](/docs/internals/ppl#rego). -In this example, Pomerium will grant a user access if their email address ends in `example.com` and their `groups` ID matches `00gso9nxonHI4YfbM4x6`. Pomerium will deny the user access on Saturdays and Sundays. +![Apply Rego in Console editor](./img/authorization/ppl-rego-policy.png) - - +## Enterprise Features -### Enterprise Console GUI +### Namespaces :::enterprise -The Enterprise Console provides a policy builder GUI so you can build policies and reapply them to multiple routes and namespaces. See our [**Enterprise**](/docs/enterprise) page to learn more. +Namespaces group resources and teams in a hierarchical structure. A parent namespace can enforce global rules while child namespaces add local restrictions. ::: -Use the **BUILDER** tab to build your policy: +Key benefits: -![Build policy with Console GUI](./img/authorization/ppl-gui-policy.png) +- **Self-Service**: Team leads can manage their own routes and policies. +- **Hierarchical**: Global admins set top-level constraints (like requiring a `@yourcompany.com` email). +- **RBAC**: Access is granted via roles: **Guest**, **Viewer**, **Manager**, **Admin**. -In this example, a user will have access if their email address ends in `example.com` and their device ID matches the ID in the **Value** field. +## Pomerium Zero & Clusters -#### Reapply policies +**Pomerium Zero** uses a _cluster_ model. Each cluster is a local deployment of Pomerium Core, connected to a hosted control plane. Clusters fetch routes, policies, and certificates from the Zero console: -Reapply policies as necessary to any route or namespace: +- **Starter domain**: Each cluster gets a unique domain with automatic TLS. +- **Custom domains**: Switch from the starter domain to your own. +- **Scalability**: Add more replicas to handle more traffic. +- **Storage**: Use a persistent PostgreSQL database in production for reliability. -![Reapply policies to multiple routes or namespaces](./img/authorization/apply-policies-to-routes.png) +For more details, see the [**Clusters**](/docs/internals/clusters) documentation. -### Policy overrides +## Policy Overrides -Pomerium Core and Enterprise offer the following options for overriding your authorization policy: +Regardless of PPL or Rego, Pomerium provides quick overrides: -- **Any Authenticated User**: Allows access to a route with this policy attached to any user who can authenticate to your identity provider -- **CORS Preflight**: Allows unauthenticated HTTP OPTIONS requests as per the CORS spec -- **Public Access**: Allows complete, unrestricted access to an associated route (use this setting with caution) +- **Any Authenticated User**: Bypasses all other policy logic and admits any logged-in user. +- **CORS Preflight**: Lets `OPTIONS` requests pass unauthenticated. +- **Public Access**: No authentication required. Use with caution. :::note robots.txt behavior -By default, Pomerium serves a **robots.txt** response directly, instructing search engines _not_ to crawl the route domain: - -```txt -User-agent: * -Disallow: / -``` - -For routes with policies that allow public, unauthenticated access, Pomerium _will not_ serve **robots.txt** directly. Instead, Pomerium will proxy requests for `/robots.txt` to the upstream service. +If a route is fully public, `robots.txt` will be proxied from upstream (instead of returning a disallow-by-default). ::: -## Manage devices +## Putting It All Together -:::enterprise +1. **Plan Your Structure** -[Device identity](/docs/capabilities/device-identity) is an Enterprise feature. Check out our [Enterprise](/docs/enterprise) page to learn more. + - Small setups: attach a PPL policy directly to each route in Core. + - Larger orgs: use **Namespaces** (Enterprise) to group resources. + - Multi-deployment: use **Clusters** (Pomerium Zero) to unify config. -::: +2. **Decide on Language** + + - **PPL**: YAML, easy to read, covers most use cases. + - **Rego** (Enterprise): advanced logic, OPA-based. -The **Manage Devices** feature in the Enterprise Console allows you to enroll and manage user devices for policy-based authorization. +3. **Continuously Verify** + - Pomerium reevaluates the user's context (IdP claims, device posture, location) on every request. -![Enroll devices](./img/authorization/enroll-device.png) +## Learn More -The **Devices List** displays enrolled devices for each user and the approval status. Administrators can inspect, approve, or delete registered devices from this table. +- [**Routing**](/docs/capabilities/routing) +- [**Policy Language (PPL)**](/docs/internals/ppl) +- [**Rego**](/docs/internals/ppl) +- [**Namespaces**](/docs/internals/namespacing) +- [**Clusters**](/docs/internals/clusters) +- [**Device Identity**](/docs/integrations/device-context/device-identity) -![List of user devices](./img/authorization/console-devices.png) +Use Pomerium's robust, context-driven authorization to unify your security posture, whether you're looking to secure a few routes or an entire global infrastructure. diff --git a/content/docs/capabilities/branding.md b/content/docs/capabilities/branding.md index 25a49235f..e1f56a078 100644 --- a/content/docs/capabilities/branding.md +++ b/content/docs/capabilities/branding.md @@ -1,83 +1,62 @@ --- -description: Add custom colors, logos, and error messages. +title: 'Whitelabeling' +sidebar_label: 'Whitelabeling' +description: "Customize Pomerium's user-facing and administrative UI with your organization's branding." +keywords: + - 'pomerium' + - 'custom branding' + - 'white labeling' + - 'beyondcorp' + - 'zero trust' + - 'compliance' --- -# Custom Branding (White Labeling) +# White Labeling :::enterprise -This article describes a use case available to [Pomerium Enterprise](/docs/enterprise/install) customers. +This article describes a use case available to [Pomerium Enterprise](/docs/deploy/enterprise/install) customers. ::: -Pomerium's user and administrative facing GUI and error messages can be customized to meet your organization's needs. +## Overview -## Settings - -Most of the Branding settings are located in the Branding Tab of the main Settings Page. - -![Branding Settings in Pomerium Enterprise](./img/branding/no_branding_settings.png) - -There is also a setting to enable Error Details on Edit Route's General Tab. +Pomerium Enterprise allows you to visually align your identity-aware proxy with your organization's brand identity. You can replace Pomerium's default logos, change color themes, and add your own favicon to ensure that all administrative pages and user-facing prompts feel like a natural extension of your existing portals. -![Enable Error Details on a Route](./img/branding/enable_error_details.png) +For instructions on customizing error pages and enabling user self-remediation, see [Self-Remediation & Custom Error Pages](/docs/capabilities/self-remediation). -Policies have two new fields, explanation and remediation. +## Settings -Explanation is an optional short description of why the user would have been denied. Likewise, remediation is an optional field to cover how the user can self-remediate their state. Oftentimes, this will be a link to your internal help desk support site or knowledge base repo. +Most Branding options reside in the **Branding** tab of the **Settings** page: -![Add custom error messages.](./img/branding/policy_with_explanation_and_remediation.png) +![Branding Settings in Pomerium Enterprise](./img/branding/no_branding_settings.png) -## Colors +### Colors -Adding a [hex code](https://color.adobe.com/create/color-wheel) to the Primary Color setting will affect the majority of the theming on the console. For more details on how the types of colors will impact the look and feel of Pomerium, see Material Designs' [color documentation](https://material.io/resources/color/#!/?view.left=0&view.right=0)'s color documentation. +By adding a [hex code](https://color.adobe.com/create/color-wheel) in **Primary Color** and **Secondary Color**, you can seamlessly alter the console's UI to match your brand guidelines. ![Primary Color Pomerium Enterprise](./img/branding/branded_colors_console.png) -There is also a secondary color that is used for a few things such as certain button colors. - -![Secondary Color Pomerium Enterprise](./img/branding/secondary_color.png) - -Choosing colors also affects the majority of webpages served by Pomerium Core. - -![Error Pages and User Info](./img/branding/branded_colors_error_details.png) - -You can also set different colors for users using dark mode. +If you have users who prefer dark mode, you can add a different primary/secondary palette for dark mode: ![Dark Mode Colors](./img/branding/branded_colors_darkmode_console.png) -## Logo +This ensures a consistent brand experience whether someone is an admin in the console or a user landing on Pomerium's sign-in pages. -You may add a URL to link to your logo and favicon which will replace the Pomerium defaults. +### Logo + +You can replace Pomerium's default logo and favicon by specifying a custom URL: ![Replace the Logo and Favicon in Pomerium Enterprise](./img/branding/svg_logo_console.png) -It will also appear for all the user-facing webpages too. +Both administrative and user-facing pages will use your organization's imagery: ![Replace the Logo and Favicon in Open Source webpages](./img/branding/svg_logo_error_details.png) -## Error Details - -It is possible to customize the error messages displayed on 403 unauthorized pages. - -This feature is enabled on a per Route basis by toggling the setting in the General Tab of the Route settings. - -![Enable Error Details](./img/branding/enable_error_details.png) - -Error Message will appear similar to this example. - -![Extra Error Details](./img/branding/error_details_enabled.png) - -Policies without an explanation or remediation field will show the policy ID. - -If the explanation or remediation fields are added to the policy they will show up in the error details. - -![Policy Settings](./img/branding/policy_with_explanation_and_remediation.png) - -You can additionally add a Header paragraph that supports markdown to all error pages in the General Settings (same place you add colors and logos). - -![Markdown Header](./img/branding/first_paragraph_setting.png) +## Why White Labeling? -You can see the link added to the Error Page. +- **Professional Appearance**: Present a unified front to end users, ensuring they associate your secure portal with your organization's branding. +- **Trust & Familiarity**: A consistent identity lowers user confusion, especially for teams already accustomed to your internal brand or product suite. +- **Easier User Adoption**: When Pomerium “feels” like part of your standard workflow, employees are more likely to comply with zero-trust and security measures. -![Markdown Header](./img/branding/includes_first_paragraph.png) +White labeling is not merely cosmetic; it's a critical step to assure teams that they're accessing official, trusted corporate resources—enhancing user confidence and security posture. diff --git a/content/docs/capabilities/custom-domains.mdx b/content/docs/capabilities/custom-domains.mdx index b53e913fc..e7da7ead0 100644 --- a/content/docs/capabilities/custom-domains.mdx +++ b/content/docs/capabilities/custom-domains.mdx @@ -1,8 +1,8 @@ --- # cSpell:ignore mycorp id: custom-domains -title: Custom Domains -sidebar_label: Custom Domains +title: Custom Domains in Pomerium Zero +sidebar_label: 'Automatic Certs & Domains' description: The Custom Domains page teaches you how to add your own domain in Pomerium Zero and how to use it to build routes to your services. --- @@ -34,7 +34,7 @@ The **Custom Domains** feature helps simplify these steps. :::info -See the [**Clusters Concepts**](/docs/concepts/clusters) page for more information about clusters in Pomerium Zero. +See the [**Clusters Concepts**](/docs/internals/clusters) page for more information about clusters in Pomerium Zero. ::: @@ -58,7 +58,7 @@ Add a **wildcard CNAME record** that points to your starter domain. For example: If you're using a DNS provider like Google's Cloud DNS, you can add the wildcard CNAME record without code: -![Add a CNAME record in GCP](../capabilities/img/custom-domains/gcp-cname-record.png) +![Add a CNAME record in GCP](./img/custom-domains/gcp-cname-record.png) Add the custom domain in **Cluster Settings > Domains**: @@ -67,15 +67,15 @@ Add the custom domain in **Cluster Settings > Domains**: 1. In the **Custom Domains** field, select the **+** icon to add a domain name 1. Enter your custom domain -![Entering the fully qualified domain name in the Zero Console](../capabilities/img/custom-domains/add-custom-domain.gif) +![Entering the fully qualified domain name in the Zero Console](./img/custom-domains/add-custom-domain.gif) If added successfully, you will be able to build routes with your custom domain instead of the starter domain. Pomerium will automatically provision and renew TLS certificates for this custom domain, which you can verify by the Common Name found in the certificate: -![Reviewing the Let's Encrypt certificate for a custom domain](../capabilities/img/custom-domains/custom-domain-certificates.png) +![Reviewing the Let's Encrypt certificate for a custom domain](./img/custom-domains/custom-domain-certificates.png) You can also review the certificate in the **Certificates** dashboard: -![Review certificate details in the Certificate dashboard in the Zero Console](../capabilities/img/custom-domains/certificate-details.gif) +![Review certificate details in the Certificate dashboard in the Zero Console](./img/custom-domains/certificate-details.gif) ### How custom domains work diff --git a/content/docs/capabilities/device-identity.mdx b/content/docs/capabilities/device-identity.mdx deleted file mode 100644 index 3d4987505..000000000 --- a/content/docs/capabilities/device-identity.mdx +++ /dev/null @@ -1,155 +0,0 @@ ---- -title: Device Identity -description: Learn about how WebAuthn is used to authenticate and authorize access using Device ID and state. -lang: en-US -keywords: - [ - pomerium, - identity access proxy, - webauthn, - device id, - enroll, - enrollment, - authentication, - authorization, - enterprise, - ] ---- - -import Tabs from '@theme/Tabs'; -import TabItem from '@theme/TabItem'; - -Device identity is the unique ID associated with a device. In the context of zero trust, device identity can be used to authenticate and authorize users and to determine if a device can be trusted before granting a user access to a protected application or service. - - - -## Overview - -JWTs provide a secure and efficient means to authenticate and authorize users before they can access upstream services behind Pomerium. When configured for JWT authentication, Pomerium sends its own JWT to the upstream service. By verifying the Pomerium JWT, the upstream service can: - -- Confirm that the Pomerium Proxy service handled the client request before forwarding it. -- Make application-level authorization decisions based on the user's associated identity information. - -## Why JWT authentication? - -### Identity verification - -JWT authentication through Pomerium enables an upstream service to verify a user's identity based on claims contained in the JWT. Pomerium signs and issues a new JWT based on the ID token received from the service's configured identity provider. - -### Request verification - -Pomerium places the newly minted JWT in a [JWT assertion header](#jwt-assertion-header). The upstream service should only accept the incoming request if it satisfies all [JWT validation](#jwt-validation) conditions. - -By validating the JWT, the upstream service can assert that: - -- The request originated from Pomerium. -- The user was authenticated. -- The request was authorized in accordance with the route's authorization policy. - -:::note - -The Pomerium JWT does not contain any path information for an upstream service. If you've configured multiple routes with different paths for the same upstream service (such as an `/admin` route that grants access to a limited set of users), the application can't determine which Pomerium route the JWT corresponds to. - -::: - -### Single Sign-on (SSO) - -You can configure upstream services to accept the Pomerium JWT to achieve an SSO authentication flow. This capability is completely free and relatively easy to configure depending on the upstream service and your [identity provider](/docs/identity-providers). - -:::info Implement SSO with Pomerium - -See our [**Grafana**](/docs/guides/grafana) guide for a real-world example of how configuring both Pomerium and and an upstream service can provide easy SSO access for your end users. - -::: - -## JWT authentication flow - -![A diagram that shows how Pomerium forwards JWTs to an upstream application](./img/jwt-authn/jwt-authentication.svg) - -### Identity provider authentication - -Pomerium requires users to authenticate against an OIDC-compliant identity provider before authorizing or denying a request to an upstream service. - -After successful authentication, Pomerium mints a new [**Pomerium JWT**](#pomerium-jwt) based on the **ID token** generated by the identity provider. (This is Pomerium's default behavior, even if you haven't configured Pomerium to support JWT authentication.) - -### JWT assertion header - -Pomerium signs its JWT with a [signing key](/docs/reference/signing-key). If the [pass identity headers](/docs/reference/routes/pass-identity-headers-per-route) setting is enabled, Pomerium will place the JWT into a special HTTP header called the JWT assertion header. Pomerium includes the JWT assertion header in every request it forwards to the upstream service. - -:::info JWT assertion header field - -Pomerium passes the JWT in the `X-Pomerium-Jwt-Assertion` HTTP header, and encodes it according to [RFC7519](https://datatracker.ietf.org/doc/html/rfc7519). - -::: - -### JWT validation - -The upstream service receives the `X-Pomerium-Jwt-Assertion-Header` with the encrypted JWT. To validate a JWT, the service should check the following items: - -- [JWT signature](#jwt-signature) -- [Audience (`aud`) and issuer (`iss`) claims](#aud-and-iss-claims) -- [JWT timestamps](#jwt-timestamps) - -#### JWT signature - -The upstream service should validate that the JWT was signed by the issuing authority. - -Pomerium issues and signs the new JWT with a private signing key. To validate the signature, the upstream service must fetch the corresponding public key from Pomerium's [JSON web key set](https://datatracker.ietf.org/doc/html/rfc7517#section-5) (JWKS) endpoint. - -To configure an upstream service to fetch the public key: - -1. Get the hostname from the JWT's `iss` claim -1. Append the `/.well-known/pomerium/jwks.json` path to the hostname -1. Prepend the `https://` scheme to the URL -1. Set the `Accept: application/json` header in the request - -For example: - - - - -```bash -curl https://service.corp.example.com/.well-known/pomerium/jwks.json \ --H 'Accept: application/json' -``` - - - - -```bash -curl https:///.well-known/pomerium/jwks.json \ --H 'Accept: application/json' -``` - - - - -The returned JWK key set contains Pomerium's public keys. Use the `kid` claim provided in the Pomerium JWT header to identify the correct key in the returned key set. - -```json title="JWKS response" -{ - "keys": [ - { - "use": "sig", - "kty": "EC", - // highlight-start - "kid": "ccc5bc9d835ff3c8f7075ed4a7510159cf440fd7bf7b517b5caeb1fa419ee6a1", - // highlight-end - "crv": "P-256", - "alg": "ES256", - "x": "QCN7adG2AmIK3UdHJvVJkldsUc6XeBRz83Z4rXX8Va4", - "y": "PI95b-ary66nrvA55TpaiWADq8b3O1CYIbvjqIHpXCY" - } - ] -} -``` - -If the JWT signature can't be validated, the JWT is invalid and can't be trusted. - -#### Aud and iss claims - -The upstream service should verify that the `aud` and `iss` claims match the domain used to serve your application. - -The `aud` claim identifies the recipient the JWT is intended for. In the context of a service behind Pomerium, the `aud` claim should always be set as the upstream service's domain name. - -Since v0.22, Pomerium sets the `iss` claim also to the domain of the target upstream service. (In previous versions, this was instead set to the [authenticate service](/docs/reference/service-urls#authenticate-service-url) domain.) - -If the domain provided in the `aud` and `iss` claims doesn't match the upstream service's domain name, the JWT is invalid and can't be trusted. - -```json title="Valid aud and iss claims" -{ - "aud": "verify.pomerium.app", - "iss": "verify.pomerium.app" -} -``` - -#### JWT timestamps - -The upstream service should verify that the Pomerium JWT has not expired. - -The `iat` claim informs you at what time the JWT was issued. The `exp` claim specifies the expiration time on or after which the JWT must be considered invalid. By default, Pomerium sets the `exp` claim to expire 5 minutes after the time it was issued. - -By comparing the current time with the timestamps in the `exp` and `iat` claims, you can verify if the JWT has expired or not. We recommend allowing up to a 1-minute leeway when comparing the `exp` and `iat` timestamps to account for [clock skew](https://en.wikipedia.org/wiki/Clock_skew) between Pomerium and the upstream service. - -If the JWT has expired, it is invalid and can't be trusted. - -:::tip JWT Verification with Pomerium SDKs - -Pomerium's [**JWT Verification**](/docs/guides/verify-jwt) guide shows you how to use our custom JWT libraries to parse and validate the Pomerium JWT in an upstream service. - -::: - -After the upstream service validates the JWT, it can accept the request and trust other claims present in the JWT. - -## The Pomerium JWT - -Pomerium generates a new **Pomerium JWT** based on the claims data contained in the original ID token. In addition to including standard claims as defined in [RFC7519](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1), Pomerium also injects its own claims into the Pomerium JWT as well. (See [JWT claims data](#jwt-claims-data) below for more details.) - -:::note - -The original ID token sourced from an identity provider is never modified or leaked to end users or upstream services. - -::: - -### Pomerium JWT claims data - -When Pomerium is configured for JWT authentication with the [pass identity headers](#jwt-settings) setting, the user's associated identity information will be included in the JWT assertion header in each upstream request. - -The Pomerium JWT contains at least the following claims: - -| JWT Claim | Description | -| :-: | --- | -| `jti` | A randomly generated UUID that represents the JWT ID. | -| `exp` | Expiration time in seconds since the UNIX epoch. Set to expire 5 minutes after `iat` time. | -| `iat` | Issued-at time in seconds since the UNIX epoch. | -| `aud` | The domain for the upstream application (for example, `httpbin.corp.example.com`). | -| `iss` | Same as the `aud` claim. | -| `sub` | The user's ID, as specified by the identity provider. | -| `email` | The user's email address. | -| `groups` | The user's group memberships (if supported for the identity provider). | -| `name` | The user's full name, as specified by the identity provider. | - -:::tip Prevent session replay attempts - -The `jti` claim (the JWT ID) contains a unique identifier assigned to each Pomerium JWT. If you can implement a system that checks the `jti` value in real time, you can prevent session replay attempts. Or, if you persist the `jti` value in your logs, you can detect replayed JWTs after the fact. - -::: - -### JWT Settings - -Use these settings to configure Pomerium to forward the Pomerium JWT to upstream services: - -- [Pass Identity Headers (global)](/docs/reference/pass-identity-headers) -- [Pass Identity Headers (per route)](/docs/reference/routes/pass-identity-headers-per-route) - -If your identity provider provides other claims not included in the Pomerium JWT that you would like to pass to your application, you can use the [JWT Claims Headers](/docs/reference/jwt-claim-headers) option to include them in the JWT as well. diff --git a/content/docs/capabilities/getting-users-identity.mdx b/content/docs/capabilities/getting-users-identity.mdx new file mode 100644 index 000000000..af50d3428 --- /dev/null +++ b/content/docs/capabilities/getting-users-identity.mdx @@ -0,0 +1,201 @@ +--- +# cSpell:ignore ecparam genkey noout pubout secp256r1 QCN7adG2AmIK3UdHJvVJkldsUc6XeBRz83Z4rXX8Va4 ary66nrvA55TpaiWADq8b3O1CYIbvjqIHpXCY envoyproxy Jklds Tpai Ibvjq Lamda + +title: Continious Identity Verification at the Application Layer +description: Learn how Pomerium uses JWTs for identity and context verification, how it fits into a zero trust environment, and four ways to validate the JWT in your upstream service. +sidebar_label: Continious Identity Verification +keywords: + - jwt + - jwt authentication + - sso + - single sign-on + - identity verification + - request verification + - pomerium + - zero trust + - pass identity headers + - jwks + - envoy + - go + - node + - sidecar +--- + +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; +import GoApp from '/content/examples/go-sdk/go-app.md'; +import ExpressApp from '/content/examples/js-sdk/express-server.md'; + + + +Pomerium uses JSON Web Tokens (JWTs) to help your upstream services verify a user's identity and additional context (like group membership) at the **application layer**. In a zero trust environment, verifying that **both** the client and server are who they say they are is crucial. Pomerium handles user authentication, then mints a **signed JWT** for every verified and authorized request. + +By validating that JWT, your application or service confirms: + +- The request came from Pomerium (a trusted policy enforcement point). +- The user's identity is legitimate and authorized, according to policy. +- The JWT is specifically intended for the service (not some other application). + +This article explains **why** identity & context verification at the application layer is important, **how** JWT-based verification works, and **four different approaches** you can use to verify JWTs: + +1. **Manually** (to understand the process) +2. **3rd-party app** with built-in JWT support (like Grafana) +3. **Custom application** (using an existing JWT library or Pomerium's SDK) +4. **Sidecar** (no code changes, e.g. Envoy proxy) + +## JWT Authentication Flow + +![A diagram that shows how Pomerium forwards JWTs to an upstream application](./img/jwt-authn/jwt-authentication.svg) + +1. **User authenticates** + Pomerium redirects the user to your OIDC-compliant identity provider (IdP). +2. **Pomerium issues a signed JWT** + After the user is authenticated, Pomerium mints a **new** JWT. +3. **JWT assertion header** + The JWT goes in the `X-Pomerium-Jwt-Assertion` header, following [RFC7519](https://datatracker.ietf.org/doc/html/rfc7519) encoding. +4. **Upstream service verifies** + Your application (or a helper process) confirms the JWT's signature, audience, issuer, and timestamps. + +If everything checks out, your service can trust the identity data in the token for additional authorization or logging. + +## Why JWT-Based Verification? + +- **Zero Trust**: Enforces that _every_ request is from a legitimate, authenticated user. +- **Application Layer**: Even if TLS terminates at Pomerium, the downstream service can verify the request is valid. +- **Single Sign-On**: A single IdP login flows downstream. Your app can read the user's email, groups, etc., from the JWT. +- **Local Validation**: JWTs are stateless. After an initial login, your service doesn't need to call the IdP again; it simply verifies the token signature. + +## JWT Details + +A Pomerium-issued JWT typically has standard fields plus additional claims: + +- **`exp`** (expiration), **`iat`** (issued-at), **`sub`** (user ID), **`aud`**, **`iss`** +- **`email`** (from IdP), **`groups`** (if available), **`name`** (if provided) + +The **original** ID token from your IdP is never forwarded. Instead, Pomerium reissues a fresh token under its own signing key. + +## Verifying a JWT + +Your upstream must ensure: + +1. **Signature**: The JWT was signed by Pomerium's private key. +2. **Audience & Issuer**: `aud` and `iss` match your service domain. +3. **Expiration**: The token is still valid (`exp` > now). + +### Fetch the Public Key (JWKS) + +Your upstream can automatically fetch Pomerium's public key: + +```bash +curl https:///.well-known/pomerium/jwks.json \ + -H 'Accept: application/json' +``` + +Pick the key matching the `kid` claim in the JWT header to verify its signature. + +## Four Approaches to JWT Validation + +### 1. Manual Verification + +Useful for learning or debugging: + +1. **Provide Pomerium a private key**: + ```bash + openssl ecparam -genkey -name prime256v1 -noout -out ec_private.pem + openssl ec -in ec_private.pem -pubout -out ec_public.pem + cat ec_private.pem | base64 # copy to SIGNING_KEY in Pomerium config + ``` +2. **Inspect the header** (`X-Pomerium-Jwt-Assertion`) in a request after you've logged in. +3. **Decode** the token on a site like [jwt.io](https://jwt.io/) or a local JWT decoder library. +4. **Paste** your `ec_public.pem` into the decoder's “verify signature” field. If it's valid, the user claims are genuine. + +:::info Example Screenshots + +If you use `httpbin` to inspect headers, you might see: + +![httpbin displaying jwt headers](./img/jwt/inspect-headers.png) + +Decoded, you'll see the claims: + +![httpbin displaying decoded jwt](./img/jwt/verifying-headers-1.png) + +After adding your public key, you should see a verified signature: + +![httpbin displaying verified jwt](./img/jwt/jwt-payload.png) + +::: + +### 2. 3rd-Party App with Built-In JWT Support + +Many modern platforms (for example, **Grafana**) allow you to configure JWT-based SSO. Once you enable JWT authentication in Grafana (and point it to Pomerium's JWKS endpoint), all inbound requests with a valid `X-Pomerium-Jwt-Assertion` token are accepted for user identity. Grafana (or your chosen app) sees the user's email, groups, etc., and can apply its own RBAC logic. + +For a real-world example, see our [Grafana](/docs/guides/grafana) guide. + +### 3. Custom Application (JWT Libraries or Pomerium SDK) + +If you're building a custom in-house app, you can parse and validate the JWT using a standard library or one of Pomerium's SDKs: + +**Go Example** + + + +**Node/JS Example** + + + +Your application: + +1. Extracts the token from the `X-Pomerium-Jwt-Assertion` header. +2. Uses a JWT library (or Pomerium's SDK) to verify the signature via the JWKS URL. +3. Confirms `aud`, `iss`, and `exp`. +4. Trusts the user claims (like `email`, `groups`, etc.) if valid. + +**Tip:** In Pomerium's JS SDK, if you don't specify `issuer` and `audience`, it applies trust-on-first-use (TOFU) logic. We recommend explicitly setting these in production. + +### 4. Sidecar (Envoy) + +If you can't modify your app's code, run a [Envoy](https://www.envoyproxy.io/) sidecar to check JWTs before requests reach the app. Envoy's [JWT Authn filter](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/jwt_authn_filter) automatically retrieves Pomerium's JWKS and enforces valid tokens. + +```yaml +http_filters: + - name: envoy.filters.http.jwt_authn + typed_config: + '@type': type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication + providers: + pomerium: + issuer: myapp.localhost.pomerium.io + audiences: + - myapp.localhost.pomerium.io + from_headers: + - name: X-Pomerium-Jwt-Assertion + remote_jwks: + http_uri: + uri: https://myapp.localhost.pomerium.io/.well-known/pomerium/jwks.json + cluster: egress-authenticate + timeout: 1s + rules: + - match: + prefix: / + requires: + provider_name: pomerium +``` + +With a sidecar, your main application doesn't need to be JWT-aware. Envoy rejects bad tokens and only forwards valid requests. + +## Conclusion + +JWT-based identity & context verification lets your upstream service confirm each request is coming from a trusted policy enforcement point (Pomerium) and that the user's identity is valid. You can choose whichever approach fits best: + +- **Manual** for debugging or demonstration. +- **3rd-Party app** if it already supports JWT. +- **Custom app** with libraries or Pomerium's SDK. +- **Sidecar** if you can't modify your code. + +Regardless of approach, the result is the same: a zero trust environment where your application is confident every incoming request is from a legitimate user, with valid identity claims. Once verified, you can apply your own additional rules (RBAC, logging, or anything else that uses user context) without re-checking the IdP. diff --git a/content/docs/capabilities/hosted-authenticate-service.md b/content/docs/capabilities/hosted-authenticate-service.md deleted file mode 100644 index bb119c7a4..000000000 --- a/content/docs/capabilities/hosted-authenticate-service.md +++ /dev/null @@ -1,124 +0,0 @@ ---- -id: hosted-authenticate-service -title: Hosted Authenticate Service -sidebar_label: Hosted Authenticate Service -keywords: [hosted authenticate service url, hosted identity provider] -description: Use Pomerium's Hosted Authenticate Service to set up and deploy Pomerium quickly. ---- - -# Hosted Authenticate Service - -Pomerium's **Hosted Authenticate Service** provides a hosted alternative to the self-hosted authenticate service. - -Introduced in Pomerium v0.22, the hosted authenticate service is available for open-source Pomerium, Pomerium Zero, and Pomerium Enterprise. - -## How the hosted authenticate service works - -Pomerium's hosted authenticate service includes a **Hosted Authenticate Service URL** and a **Hosted Identity Provider** that handle authentication and authorization using OAuth 2.0 and OIDC protocols. - -Pomerium Zero, Core, and Enterprise configurations that do not include the self-hosted authenticate service URL or identity provider settings default to the hosted authenticate service settings. See [Configure the hosted authenticate service](#configure-the-hosted-authenticate-service) section for more information. - -## Why use the hosted authenticate service - -The hosted authenticate service offers a quicker way for users to deploy and test Pomerium. - -### No configuration - -The hosted authenticate service doesn't require an authenticate service URL or identity provider settings to use. - -### Less time to deploy - -Pomerium's hosted authenticate service removes the tedium of configuring your own identity provider (IdP) and authenticate service URL so you can deploy Pomerium in less time. - -### Faster proof of concept - -If you're testing Pomerium for the first time, run [Pomerium with Docker](/docs/core/quickstart) using our hosted authenticate service – you can run Pomerium Core in **under 5 minutes** with minimal setup. - -:::enterprise - -Pomerium users who are interested in [Pomerium Enterprise](https://www.pomerium.com/enterprise-sales/) can test out the [Docker Enterprise quickstart](/docs/enterprise/quickstart) using our hosted authenticate service as well. - -::: - -## Configure the hosted authenticate service - -The hosted authenticate service requires no configuration to use. - -Add the following route and policy to your configuration file: - -```yaml title="pomerium-config.yaml" -routes: - - from: https://verify.localhost.pomerium.io - to: http://verify:8000 - policy: - - allow: - or: - - email: - is: user@example.com - pass_identity_headers: true -``` - -This minimal configuration is all you need to connect to an upstream service with Pomerium's hosted services. - -If you want, you can still include the hosted URL in your configuration: - -```yaml title="pomerium-config.yaml" -authenticate_service_url: https://authenticate.pomerium.app - -routes: - - from: https://verify.localhost.pomerium.io - to: http://verify:8000 - policy: - - allow: - or: - - email: - is: user@example.com - pass_identity_headers: true -``` - -If you use the hosted URL and include your own IdP settings, Pomerium will override your IdP configuration and use the hosted IdP instead: - -```yaml title="pomerium-config.yaml" -authenticate_service_url: https://authenticate.pomerium.app - -idp_provider: google -idp_client_id: my_client_id -idp_client_secret: my_client_secret - -routes: - - from: https://verify.localhost.pomerium.io - to: http://verify:8000 - policy: - - allow: - or: - - email: - is: user@example.com - pass_identity_headers: true -``` - -## Limitations - -**Limited sign-in options** - -Currently, you can only authenticate with Google single-sign on or with email and password credentials. - -**Session management** - -The hosted authenticate service is separate from your Pomerium installation. This means you can't refresh session tokens, so users must re-authenticate after roughly one hour. - -**Uptime commitment** - -We make no commitments to uptime for our free hosted authenticate service. - -## Privacy considerations - -Users that take advantage of our hosted authenticate service should review the [Terms of Service agreement](https://www.pomerium.com/pomerium-zero-user-agreement/). - -Specifically, you should be aware that by using our hosted services, you agree to Pomerium collecting the following data: - -- IP address -- OS version -- Internal domain name -- Session details (email, name, and domain) - -We collect this information to better understand how our users interact with and use Pomerium's services. diff --git a/content/docs/capabilities/img/authorization/apply-policies-to-routes.png b/content/docs/capabilities/img/authorization/apply-policies-to-routes.png index 8a2a6df62..12baf5ca2 100644 Binary files a/content/docs/capabilities/img/authorization/apply-policies-to-routes.png and b/content/docs/capabilities/img/authorization/apply-policies-to-routes.png differ diff --git a/content/docs/capabilities/img/authorization/console-devices.png b/content/docs/capabilities/img/authorization/console-devices.png index 3e9de4bae..fedea3ca8 100644 Binary files a/content/docs/capabilities/img/authorization/console-devices.png and b/content/docs/capabilities/img/authorization/console-devices.png differ diff --git a/content/docs/capabilities/img/authorization/enroll-device.png b/content/docs/capabilities/img/authorization/enroll-device.png index a6289e48d..d6835f5ef 100644 Binary files a/content/docs/capabilities/img/authorization/enroll-device.png and b/content/docs/capabilities/img/authorization/enroll-device.png differ diff --git a/content/docs/capabilities/img/authorization/ppl-edit-policy.png b/content/docs/capabilities/img/authorization/ppl-edit-policy.png index a9d859f69..d19fe53f6 100644 Binary files a/content/docs/capabilities/img/authorization/ppl-edit-policy.png and b/content/docs/capabilities/img/authorization/ppl-edit-policy.png differ diff --git a/content/docs/capabilities/img/authorization/ppl-gui-policy.png b/content/docs/capabilities/img/authorization/ppl-gui-policy.png index 2ad563284..79a2e2069 100644 Binary files a/content/docs/capabilities/img/authorization/ppl-gui-policy.png and b/content/docs/capabilities/img/authorization/ppl-gui-policy.png differ diff --git a/content/docs/capabilities/img/authorization/ppl-rego-policy.png b/content/docs/capabilities/img/authorization/ppl-rego-policy.png index 8cb91ed95..0842fa805 100644 Binary files a/content/docs/capabilities/img/authorization/ppl-rego-policy.png and b/content/docs/capabilities/img/authorization/ppl-rego-policy.png differ diff --git a/content/docs/capabilities/img/branding/branded_colors_console.png b/content/docs/capabilities/img/branding/branded_colors_console.png index ffb542305..d666787cb 100644 Binary files a/content/docs/capabilities/img/branding/branded_colors_console.png and b/content/docs/capabilities/img/branding/branded_colors_console.png differ diff --git a/content/docs/capabilities/img/branding/branded_colors_darkmode_console.png b/content/docs/capabilities/img/branding/branded_colors_darkmode_console.png index 7b1bedae1..e935bae84 100644 Binary files a/content/docs/capabilities/img/branding/branded_colors_darkmode_console.png and b/content/docs/capabilities/img/branding/branded_colors_darkmode_console.png differ diff --git a/content/docs/capabilities/img/branding/branded_colors_error_details.png b/content/docs/capabilities/img/branding/branded_colors_error_details.png index 955901cba..13594cb89 100644 Binary files a/content/docs/capabilities/img/branding/branded_colors_error_details.png and b/content/docs/capabilities/img/branding/branded_colors_error_details.png differ diff --git a/content/docs/capabilities/img/branding/enable_error_details.png b/content/docs/capabilities/img/branding/enable_error_details.png index 2cf38cfc7..4ea4dea66 100644 Binary files a/content/docs/capabilities/img/branding/enable_error_details.png and b/content/docs/capabilities/img/branding/enable_error_details.png differ diff --git a/content/docs/capabilities/img/branding/error_details_enabled.png b/content/docs/capabilities/img/branding/error_details_enabled.png index dd7cc1e10..d3e767211 100644 Binary files a/content/docs/capabilities/img/branding/error_details_enabled.png and b/content/docs/capabilities/img/branding/error_details_enabled.png differ diff --git a/content/docs/capabilities/img/branding/first_paragraph_setting.png b/content/docs/capabilities/img/branding/first_paragraph_setting.png index 4dd6032f4..fc1b5871b 100644 Binary files a/content/docs/capabilities/img/branding/first_paragraph_setting.png and b/content/docs/capabilities/img/branding/first_paragraph_setting.png differ diff --git a/content/docs/capabilities/img/branding/includes_first_paragraph.png b/content/docs/capabilities/img/branding/includes_first_paragraph.png index 9c9979d36..fcc860c4b 100644 Binary files a/content/docs/capabilities/img/branding/includes_first_paragraph.png and b/content/docs/capabilities/img/branding/includes_first_paragraph.png differ diff --git a/content/docs/capabilities/img/branding/no_branding_settings.png b/content/docs/capabilities/img/branding/no_branding_settings.png index 41e266a38..17f1ca643 100644 Binary files a/content/docs/capabilities/img/branding/no_branding_settings.png and b/content/docs/capabilities/img/branding/no_branding_settings.png differ diff --git a/content/docs/capabilities/img/branding/policy_with_explanation_and_remediation.png b/content/docs/capabilities/img/branding/policy_with_explanation_and_remediation.png index 25dedf054..63de4b41d 100644 Binary files a/content/docs/capabilities/img/branding/policy_with_explanation_and_remediation.png and b/content/docs/capabilities/img/branding/policy_with_explanation_and_remediation.png differ diff --git a/content/docs/capabilities/img/branding/secondary_color.png b/content/docs/capabilities/img/branding/secondary_color.png index 9840cc13e..f74fd00be 100644 Binary files a/content/docs/capabilities/img/branding/secondary_color.png and b/content/docs/capabilities/img/branding/secondary_color.png differ diff --git a/content/docs/capabilities/img/branding/svg_logo_console.png b/content/docs/capabilities/img/branding/svg_logo_console.png index e0ee38098..8db5dd4df 100644 Binary files a/content/docs/capabilities/img/branding/svg_logo_console.png and b/content/docs/capabilities/img/branding/svg_logo_console.png differ diff --git a/content/docs/capabilities/img/branding/svg_logo_error_details.png b/content/docs/capabilities/img/branding/svg_logo_error_details.png index 133d6fcf3..91901fd37 100644 Binary files a/content/docs/capabilities/img/branding/svg_logo_error_details.png and b/content/docs/capabilities/img/branding/svg_logo_error_details.png differ diff --git a/content/docs/capabilities/img/branding/unbranded_error_page.png b/content/docs/capabilities/img/branding/unbranded_error_page.png index c856e51cb..202a625eb 100644 Binary files a/content/docs/capabilities/img/branding/unbranded_error_page.png and b/content/docs/capabilities/img/branding/unbranded_error_page.png differ diff --git a/content/docs/capabilities/img/custom-domains/add-custom-domain.gif b/content/docs/capabilities/img/custom-domains/add-custom-domain.gif index 8a8a3c964..80ef9e16a 100644 Binary files a/content/docs/capabilities/img/custom-domains/add-custom-domain.gif and b/content/docs/capabilities/img/custom-domains/add-custom-domain.gif differ diff --git a/content/docs/capabilities/img/custom-domains/certificate-details.gif b/content/docs/capabilities/img/custom-domains/certificate-details.gif index cc6ec6677..2d271800a 100644 Binary files a/content/docs/capabilities/img/custom-domains/certificate-details.gif and b/content/docs/capabilities/img/custom-domains/certificate-details.gif differ diff --git a/content/docs/capabilities/img/custom-domains/custom-domain-certificates.png b/content/docs/capabilities/img/custom-domains/custom-domain-certificates.png index 82b0a8343..03f6f1900 100644 Binary files a/content/docs/capabilities/img/custom-domains/custom-domain-certificates.png and b/content/docs/capabilities/img/custom-domains/custom-domain-certificates.png differ diff --git a/content/docs/capabilities/img/custom-domains/gcp-cname-record.png b/content/docs/capabilities/img/custom-domains/gcp-cname-record.png index 36ad2f09a..98f85d581 100644 Binary files a/content/docs/capabilities/img/custom-domains/gcp-cname-record.png and b/content/docs/capabilities/img/custom-domains/gcp-cname-record.png differ diff --git a/content/docs/capabilities/img/directory-sync/device-enrollment.png b/content/docs/capabilities/img/directory-sync/device-enrollment.png deleted file mode 100644 index bde6cf0e5..000000000 Binary files a/content/docs/capabilities/img/directory-sync/device-enrollment.png and /dev/null differ diff --git a/content/docs/capabilities/img/directory-sync/directory-sync-group-criteria.png b/content/docs/capabilities/img/directory-sync/directory-sync-group-criteria.png deleted file mode 100644 index 70bce5637..000000000 Binary files a/content/docs/capabilities/img/directory-sync/directory-sync-group-criteria.png and /dev/null differ diff --git a/content/docs/capabilities/img/directory-sync/directory-sync-idp-tab.gif b/content/docs/capabilities/img/directory-sync/directory-sync-idp-tab.gif deleted file mode 100644 index d0535f629..000000000 Binary files a/content/docs/capabilities/img/directory-sync/directory-sync-idp-tab.gif and /dev/null differ diff --git a/content/docs/capabilities/img/impersonation/add-service-account-to-policy.gif b/content/docs/capabilities/img/impersonation/add-service-account-to-policy.gif index c02c7213c..1971e0e8a 100644 Binary files a/content/docs/capabilities/img/impersonation/add-service-account-to-policy.gif and b/content/docs/capabilities/img/impersonation/add-service-account-to-policy.gif differ diff --git a/content/docs/capabilities/img/impersonation/create-service-account.gif b/content/docs/capabilities/img/impersonation/create-service-account.gif index 66392bb91..e0a5baa39 100644 Binary files a/content/docs/capabilities/img/impersonation/create-service-account.gif and b/content/docs/capabilities/img/impersonation/create-service-account.gif differ diff --git a/content/docs/capabilities/img/impersonation/impersonation.gif b/content/docs/capabilities/img/impersonation/impersonation.gif index fcfea1ceb..7752a58dc 100644 Binary files a/content/docs/capabilities/img/impersonation/impersonation.gif and b/content/docs/capabilities/img/impersonation/impersonation.gif differ diff --git a/content/docs/capabilities/img/jwt-authn/jwt-authentication.svg b/content/docs/capabilities/img/jwt-authn/jwt-authentication.svg index 8764aee91..7a7bdecc7 100644 --- a/content/docs/capabilities/img/jwt-authn/jwt-authentication.svg +++ b/content/docs/capabilities/img/jwt-authn/jwt-authentication.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/content/docs/capabilities/img/jwt/inspect-headers.png b/content/docs/capabilities/img/jwt/inspect-headers.png new file mode 100644 index 000000000..26ad49b04 Binary files /dev/null and b/content/docs/capabilities/img/jwt/inspect-headers.png differ diff --git a/content/docs/capabilities/img/jwt/jwt-payload.png b/content/docs/capabilities/img/jwt/jwt-payload.png new file mode 100644 index 000000000..3e8905487 Binary files /dev/null and b/content/docs/capabilities/img/jwt/jwt-payload.png differ diff --git a/content/docs/capabilities/img/jwt/verifying-headers-1.png b/content/docs/capabilities/img/jwt/verifying-headers-1.png new file mode 100644 index 000000000..3e5b196f2 Binary files /dev/null and b/content/docs/capabilities/img/jwt/verifying-headers-1.png differ diff --git a/content/docs/capabilities/img/kubernetes/kubernetes-auth-jwt.svg b/content/docs/capabilities/img/kubernetes/kubernetes-auth-jwt.svg index f2974ebeb..f0cd1494b 100644 --- a/content/docs/capabilities/img/kubernetes/kubernetes-auth-jwt.svg +++ b/content/docs/capabilities/img/kubernetes/kubernetes-auth-jwt.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/content/docs/capabilities/img/kubernetes/kubernetes-integration.svg b/content/docs/capabilities/img/kubernetes/kubernetes-integration.svg index d80842a95..3dfad2220 100644 --- a/content/docs/capabilities/img/kubernetes/kubernetes-integration.svg +++ b/content/docs/capabilities/img/kubernetes/kubernetes-integration.svg @@ -1,3 +1 @@ - - -

user@domain.com

user@dom...
exec
exec
request with pomerium
session token
request with pomerium...
kubectl
kubectl
retrieve user
session token
retrieve user...
pomerium-cli
pomerium-cli
impersonate
user@domain.com
impersonate...
pomerium
service
account
pomerium...
API
Server
API...
user
impersonation
role
user...
user@domain.com
user@doma...
user role
user role
Viewer does not support full SVG 1.1
\ No newline at end of file +

user@domain.com

user@dom...
exec
exec
request with pomerium
session token
request with pomerium...
kubectl
kubectl
retrieve user
session token
retrieve user...
pomerium-cli
pomerium-cli
impersonate
user@domain.com
impersonate...
pomerium
service
account
pomerium...
API
Server
API...
user
impersonation
role
user...
user@domain.com
user@doma...
user role
user role
Viewer does not support full SVG 1.1
\ No newline at end of file diff --git a/content/docs/capabilities/img/logged-in-as.png b/content/docs/capabilities/img/logged-in-as.png index 7de800a74..3eef6af88 100644 Binary files a/content/docs/capabilities/img/logged-in-as.png and b/content/docs/capabilities/img/logged-in-as.png differ diff --git a/content/docs/capabilities/img/metrics/enterprise-authorized-requests.png b/content/docs/capabilities/img/metrics/enterprise-authorized-requests.png deleted file mode 100644 index b840f5ff6..000000000 Binary files a/content/docs/capabilities/img/metrics/enterprise-authorized-requests.png and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/enterprise-filter-traffic.gif b/content/docs/capabilities/img/metrics/enterprise-filter-traffic.gif deleted file mode 100644 index 64ebdae34..000000000 Binary files a/content/docs/capabilities/img/metrics/enterprise-filter-traffic.gif and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/enterprise-healthy-upstream-endpoints-graph.png b/content/docs/capabilities/img/metrics/enterprise-healthy-upstream-endpoints-graph.png deleted file mode 100644 index b6baf1fd4..000000000 Binary files a/content/docs/capabilities/img/metrics/enterprise-healthy-upstream-endpoints-graph.png and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/enterprise-metrics-namespaces.gif b/content/docs/capabilities/img/metrics/enterprise-metrics-namespaces.gif deleted file mode 100644 index 11be1dbc8..000000000 Binary files a/content/docs/capabilities/img/metrics/enterprise-metrics-namespaces.gif and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/enterprise-percentile-ranges.gif b/content/docs/capabilities/img/metrics/enterprise-percentile-ranges.gif deleted file mode 100644 index 7695de2b4..000000000 Binary files a/content/docs/capabilities/img/metrics/enterprise-percentile-ranges.gif and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/enterprise-request-duration.png b/content/docs/capabilities/img/metrics/enterprise-request-duration.png deleted file mode 100644 index b5c371a5e..000000000 Binary files a/content/docs/capabilities/img/metrics/enterprise-request-duration.png and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/enterprise-request-rate.png b/content/docs/capabilities/img/metrics/enterprise-request-rate.png deleted file mode 100644 index 4840d79d9..000000000 Binary files a/content/docs/capabilities/img/metrics/enterprise-request-rate.png and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/enterprise-request-size.png b/content/docs/capabilities/img/metrics/enterprise-request-size.png deleted file mode 100644 index 7daf84b20..000000000 Binary files a/content/docs/capabilities/img/metrics/enterprise-request-size.png and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/enterprise-response-status-codes.gif b/content/docs/capabilities/img/metrics/enterprise-response-status-codes.gif deleted file mode 100644 index 9bb7a357d..000000000 Binary files a/content/docs/capabilities/img/metrics/enterprise-response-status-codes.gif and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/enterprise-total-requests.png b/content/docs/capabilities/img/metrics/enterprise-total-requests.png deleted file mode 100644 index 79e5e0af4..000000000 Binary files a/content/docs/capabilities/img/metrics/enterprise-total-requests.png and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/reports-runtime-fullpage.png b/content/docs/capabilities/img/metrics/reports-runtime-fullpage.png deleted file mode 100644 index d48cc46eb..000000000 Binary files a/content/docs/capabilities/img/metrics/reports-runtime-fullpage.png and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/reports-runtime.png b/content/docs/capabilities/img/metrics/reports-runtime.png deleted file mode 100644 index 061518029..000000000 Binary files a/content/docs/capabilities/img/metrics/reports-runtime.png and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/reports-sessions-fullpage.png b/content/docs/capabilities/img/metrics/reports-sessions-fullpage.png deleted file mode 100644 index fbdb39a38..000000000 Binary files a/content/docs/capabilities/img/metrics/reports-sessions-fullpage.png and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/zero-authorized-and-denied-chart.png b/content/docs/capabilities/img/metrics/zero-authorized-and-denied-chart.png deleted file mode 100644 index d053c919c..000000000 Binary files a/content/docs/capabilities/img/metrics/zero-authorized-and-denied-chart.png and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/zero-bytes-sent-received.png b/content/docs/capabilities/img/metrics/zero-bytes-sent-received.png deleted file mode 100644 index bc6626245..000000000 Binary files a/content/docs/capabilities/img/metrics/zero-bytes-sent-received.png and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/zero-changesets.png b/content/docs/capabilities/img/metrics/zero-changesets.png deleted file mode 100644 index 538fd8c46..000000000 Binary files a/content/docs/capabilities/img/metrics/zero-changesets.png and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/zero-deployments-changesets.gif b/content/docs/capabilities/img/metrics/zero-deployments-changesets.gif deleted file mode 100644 index 2504c6e00..000000000 Binary files a/content/docs/capabilities/img/metrics/zero-deployments-changesets.gif and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/zero-filter-traffic.gif b/content/docs/capabilities/img/metrics/zero-filter-traffic.gif deleted file mode 100644 index b2f034fec..000000000 Binary files a/content/docs/capabilities/img/metrics/zero-filter-traffic.gif and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/zero-find-metrics.gif b/content/docs/capabilities/img/metrics/zero-find-metrics.gif deleted file mode 100644 index 81a4f8efd..000000000 Binary files a/content/docs/capabilities/img/metrics/zero-find-metrics.gif and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/zero-find-traffic-dashboard.png b/content/docs/capabilities/img/metrics/zero-find-traffic-dashboard.png deleted file mode 100644 index 6a3a04c3c..000000000 Binary files a/content/docs/capabilities/img/metrics/zero-find-traffic-dashboard.png and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/zero-request-duration-second-chart.png b/content/docs/capabilities/img/metrics/zero-request-duration-second-chart.png deleted file mode 100644 index ce82f4192..000000000 Binary files a/content/docs/capabilities/img/metrics/zero-request-duration-second-chart.png and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/zero-request-duration.png b/content/docs/capabilities/img/metrics/zero-request-duration.png deleted file mode 100644 index 18b83d588..000000000 Binary files a/content/docs/capabilities/img/metrics/zero-request-duration.png and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/zero-requests-per-second.png b/content/docs/capabilities/img/metrics/zero-requests-per-second.png deleted file mode 100644 index 3970421f6..000000000 Binary files a/content/docs/capabilities/img/metrics/zero-requests-per-second.png and /dev/null differ diff --git a/content/docs/capabilities/img/metrics/zero-total-and-authorized-requests.png b/content/docs/capabilities/img/metrics/zero-total-and-authorized-requests.png deleted file mode 100644 index 2cc0cf884..000000000 Binary files a/content/docs/capabilities/img/metrics/zero-total-and-authorized-requests.png and /dev/null differ diff --git a/content/docs/capabilities/img/mtls/01-chrome-settings-certificates.png b/content/docs/capabilities/img/mtls/01-chrome-settings-certificates.png deleted file mode 100644 index a5a38359d..000000000 Binary files a/content/docs/capabilities/img/mtls/01-chrome-settings-certificates.png and /dev/null differ diff --git a/content/docs/capabilities/img/mtls/02-import-client-certificate.png b/content/docs/capabilities/img/mtls/02-import-client-certificate.png deleted file mode 100644 index 1f96e3426..000000000 Binary files a/content/docs/capabilities/img/mtls/02-import-client-certificate.png and /dev/null differ diff --git a/content/docs/capabilities/img/mtls/03-enter-certificate-password.png b/content/docs/capabilities/img/mtls/03-enter-certificate-password.png deleted file mode 100644 index 9b1fa24ae..000000000 Binary files a/content/docs/capabilities/img/mtls/03-enter-certificate-password.png and /dev/null differ diff --git a/content/docs/capabilities/img/mtls/04-certificate-list.png b/content/docs/capabilities/img/mtls/04-certificate-list.png deleted file mode 100644 index 6f04e3be8..000000000 Binary files a/content/docs/capabilities/img/mtls/04-certificate-list.png and /dev/null differ diff --git a/content/docs/capabilities/img/mtls/05-select-client-certificate.png b/content/docs/capabilities/img/mtls/05-select-client-certificate.png deleted file mode 100644 index d71b628c7..000000000 Binary files a/content/docs/capabilities/img/mtls/05-select-client-certificate.png and /dev/null differ diff --git a/content/docs/capabilities/img/mtls/openssl-test1.png b/content/docs/capabilities/img/mtls/openssl-test1.png deleted file mode 100644 index 76ad069fd..000000000 Binary files a/content/docs/capabilities/img/mtls/openssl-test1.png and /dev/null differ diff --git a/content/docs/capabilities/img/ppl/exists-operator.png b/content/docs/capabilities/img/ppl/exists-operator.png deleted file mode 100644 index 9a95d19d9..000000000 Binary files a/content/docs/capabilities/img/ppl/exists-operator.png and /dev/null differ diff --git a/content/docs/capabilities/img/ppl/numerical-comparison-operators.png b/content/docs/capabilities/img/ppl/numerical-comparison-operators.png deleted file mode 100644 index 1140e5e76..000000000 Binary files a/content/docs/capabilities/img/ppl/numerical-comparison-operators.png and /dev/null differ diff --git a/content/docs/capabilities/img/reports/reports-deployments-diff.png b/content/docs/capabilities/img/reports/reports-deployments-diff.png index cd5738de9..c1ea9241b 100644 Binary files a/content/docs/capabilities/img/reports/reports-deployments-diff.png and b/content/docs/capabilities/img/reports/reports-deployments-diff.png differ diff --git a/content/docs/capabilities/img/reports/reports-traffic-fullpage.png b/content/docs/capabilities/img/reports/reports-traffic-fullpage.png index 8c8055bb6..fc97119db 100644 Binary files a/content/docs/capabilities/img/reports/reports-traffic-fullpage.png and b/content/docs/capabilities/img/reports/reports-traffic-fullpage.png differ diff --git a/content/docs/capabilities/img/routing/migrate-routes.png b/content/docs/capabilities/img/routing/migrate-routes.png index cd4eb0361..8a9fff08a 100644 Binary files a/content/docs/capabilities/img/routing/migrate-routes.png and b/content/docs/capabilities/img/routing/migrate-routes.png differ diff --git a/content/docs/capabilities/img/service-accounts/add-service-account.png b/content/docs/capabilities/img/service-accounts/add-service-account.png index bbdccdd5b..ebb1e3f55 100644 Binary files a/content/docs/capabilities/img/service-accounts/add-service-account.png and b/content/docs/capabilities/img/service-accounts/add-service-account.png differ diff --git a/content/docs/capabilities/img/service-accounts/console-service-account.png b/content/docs/capabilities/img/service-accounts/console-service-account.png index b78fb4656..28d1c6c1c 100644 Binary files a/content/docs/capabilities/img/service-accounts/console-service-account.png and b/content/docs/capabilities/img/service-accounts/console-service-account.png differ diff --git a/content/docs/capabilities/img/service-accounts/create-policy-1.png b/content/docs/capabilities/img/service-accounts/create-policy-1.png index 62138b390..a2d4f3fc4 100644 Binary files a/content/docs/capabilities/img/service-accounts/create-policy-1.png and b/content/docs/capabilities/img/service-accounts/create-policy-1.png differ diff --git a/content/docs/capabilities/img/service-accounts/create-policy-2.png b/content/docs/capabilities/img/service-accounts/create-policy-2.png index 32f9c221f..e064006ec 100644 Binary files a/content/docs/capabilities/img/service-accounts/create-policy-2.png and b/content/docs/capabilities/img/service-accounts/create-policy-2.png differ diff --git a/content/docs/capabilities/img/service-accounts/create-service-account.png b/content/docs/capabilities/img/service-accounts/create-service-account.png index 2d5505b7e..ddb2d3c8f 100644 Binary files a/content/docs/capabilities/img/service-accounts/create-service-account.png and b/content/docs/capabilities/img/service-accounts/create-service-account.png differ diff --git a/content/docs/capabilities/img/service-accounts/service-account-jwt.png b/content/docs/capabilities/img/service-accounts/service-account-jwt.png index 7aa664734..d072c8d53 100644 Binary files a/content/docs/capabilities/img/service-accounts/service-account-jwt.png and b/content/docs/capabilities/img/service-accounts/service-account-jwt.png differ diff --git a/content/docs/capabilities/img/single-sign-out/sign-out-flow.svg b/content/docs/capabilities/img/single-sign-out/sign-out-flow.svg index d2ab55d3d..f155933f6 100644 --- a/content/docs/capabilities/img/single-sign-out/sign-out-flow.svg +++ b/content/docs/capabilities/img/single-sign-out/sign-out-flow.svg @@ -1,5240 +1 @@ - - - - + \ No newline at end of file diff --git a/content/docs/capabilities/img/verifying-headers-2.png b/content/docs/capabilities/img/verifying-headers-2.png index 67883ef7a..74164a2e0 100644 Binary files a/content/docs/capabilities/img/verifying-headers-2.png and b/content/docs/capabilities/img/verifying-headers-2.png differ diff --git a/content/docs/capabilities/img/webauthn/450-error.png b/content/docs/capabilities/img/webauthn/450-error.png deleted file mode 100644 index be361bafd..000000000 Binary files a/content/docs/capabilities/img/webauthn/450-error.png and /dev/null differ diff --git a/content/docs/capabilities/img/webauthn/admin-enroll-1.png b/content/docs/capabilities/img/webauthn/admin-enroll-1.png deleted file mode 100644 index 7cdc2e80b..000000000 Binary files a/content/docs/capabilities/img/webauthn/admin-enroll-1.png and /dev/null differ diff --git a/content/docs/capabilities/img/webauthn/device-credentials-empty-highlight.png b/content/docs/capabilities/img/webauthn/device-credentials-empty-highlight.png deleted file mode 100644 index e2e09d548..000000000 Binary files a/content/docs/capabilities/img/webauthn/device-credentials-empty-highlight.png and /dev/null differ diff --git a/content/docs/capabilities/img/webauthn/device-id-list.png b/content/docs/capabilities/img/webauthn/device-id-list.png deleted file mode 100644 index 3bc3597c3..000000000 Binary files a/content/docs/capabilities/img/webauthn/device-id-list.png and /dev/null differ diff --git a/content/docs/capabilities/img/webauthn/enrollment-created.png b/content/docs/capabilities/img/webauthn/enrollment-created.png deleted file mode 100644 index b53c2df92..000000000 Binary files a/content/docs/capabilities/img/webauthn/enrollment-created.png and /dev/null differ diff --git a/content/docs/capabilities/img/webauthn/new-enrollment.png b/content/docs/capabilities/img/webauthn/new-enrollment.png deleted file mode 100644 index bc06cbd01..000000000 Binary files a/content/docs/capabilities/img/webauthn/new-enrollment.png and /dev/null differ diff --git a/content/docs/capabilities/img/webauthn/no-device.png b/content/docs/capabilities/img/webauthn/no-device.png deleted file mode 100644 index b2cd41967..000000000 Binary files a/content/docs/capabilities/img/webauthn/no-device.png and /dev/null differ diff --git a/content/docs/capabilities/img/webauthn/security-key-chromebook.png b/content/docs/capabilities/img/webauthn/security-key-chromebook.png deleted file mode 100644 index 47565fd78..000000000 Binary files a/content/docs/capabilities/img/webauthn/security-key-chromebook.png and /dev/null differ diff --git a/content/docs/capabilities/img/webauthn/security-key-firefox.png b/content/docs/capabilities/img/webauthn/security-key-firefox.png deleted file mode 100644 index 488b0f580..000000000 Binary files a/content/docs/capabilities/img/webauthn/security-key-firefox.png and /dev/null differ diff --git a/content/docs/capabilities/img/webauthn/security-key-google.png b/content/docs/capabilities/img/webauthn/security-key-google.png deleted file mode 100644 index 9176f024b..000000000 Binary files a/content/docs/capabilities/img/webauthn/security-key-google.png and /dev/null differ diff --git a/content/docs/capabilities/img/webauthn/security-key-windows.png b/content/docs/capabilities/img/webauthn/security-key-windows.png deleted file mode 100644 index 3b54dadcf..000000000 Binary files a/content/docs/capabilities/img/webauthn/security-key-windows.png and /dev/null differ diff --git a/content/docs/capabilities/kubernetes-access.mdx b/content/docs/capabilities/kubernetes-access.mdx index 29d032de8..dc1429af8 100644 --- a/content/docs/capabilities/kubernetes-access.mdx +++ b/content/docs/capabilities/kubernetes-access.mdx @@ -2,7 +2,7 @@ # cSpell:ignore kubeconfig mycluster title: Kubernetes `kubectl` Integration -sidebar_label: Kubernetes Access +sidebar_label: Kubernetes Access Management description: This article describes Pomerium's integration with the Kubernetes API Server --- @@ -83,7 +83,7 @@ rules: 2. A [route's policy](/docs/reference/routes/policy) is created for the API server and [configured](/docs/reference/routes/kubernetes-service-account-token) to use the service account token 3. Kubernetes RoleBindings operate against IdP Users and Group subjects -4. Users access the protected cluster through their standard tools, using [pomerium-cli](/docs/clients/pomerium-cli) as an auth provider in `~/.kube/config` +4. Users access the protected cluster through their standard tools, using [pomerium-cli](/docs/deploy/clients) as an auth provider in `~/.kube/config` 5. Pomerium authorizes requests and passes the user identity to the API server for fine grained RBAC @@ -215,7 +215,7 @@ Then, your user should be authorized: ## Kubeconfig Setup -Edit your kubeconfig to use [pomerium-cli](/docs/clients/pomerium-cli) as a [credential plugin](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins): +Edit your kubeconfig to use [pomerium-cli](/docs/deploy/clients) as a [credential plugin](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins): ```yaml apiVersion: v1 diff --git a/content/docs/capabilities/load-balancing.md b/content/docs/capabilities/load-balancing.md deleted file mode 100644 index e072b530b..000000000 --- a/content/docs/capabilities/load-balancing.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: Upstream Load Balancing -sidebar_label: Load Balancing -description: This article covers Pomerium built-in load balancing capabilities in presence of multiple upstream servers. ---- - -# Upstream Load Balancing - -This article covers Pomerium built-in load balancing capabilities in presence of multiple upstream servers. - -## Multiple Upstream Servers - -You may specify multiple servers for your upstream application, and Pomerium would load balance user requests between them. - -```yaml -routes: - - from: https://myapp.localhost.pomerium.io - to: - - http://myapp-srv-1:8080 - - http://myapp-srv-2:8080 -``` - -:::tip - -In the presence of multiple upstream servers, make sure to specify either an active or passive health check, or both, to avoid requests being served to an unhealthy backend. - -::: - -## Active Health Checks - -Active health checks issue periodic requests to each upstream to determine its health. See the [Envoy Health Checking documentation](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/health_checking) for a comprehensive overview. - -For example configurations in Pomerium, see the [Load Balancing](/docs/reference/routes/load-balancing#health-checks) reference page. - -## Passive Health Checks - -Passive health check tries to deduce upstream server health based on recent observed responses. See [Outlier Detection](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/outlier) for comprehensive overview. - -```yaml -routes: - - from: https://myapp.localhost.pomerium.io - to: - - http://myapp-srv-1:8080 - - http://myapp-srv-2:8080 - outlier_detection: {} -``` - -## Load Balancing Method - -`lb_policy` should be set to [one of the values](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers): - -- [`ROUND_ROBIN`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-round-robin) (default) -- [`LEAST_REQUEST`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-least-request) and may be further configured using [`least_request_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-leastrequestlbconfig) -- [`RING_HASH`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#ring-hash) and may be further configured using [`ring_hash_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-ringhashlbconfig) option -- [`RANDOM`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#random) -- [`MAGLEV`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#maglev) and may be further configured using [`maglev_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-maglevlbconfig) option - -### Example - -```yaml -routes: - - from: https://myapp.localhost.pomerium.io - to: - - http://myapp-srv-1:8080 - - http://myapp-srv-2:8080 - - http://myapp-srv-3:8080 - - http://myapp-srv-4:8080 - - http://myapp-srv-5:8080 - lb_policy: LEAST_REQUEST - least_request_lb_config: - choice_count: 2 # current envoy default -``` - -## Load Balancing Weight - -When a list of upstream URLs is specified in the `to` field, you may append an optional load balancing weight parameter. The individual [`lb_policy`](#load-balancing-method) settings will take this weighting into account when making routing decisions. - -### Example - -This configuration uses the default `round_robin` load balancer policy but specifies different frequency of selection be applied to the upstream servers. - -```yaml -routes: - - from: https://myapp.localhost.pomerium.io - to: - - http://myapp-srv-1:8080,10 - - http://myapp-srv-2:8080,20 - - http://myapp-srv-3:8080,30 - - http://myapp-srv-4:8080,20 - - http://myapp-srv-5:8080,10 -``` - -## Further reading - -- [Introduction to modern network load balancing and proxying](https://blog.envoyproxy.io/introduction-to-modern-network-load-balancing-and-proxying-a57f6ff80236) diff --git a/content/docs/capabilities/mtls-clients.mdx b/content/docs/capabilities/mtls-clients.mdx deleted file mode 100644 index f8d183335..000000000 --- a/content/docs/capabilities/mtls-clients.mdx +++ /dev/null @@ -1,186 +0,0 @@ ---- -# cSpell:ignore caroot changeit - -title: Downstream mutual TLS (mTLS) with Pomerium -sidebar_label: Downstream mTLS (clients) -lang: en-US -keywords: - [ - pomerium, - identity access proxy, - mtls, - client certificate, - mutual authentication, - server certificate, - tls certificate, - ] -description: This guide covers how to use Pomerium to require mutual TLS authentication (mTLS) for end users, using client certificates with a custom certificate authority. ---- - -import Tabs from '@theme/Tabs'; -import TabItem from '@theme/TabItem'; - -Downstream mutual TLS (mTLS) refers to a requirement that end users must present a trusted client certificate when connecting to services secured by Pomerium. - -With ordinary TLS, only the server presents a certificate. This allows the client to verify the identity of the server before proceeding with the connection, ensuring that the connection between the client and server is not only private (encrypted) but also authenticated. - -With mTLS, the client must also present a certificate. The server will allow requests only when the client presents a certificate that it recognizes as trusted. This capability can be used to provide an additional layer of security. - -:::note - -Pomerium uses the term "downstream mTLS" when referring to the connection between end users and Pomerium, and "upstream mTLS" when referring to the connection between Pomerium and the services protected by Pomerium. (See [Upstream mTLS](/docs/capabilities/mtls-services) for more information on the latter.) - -::: - -Enabling downstream mTLS in Pomerium requires all clients to authenticate themselves by providing a trusted client certificate during the initial connection. Only after Pomerium successfully verifies the client certificate will it permit access to the configured routes. - -This guide shows you how to configure Pomerium to enable mTLS using client certificates issued by a private certificate authority. - -## Before You Begin - -To complete this guide, you will need: - -- A working Pomerium instance. Complete the [Pomerium Core quickstart](/docs/quickstart) with Docker for a quick proof of concept to test with this guide. -- [`mkcert`](https://github.com/FiloSottile/mkcert#installation) to issue certificates from a locally-trusted certificate authority (CA) - -:::caution - -The `mkcert` tool is designed for testing: It creates a locally-trusted root certificate for development purposes. This guide uses `mkcert` for a proof-of-concept example, but a production deployment will require a more sophisticated certificate management solution. - -::: - -## Configure Pomerium with a server certificate - -:::tip **Note** - -If your Pomerium instance already has a server certificate configured, you can skip to the [Create a client certificate](#create-client-cert) step. - -::: - -This guide uses the domain `localhost.pomerium.io` as Pomerium's root domain (all subdomains under `localhost.pomerium.io` resolve to localhost). - -### Create a root CA - -If you haven’t yet, install `mkcert` following [these instructions](https://github.com/FiloSottile/mkcert#installation). - -Create a trusted **root CA**: - -```bash -mkcert -install -``` - -### Create a wildcard TLS certificate - -Run the following command to create a wildcard server certificate for `*.localhost.pomerium.io`: - -```bash -mkcert '*.localhost.pomerium.io' -``` - -This creates two files in the current working directory: - -- `_wildcard.localhost.pomerium.io.pem` -- `_wildcard.localhost.pomerium.io-key.pem` - -`_wildcard.localhost.pomerium.io.pem` is the certificate, which contains a public key bound to the DNS name `*.localhost.pomerium.io`. - -`_wildcard.localhost.pomerium.io-key.pem` is the corresponding private key. - -### Update Pomerium configuration - -Update the `config.yaml` file or environment variables with your wildcard certificate. If running Pomerium in Docker, you will need to bind mount these files or copy them into the container and update the file paths accordingly. - - - - -```yaml -certificate_file: '_wildcard.localhost.pomerium.io.pem' -certificate_key_file: '_wildcard.localhost.pomerium.io-key.pem' -``` - - - - -```bash -CERTIFICATE_FILE="_wildcard.localhost.pomerium.io.pem" -CERTIFICATE_KEY_FILE="_wildcard.localhost.pomerium.io-key.pem" -``` - - - - -## Create a client certificate {#create-client-cert} - -If you haven’t yet, install `mkcert` following [these instructions](https://github.com/FiloSottile/mkcert#installation). - -Then, to create a client certificate, run the following command: - -```bash -mkcert -client -pkcs12 'yourUsername@localhost.pomerium.io' -``` - -This creates a new file in the current working directory, containing both the client certificate and the corresponding private key: - -- `yourUsername@localhost.pomerium.io-client.p12` - -(Note that the root CA created by `mkcert` does not need to be installed into the system trust store in order to be used as a trusted CA by Pomerium.) - -## Configure Pomerium to require mTLS - -Update the `config.yaml` file or environment variables to trust only certificates issued by your `mkcert` root CA. To find the path to the root CA certificate created by `mkcert`, run the following command: - -```bash -echo "$(mkcert -CAROOT)/rootCA.pem" -``` - -If running Pomerium in Docker, you will need to bind mount this file or copy it into the container (and update the file path accordingly). - - - - -```yaml -downstream_mtls: - ca_file: '/YOUR/MKCERT/CAROOT/rootCA.pem' -``` - - - - -```bash -DOWNSTREAM_MTLS_CA_FILE="/YOUR/MKCERT/CAROOT/rootCA.pem" -``` - - - - -(See the [Downstream mTLS Settings](/docs/reference/downstream-mtls-settings) reference page for more details about the available mTLS settings.) - -Your Pomerium instance should now require a client certificate in order to access any configured routes. If you attempt to access any route from your browser, you should now see a Pomerium error page. - -## Install your client certificate - -Now you'll need to install the client certificate you created earlier. The following instructions are for Chrome on Linux, but client certificates are supported in all major browsers. - -1. Go to `chrome://settings/certificates`: - - ![chrome settings](img/mtls/01-chrome-settings-certificates.png) - -1. Click on **Import** and browse to the directory where you created the certificates above. Choose `yourUsername@localhost.pomerium.io-client.p12`: - - ![import client certificate](img/mtls/02-import-client-certificate.png) - -1. You will be prompted for the certificate password. The default password set by `mkcert` is **`changeit`**: - - ![enter certificate password](img/mtls/03-enter-certificate-password.png) - -1. The **org-mkcert development certificate** should now be in your list of certificates: - - ![certificate list](img/mtls/04-certificate-list.png) - -## Using the client certificate - -Visit https://verify.localhost.pomerium.io (or another route you've defined). You should be prompted to choose a client certificate: - -![choose client certificate](img/mtls/05-select-client-certificate.png) - -After selecting this certificate, Pomerium should now allow you to access this route. diff --git a/content/docs/capabilities/mtls-services.mdx b/content/docs/capabilities/mtls-services.mdx deleted file mode 100644 index ba44acf30..000000000 --- a/content/docs/capabilities/mtls-services.mdx +++ /dev/null @@ -1,195 +0,0 @@ ---- -title: Upstream mutual TLS (mTLS) with Pomerium -sidebar_label: Upstream mTLS (services) -lang: en-US -keywords: - [ - pomerium, - identity access proxy, - mtls, - client certificate, - mutual authentication, - upstream mTLS, - ] -description: This guide covers how to configure Pomerium to provide mutual authentication (mTLS) to an upstream service, using client certificates with a custom certificate authority. ---- - -import InstallMkcert from '@site/content/_install-mkcert.md'; - - - -As a reverse proxy, Pomerium is designed to manage access to your applications and services. At a minimum, Pomerium authenticates and authorizes each request to access these upstream resources. - -While this will keep unauthorized users from accessing your upstream applications, it does not authenticate the upstream service itself. Part of creating a zero-trust security model means securing communication between your identity-aware access proxy (Pomerium) and the upstream service it provides access to. - -This means Pomerium and the upstream service should authenticate each other. - -## How Pomerium authenticates upstream services - -Pomerium confirms the identity of an upstream service by verifying the service’s TLS certificate. (See [tls_custom_ca_file](/docs/reference/routes/tls#tls-custom-certificate-authority) and [tls_upstream_server_name](/docs/reference/routes/tls#tls-upstream-server-name) for more information on configuring Pomerium to accept an upstream's TLS certificate.) - -Generally, every organization has a preferred method of managing internal certificates. How an upstream service is configured to validate and accept client certificates is entirely up to that specific service and how it's configured. - -To provide a general explanation, in this guide you will use [mkcert](https://github.com/FiloSottile/mkcert) to provide the client certificate to Pomerium, and [OpenSSL](https://www.openssl.org/) as the upstream service. - -## Before you begin - -To complete this proof-of-concept guide: - -- Run Pomerium in [all-in-one mode](/docs/internals/configuration#all-in-one-vs-split-service-mode) as a system service with a configuration file in the [standard location](/docs/core/from-source#configure) -- Configure an [identity provider](/docs/identity-providers) (IdP) to communicate with your Pomerium instance -- Run all commands on the same host (You may have to move files or adjust paths and commands to match a different configuration) -- Install [`mkcert`](https://github.com/FiloSottile/mkcert) to generate self-signed certificates and a root Certificate Authority (CA) (`mkcert` will take the place of your trusted certificate tooling solution) -- Use `*.localhost.pomerium.io` as the placeholder for the Pomerium domain space - -## Create certificates - -This guide uses the `localhost.pomerium.io` domain as the root domain (all subdomains on `localhost.pomerium.io` point to localhost). - -### Create a root CA - - - -### Create OpenSSL certificate and key - -1. Create a certificate and key for your example upstream service, OpenSSL: - - ```shell-session - $ mkcert openssl.localhost - - Created a new certificate valid for the following names 📜 - - "openssl.localhost" - - The certificate is at "./openssl.localhost.pem" and the key at "./openssl.localhost-key.pem" ✅ - - It will expire on 10 March 2024 🗓 - ``` - -1. Create a client certificate and key for Pomerium to use: - - ```shell-session - $ mkcert -client 'pomerium@localhost' - - Created a new certificate valid for the following names 📜 - - "pomerium@localhost" - - The certificate is at "./pomerium@localhost-client.pem" and the key at "./pomerium@localhost-client-key.pem" ✅ - - It will expire on 10 March 2024 🗓 - ``` - -1. Change ownership of the client certificate files and move them to Pomerium's configuration directory: - - ```shell-session - $ sudo chown pomerium:pomerium pomerium@localhost-client*pem /etc/pomerium - $ sudo mv pomerium@localhost-client*pem /etc/pomerium/ - ``` - -## Configure OpenSSL server - -OpenSSL is installed or easily available for most 'nix-based operating systems like macOS and Linux. In this demo, it will take the place of an upstream service with mTLS support. - -1. In a terminal environment and the same directory where you created the certificate files, start an OpenSSL server process. Note that it will run in the foreground until stopped, so you will need another terminal environment to run additional commands: - - ```shell-session - $ openssl s_server -key ./openssl.localhost-key.pem -cert ./openssl.localhost.pem -accept 44330 -www - ``` - - You can confirm that the server is responding using `curl`: - - ```shell-session - $ curl -k https://localhost:44330 - -
-
-   s_server -key ./openssl.localhost-key.pem -cert ./openssl.localhost.pem -accept 44330 -www
-   Secure Renegotiation IS supported
-   Ciphers supported in s_server binary
-   ...
-   ```
-
-   :::tip
-
-   Even though OpenSSL is providing a certificate signed by a CA in your trust store, you need the `-k` flag because the domain name `localhost` doesn't match `openssl.localhost` defined in your certificate.
-
-   :::
-
-## Configure Pomerium
-
-1. Update the `config.yaml` file in `/etc/pomerium` with a new route for this upstream service:
-
-   ```yaml title="config.yaml"
-   - from: https://openssl.localhost.pomerium.io
-     to: https://localhost:44330
-     tls_upstream_server_name: openssl.localhost
-     policy:
-       - allow:
-           or:
-             - email:
-                 is: user@example.com
-   ```
-
-   Pomerium should automatically process changes when the configuration file is updated.
-
-1. Visit [https://openssl.localhost.pomerium.io](https://openssl.localhost.pomerium.io) in your browser to confirm the route:
-
-   ![OpenSSL Upstream without client certificate verification](./img/mtls/openssl-test1.png)
-
-   Note the last line:
-
-   > no client certificate available
-
-   In the next section, you'll adjust the OpenSSL server to require a client certificate and edit your Pomerium configuration to provide one.
-
-## Install Pomerium client certificate
-
-1. Stop the OpenSSL server process (**Ctrl+C**) and start a new one with the additional flag `-Verify 1`:
-
-   ```shell-session
-   $ openssl s_server -Verify 1 -key ./openssl.localhost-key.pem -cert ./openssl.localhost.pem -accept 44330 -www
-   ```
-
-1. When you refresh [https://openssl.localhost.pomerium.io](https://openssl.localhost.pomerium.io) in your browser, the connection will fail. Back in the terminal, the OpenSSL server should output errors containing:
-
-   ```log
-   SSL routines:tls_process_client_certificate:peer did not return a certificate
-   ```
-
-   This confirms that the upstream service is now requiring a trusted client certificate to allow connections.
-
-1. Update the Pomerium route block to provide the client certificate:
-
-   ```yaml title="config.yaml"
-   - from: https://openssl.pomerium.localhost.io
-     to: https://localhost:44330
-     tls_upstream_server_name: openssl.localhost
-     tls_client_cert_file: /etc/pomerium/pomerium@localhost-client.pem
-     tls_client_key_file: /etc/pomerium/pomerium@localhost-client-key.pem
-     policy:
-       - allow:
-           or:
-             - email:
-                 is: user@example.com
-   ```
-
-Now when you visit [https://openssl.localhost.pomerium.io](https://openssl.localhost.pomerium.io) you should see additional output under **Client certificate**, confirming that the upstream service has read and validated Pomerium's client certificate. Your upstream service is now using mTLS for mutual authentication!
-
-Obviously, the OpenSSL server is a trivial upstream service, and is purpose-built to work with encryption and not much else. Practical mutual authenticate can be a much more complex setup depending on the service, and may require a sidecar or service mesh. This exercise merely serves to demonstrate how easy it is to configure Pomerium to provide client certificates to the upstream service.
-
-## More Resources
-
-- [Mutual Authentication: A Component of Zero Trust](/docs/concepts/mutual-auth)
-- [Client-Side mTLS With Pomerium](/docs/concepts/mutual-auth.md)
-- [JWT Verification](/docs/guides/jwt-verification-with-envoy)
-
-[mkcert]: https://github.com/FiloSottile/mkcert
-[openssl]: https://www.openssl.org/
-[`tls_custom_ca_file`]: /docs/reference/routes/tls#tls-custom-certificate-authority
-[`tls_upstream_server_name`]: /docs/reference/routes/tls#tls-upstream-server-name
diff --git a/content/docs/capabilities/namespacing.mdx b/content/docs/capabilities/namespacing.mdx
deleted file mode 100644
index f6f575b1e..000000000
--- a/content/docs/capabilities/namespacing.mdx
+++ /dev/null
@@ -1,105 +0,0 @@
----
-# cSpell:ignore yourcompany
-
-title: Namespacing
-sidebar: Namespaces
-lang: en-US
-keywords:
-  [
-    pomerium,
-    identity access proxy,
-    namespacing,
-    namespaces,
-    self-service,
-    policy,
-    pomerium enterprise,
-    rbac,
-    abac,
-  ]
-description: This page describes the concept of namespaces and why it's important for enabling self-service and RBAC.
----
-
-## Namespaces
-
-In Pomerium Enterprise, a **Namespace** is a cornerstone organization unit. They are container objects that behave similar to a unix directory structure.
-
-In each Namespace, administrators can create organizational units where users and groups can be added. Namespaces enable fine-grained role based access control and management (**RBAC**) to managing Pomerium. The structure and hierarchy of namespaces empower teams to self-service the routes and policies pertinent to them. Namespaces can can also be used to optionally or mandatorily inherit from their parent permission or policies.
-
-Namespaces enable:
-
-- Self-Service.
-- Hierarchical policy enforcement (both enforced, and optional),
-- Policy organization.
-- [RBAC](https://en.wikipedia.org/wiki/Role-based_access_control) for the Enterprise Console itself.
-
-Each of these sub-concepts are related and build on each other to form a unified security model.
-
-### Self-Service Capabilities
-
-One of the benefits of an identity-aware access proxy is that, once in place, developers and owners of enterprise applications have an incentive to configure their services to be accessible via the proxy.
-
-Self-service has [several benefits](https://www.usenix.org/system/files/login/articles/login_winter16_05_cittadini.pdf):
-
-- Frees global administrators from continuously modifying the configuration per user requests
-- Encourages service owners to own their own route configuration and policy
-- Ensures a reasonable compromise between development velocity and security controls
-
-Unlike with a VPN, or network driven access control mechanisms, application owners (with limited access permissions managed through namespaces) can maintain route and policy configuration for their own services, while higher level operations, security, and identity teams are able to enforce higher level authorization and access policies.
-
-### Hierarchical Policy Enforcement
-
-Hierarchical policy lets administrators enforce inheritable authorization policy. Policies can be optional (self-select), or mandatory.
-
-Identities and their group memberships are defined by your Identity Provider (**IdP**). Pomerium looks to your IdP for identity information, so policies defined using groups are always up-to-date with the access management defined upstream.
-
-:::tip
-
-When using an IdP without directory sync or when working with non-domain users, they will not show up in the look-ahead search. See [Non-Domain Users](/docs/concepts/access-control#non-domain-users) for more information.
-
-:::
-
-Consider this scenario: you want to enable your security team to manage high level corporate policy while enabling application owners to set finer grained user access to their specific applications. Pomerium can help you do that!
-
-Your security team can enact top level security policies to ensure, everyone:
-
-- has a `yourcompany.com` email account,
-- isn't coming from a known bad actor IP address,
-
-From there, the security team delegates management of child [Namespaces](#namespaces) to application teams, providing flexibility to self-manage their own application [Routes](/docs/capabilities/routing) and [Policies](/docs/capabilities/ppl).
-
-For example, a developer group can be given control to determine who has access to their Namespace, and create or edit Routes within it. They can provide authentication and authorization to their WiP app without writing new authorization code.
-
-Meanwhile, the CFO is given [manager](#manager) permissions over the "Accounting" Namespace, and can set enforced or optional policies for the services within.
-
-### RBAC for Enterprise Console Users
-
-- Namespaces are also used to achieve Role Based Access Control (**RBAC**) in the console itself.
-- There are three different roles:
-
-#### Guest (no role)
-
-Users who are authenticated by your IdP but do not have a role assigned in Pomerium Enterprise can still view the list of Namespaces, but nothing else.
-
-#### Viewer
-
-A user with the Viewer role can:
-
-- view all resources in a Namespace (Routes, Policies, Certificates), including child Namespaces
-- view traffic dashboard for routes in the Namespace, including child Namespaces
-- view the activity log for a namespace.
-
-#### Manager
-
-In addition to the access provided by the Viewer role, a Manager can create, read, update, and delete routes, policies, and certificates in a Namespace (as well as its children). A Manager may also reference policies and certificates in the parent Namespace.
-
-:::caution
-
-Managers in any Namespace should note: while creating a route for an [upstream](/docs/internals/glossary#upstream--downstream) path prevents additional routes to that path _in the same namespace_, Managers in other namespaces can create alternate routes to the same path.
-
-If you need to ensure that access to a service is only accessible from a single route, consider implementing [Mutual Authentication](/docs/concepts/mutual-auth) between Pomerium and the upstream service. This can be achieved using one of several methods, including [mTLS](/docs/capabilities/mtls-services) and [JWT verification](/docs/guides/jwt-verification-with-envoy). You can also utilize a service mesh like [Istio](/docs/guides/istio)
-
-:::
-
-#### Admin
-
-An Admin user has permissions across all Namespaces. They can manage global settings, sessions, and [service accounts](/docs/capabilities/service-accounts), as well as view events and runtime data.
diff --git a/content/docs/capabilities/non-http.mdx b/content/docs/capabilities/non-http.mdx
new file mode 100644
index 000000000..49c746716
--- /dev/null
+++ b/content/docs/capabilities/non-http.mdx
@@ -0,0 +1,49 @@
+---
+title: Tunneling Non-HTTP Protocols
+sidebar_label: Tunneling Non-HTTP Protocols
+description: 'Consolidated documentation for using Pomerium to protect and access non-HTTP protocols (TCP and UDP) over HTTP.'
+keywords:
+  - pomerium
+  - identity access proxy
+  - pomerium desktop
+  - pomerium cli
+  - tcp
+  - udp
+  - ssh
+  - redis
+  - mysql
+  - rdp
+  - database
+  - bastion
+sidebar_position: 0
+lang: en-US
+---
+
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+# Non-HTTP Protocols
+
+Pomerium supports tunneling **non-HTTP protocols** (such as TCP- and UDP-based services) over HTTP, allowing you to secure and authenticate connections to those services using your existing identity provider.
+
+Common uses include:
+
+- Administrative connections (SSH, RDP)
+- Data services (Redis, MySQL, Postgres)
+- UDP-based protocols (e.g., time servers, Factorio game server)
+
+Below, you'll find details on how it works, how to create routes, and how to use the Pomerium CLI or Desktop client to connect.
+
+## How It Works
+
+Pomerium uses HTTP tunneling methods described in relevant RFCs:
+
+- **TCP**: Uses the [`CONNECT`](https://httpwg.org/specs/rfc9110.html#CONNECT) method to establish a tunnel.
+- **UDP**: Uses [`CONNECT-UDP`](https://datatracker.ietf.org/doc/html/rfc9298) to tunnel UDP traffic over HTTP/2 or HTTP/3.
+
+:::caution
+
+To minimize issues with TCP support, **do not** place Pomerium behind another HTTP proxy.  
+Instead, configure your load balancer in L4/TCP mode. If you must proxy HTTP to Pomerium, the upstream proxy must support forwarding `CONNECT` or `CONNECT-UDP` traffic.
+
+:::
diff --git a/content/docs/capabilities/non-http/_cli-client-certificates.mdx b/content/docs/capabilities/non-http/_cli-client-certificates.mdx
new file mode 100644
index 000000000..e05f4a534
--- /dev/null
+++ b/content/docs/capabilities/non-http/_cli-client-certificates.mdx
@@ -0,0 +1,37 @@
+import CodeBlock from '@theme/CodeBlock';
+
+### Client Certificates
+
+If Pomerium is configured to require client certificates, you will also need to provide a client certificate and private key when invoking the `pomerium-cli` command.
+
+You can specify these either by using PEM files, or (new in [v0.23.0](https://github.com/pomerium/cli/releases/tag/v0.23.0)) by searching for a certificate in the system trust store (on **macOS** and **Windows** only).
+
+To specify a client certificate and key using PEM files:
+
+
+  {`pomerium-cli ${props.protocol} --client-cert cert.pem --client-key key.pem  route.corp.example.com:1234`}
+
+
+To search for a client certificate in the system trust store:
+
+
+  {`pomerium-cli ${props.protocol} --client-cert-from-store route.corp.example.com:1234`}
+
+
+This will search the Keychain (on macOS) or the Windows certificate store (on Windows) for a client certificate and private key, based on the trusted CA names advertised by Pomerium in the TLS handshake.
+
+If you need to select between multiple matching client certificates, you can additionally filter based on the Distinguished Name of the certificate's Issuer and/or the certificate Subject.
+
+For example, to filter for a certificate directly issued by a CA with the Common Name "My Trusted CA":
+
+
+  {`pomerium-cli ${props.protocol} --client-cert-from-store --client-cert-issuer "CN=My Trusted CA" route.corp.example.com:1234`}
+
+
+Or, to filter for a certificate whose Subject contains the Organizational Unit Name "My Department":
+
+
+  {`pomerium-cli ${props.protocol} --client-cert-from-store --client-cert-subject "OU=My Department" route.corp.example.com:1234`}
+
+
+See the [reference page](/docs/capabilities/non-http#certificate-name-filters) for more details about the certificate name filter syntax.
diff --git a/content/docs/capabilities/tcp/examples/_category_.json b/content/docs/capabilities/non-http/examples/_category_.json
similarity index 100%
rename from content/docs/capabilities/tcp/examples/_category_.json
rename to content/docs/capabilities/non-http/examples/_category_.json
diff --git a/content/docs/capabilities/tcp/examples/_service-template.mdx b/content/docs/capabilities/non-http/examples/_service-template.mdx
similarity index 92%
rename from content/docs/capabilities/tcp/examples/_service-template.mdx
rename to content/docs/capabilities/non-http/examples/_service-template.mdx
index 73dd98586..8e96080e4 100644
--- a/content/docs/capabilities/tcp/examples/_service-template.mdx
+++ b/content/docs/capabilities/non-http/examples/_service-template.mdx
@@ -15,13 +15,13 @@ Replace the paragraph above with a brief description of the service, and/or why
 
 :::tip
 
-This example assumes you've already [created a TCP route](/docs/capabilities/tcp#configure-tcp-routes) for this service.
+This example assumes you've already [created a TCP route](/docs/capabilities/non-http#configure-tcp-routes) for this service.
 
 :::
 
  ## Basic Connection
 
- 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/clients/pomerium-cli) or the Pomerium Desktop client:
+ 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/deploy/clients) or the Pomerium Desktop client:
 
     
     
diff --git a/content/docs/capabilities/non-http/examples/ethr.mdx b/content/docs/capabilities/non-http/examples/ethr.mdx
new file mode 100644
index 000000000..866d0361c
--- /dev/null
+++ b/content/docs/capabilities/non-http/examples/ethr.mdx
@@ -0,0 +1,68 @@
+---
+title: Ethr
+description: Testing Pomerium UDP Tunnels with Ethr
+---
+
+# Testing Pomerium UDP Tunnels with Ethr
+
+Since v0.29.0 Pomerium supports tunneling UDP traffic. This example demonstrates how to do this using [Ethr](https://github.com/microsoft/ethr), a network performance measurement tool.
+
+You will need two machines: one running the Ethr client and the Pomerium CLI, and another running the Ethr server and Pomerium. Replace __`ethr.corp.example.com`__ with your domain name.
+
+## Server
+
+1. Install Pomerium
+2. [Install Ethr](https://github.com/microsoft/ethr?tab=readme-ov-file#installation)
+3. Enable QUIC by setting [`codec_type`](/docs/reference/codec-type) to `http3`
+
+   ```yaml
+   codec_type: http3
+   ```
+   :::tip QUIC
+
+    Pomerium also supports UDP tunneling with `http1` or `auto` (the default), but using `http3` significantly improves performance.
+
+   :::
+
+4. Add a UDP route on port 8888
+
+   ```yaml
+   - routes:
+       from: udp+https://ethr.corp.example.com:8888
+       to: udp://127.0.0.1:8888
+       allow_any_authenticated_user: true
+   ```
+
+5. Run Pomerium
+6. Run the Ethr server
+
+   ```bash
+   ethr -s
+   ```
+
+## Client
+
+1. Install the Pomerium CLI
+2. [Install Ethr](https://github.com/microsoft/ethr?tab=readme-ov-file#installation)
+3. Start a UDP tunnel
+
+   ```bash
+   pomerium-cli udp ethr.corp.example.com:8888 --listen :8888
+   ```
+
+   :::tip TLS issues
+
+   If you don't have a valid certificate use `--disable-tls-verification`.
+
+   :::
+4. Run the Ethr client
+
+   ```bash
+   ethr -c localhost -p udp -b 1M -l 1k -d 5s
+   ```
+
+You should see packets arrive at the Ethr server demonstrating that UDP tunneling is working.
+
+## More Resources
+
+- [Ethr](https://github.com/microsoft/ethr)
diff --git a/content/docs/capabilities/non-http/examples/factorio.mdx b/content/docs/capabilities/non-http/examples/factorio.mdx
new file mode 100644
index 000000000..f485e21c6
--- /dev/null
+++ b/content/docs/capabilities/non-http/examples/factorio.mdx
@@ -0,0 +1,78 @@
+---
+title: Factorio
+description: Testing Pomerium UDP Tunnels with Factorio
+---
+
+# Testing Pomerium UDP Tunnels with Factorio
+
+Since v0.29.0 Pomerium supports tunneling UDP traffic. This example demonstrates how to do this using [Factorio](https://www.factorio.com/), a popular game where you build and maintain factories with multiplayer support. Like many games Factorio uses a custom UDP protocol for multiplayer.
+
+You will need two machines: one running Factorio and the Pomerium CLI, and another running the Factorio headless server and Pomerium. Replace __`factorio.corp.example.com`__ with your domain name.
+
+## Server
+
+1. Install Pomerium
+2. Download the Linux Factorio headless server
+
+   ```bash
+   curl -L -o factorio.tar.xz https://factorio.com/get-download/stable/headless/linux64
+   tar -xJf factorio.tar.xz
+   cd factorio
+   ```
+
+3. Enable QUIC by setting [`codec_type`](/docs/reference/codec-type) to `http3`
+
+   ```yaml
+   codec_type: http3
+   ```
+   :::tip QUIC
+
+    Pomerium also supports UDP tunneling with `http1` or `auto` (the default), but using `http3` significantly improves performance.
+
+   :::
+
+4. Add a UDP route on port 34197
+
+   ```yaml
+   - routes:
+       from: udp+https://factorio.corp.example.com:34197
+       to: udp://127.0.0.1:34197
+       allow_any_authenticated_user: true
+   ```
+
+
+5. Run Pomerium
+6. Create a new Factorio save
+
+   ```bash
+   ./bin/x64/factorio --create ./saves/pomerium-example.zip
+   ```
+
+7. Run the Factorio headless server
+
+    ```bash
+    ./bin/x64/factorio --start-server ./saves/pomerium-example.zip
+    ```
+
+## Client
+
+1. Install the Pomerium CLI
+2. [Install Factorio](https://www.factorio.com/download)
+3. Start a UDP tunnel
+
+   ```bash
+   pomerium-cli udp factorio.corp.example.com:34197 --listen :34197
+   ```
+
+   :::tip TLS issues
+
+   If you don't have a valid certificate use `--disable-tls-verification`.
+
+   :::
+4. Run Factorio, click _Multiplayer_, then _Connect to Address_, and enter `127.0.0.1:34197` as the server address and click _Connect_.
+
+   ![Connect to Localhost](img/factorio-connect.png)
+
+You should now be connected to the server.
+
+![Factorio](img/factorio-ticks.png)
diff --git a/content/docs/capabilities/tcp/examples/git.mdx b/content/docs/capabilities/non-http/examples/git.mdx
similarity index 87%
rename from content/docs/capabilities/tcp/examples/git.mdx
rename to content/docs/capabilities/non-http/examples/git.mdx
index 7b058fd1f..4b19fab48 100644
--- a/content/docs/capabilities/tcp/examples/git.mdx
+++ b/content/docs/capabilities/non-http/examples/git.mdx
@@ -18,12 +18,12 @@ When hosting a self-hosted Git server like [GitLab](/docs/guides/gitlab) behind
 :::
 
 :::tip
-This example assumes you've already [created a TCP route](/docs/capabilities/tcp#configure-tcp-routes) for this service.
+This example assumes you've already [created a TCP route](/docs/capabilities/non-http#configure-tcp-routes) for this service.
 :::
 
  ## Basic Connection
 
- 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/clients/pomerium-cli) or the Pomerium Desktop client. These examples use Git connections over SSH:
+ 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/deploy/clients) or the Pomerium Desktop client. These examples use Git connections over SSH:
 
     
     
@@ -76,7 +76,7 @@ Because Git uses the SSH protocol, we can define a `Host` block in our local SSH
     ```
 
 :::tip
-If you've already defined an SSH configuration for all domains managed by Pomerium as described in our [SSH Example](/docs/capabilities/tcp/examples/ssh#always-tunnel-through-pomerium), you can skip the first step above and define your new remote with the Git server's domain name.
+If you've already defined an SSH configuration for all domains managed by Pomerium as described in our [SSH Example](/docs/capabilities/non-http/examples/ssh#always-tunnel-through-pomerium), you can skip the first step above and define your new remote with the Git server's domain name.
 :::
 
 ## More Resources
diff --git a/content/docs/capabilities/non-http/examples/img/desktop/advanced-settings.png b/content/docs/capabilities/non-http/examples/img/desktop/advanced-settings.png
new file mode 100644
index 000000000..3a73e16f7
Binary files /dev/null and b/content/docs/capabilities/non-http/examples/img/desktop/advanced-settings.png differ
diff --git a/content/docs/capabilities/non-http/examples/img/desktop/desktop-new-connection.png b/content/docs/capabilities/non-http/examples/img/desktop/desktop-new-connection.png
new file mode 100644
index 000000000..51d8b9fe0
Binary files /dev/null and b/content/docs/capabilities/non-http/examples/img/desktop/desktop-new-connection.png differ
diff --git a/content/docs/capabilities/non-http/examples/img/desktop/example-git-connection.png b/content/docs/capabilities/non-http/examples/img/desktop/example-git-connection.png
new file mode 100644
index 000000000..c90001813
Binary files /dev/null and b/content/docs/capabilities/non-http/examples/img/desktop/example-git-connection.png differ
diff --git a/content/docs/capabilities/non-http/examples/img/desktop/example-mssql-connection.png b/content/docs/capabilities/non-http/examples/img/desktop/example-mssql-connection.png
new file mode 100644
index 000000000..80718a4de
Binary files /dev/null and b/content/docs/capabilities/non-http/examples/img/desktop/example-mssql-connection.png differ
diff --git a/content/docs/capabilities/tcp/examples/img/desktop/example-mysql-connection.png b/content/docs/capabilities/non-http/examples/img/desktop/example-mysql-connection.png
similarity index 100%
rename from content/docs/capabilities/tcp/examples/img/desktop/example-mysql-connection.png
rename to content/docs/capabilities/non-http/examples/img/desktop/example-mysql-connection.png
diff --git a/content/docs/capabilities/tcp/examples/img/desktop/example-rdp-connection.png b/content/docs/capabilities/non-http/examples/img/desktop/example-rdp-connection.png
similarity index 100%
rename from content/docs/capabilities/tcp/examples/img/desktop/example-rdp-connection.png
rename to content/docs/capabilities/non-http/examples/img/desktop/example-rdp-connection.png
diff --git a/content/docs/capabilities/tcp/examples/img/desktop/example-redis-connection.png b/content/docs/capabilities/non-http/examples/img/desktop/example-redis-connection.png
similarity index 100%
rename from content/docs/capabilities/tcp/examples/img/desktop/example-redis-connection.png
rename to content/docs/capabilities/non-http/examples/img/desktop/example-redis-connection.png
diff --git a/content/docs/capabilities/tcp/examples/img/desktop/example-ssh-connection.png b/content/docs/capabilities/non-http/examples/img/desktop/example-ssh-connection.png
similarity index 100%
rename from content/docs/capabilities/tcp/examples/img/desktop/example-ssh-connection.png
rename to content/docs/capabilities/non-http/examples/img/desktop/example-ssh-connection.png
diff --git a/content/docs/capabilities/tcp/examples/img/desktop/new-ssh-connection.png b/content/docs/capabilities/non-http/examples/img/desktop/new-ssh-connection.png
similarity index 100%
rename from content/docs/capabilities/tcp/examples/img/desktop/new-ssh-connection.png
rename to content/docs/capabilities/non-http/examples/img/desktop/new-ssh-connection.png
diff --git a/content/docs/capabilities/non-http/examples/img/desktop/pomerium-desktop-postgres.png b/content/docs/capabilities/non-http/examples/img/desktop/pomerium-desktop-postgres.png
new file mode 100644
index 000000000..8c3084793
Binary files /dev/null and b/content/docs/capabilities/non-http/examples/img/desktop/pomerium-desktop-postgres.png differ
diff --git a/content/docs/capabilities/non-http/examples/img/desktop/zero-ssh-route-example.png b/content/docs/capabilities/non-http/examples/img/desktop/zero-ssh-route-example.png
new file mode 100644
index 000000000..c77967d23
Binary files /dev/null and b/content/docs/capabilities/non-http/examples/img/desktop/zero-ssh-route-example.png differ
diff --git a/content/docs/capabilities/non-http/examples/img/factorio-connect.png b/content/docs/capabilities/non-http/examples/img/factorio-connect.png
new file mode 100644
index 000000000..7a62bdfbe
Binary files /dev/null and b/content/docs/capabilities/non-http/examples/img/factorio-connect.png differ
diff --git a/content/docs/capabilities/non-http/examples/img/factorio-ticks.png b/content/docs/capabilities/non-http/examples/img/factorio-ticks.png
new file mode 100644
index 000000000..1a98fc493
Binary files /dev/null and b/content/docs/capabilities/non-http/examples/img/factorio-ticks.png differ
diff --git a/content/docs/capabilities/tcp/examples/img/remmina-connection-profile.png b/content/docs/capabilities/non-http/examples/img/remmina-connection-profile.png
similarity index 100%
rename from content/docs/capabilities/tcp/examples/img/remmina-connection-profile.png
rename to content/docs/capabilities/non-http/examples/img/remmina-connection-profile.png
diff --git a/content/docs/capabilities/tcp/examples/img/remmina-connection-scripted.png b/content/docs/capabilities/non-http/examples/img/remmina-connection-scripted.png
similarity index 100%
rename from content/docs/capabilities/tcp/examples/img/remmina-connection-scripted.png
rename to content/docs/capabilities/non-http/examples/img/remmina-connection-scripted.png
diff --git a/content/docs/capabilities/tcp/examples/ms-sql.mdx b/content/docs/capabilities/non-http/examples/ms-sql.mdx
similarity index 91%
rename from content/docs/capabilities/tcp/examples/ms-sql.mdx
rename to content/docs/capabilities/non-http/examples/ms-sql.mdx
index 62dc6d59b..493541b0f 100644
--- a/content/docs/capabilities/tcp/examples/ms-sql.mdx
+++ b/content/docs/capabilities/non-http/examples/ms-sql.mdx
@@ -20,13 +20,13 @@ This document explains how to connect to a Microsoft SQL database through an enc
 :::
 
 :::tip
-This example assumes you've already [created a TCP route](/docs/capabilities/tcp#configure-tcp-routes) for this service.
+This example assumes you've already [created a TCP route](/docs/capabilities/non-http#configure-tcp-routes) for this service.
 :::
 
 
  ## Basic Connection
 
- 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/clients/pomerium-cli) or the Pomerium Desktop client:
+ 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/deploy/clients) or the Pomerium Desktop client:
 
     
     
diff --git a/content/docs/capabilities/tcp/examples/mysql.mdx b/content/docs/capabilities/non-http/examples/mysql.mdx
similarity index 94%
rename from content/docs/capabilities/tcp/examples/mysql.mdx
rename to content/docs/capabilities/non-http/examples/mysql.mdx
index 52007377f..f4cdba67c 100644
--- a/content/docs/capabilities/tcp/examples/mysql.mdx
+++ b/content/docs/capabilities/non-http/examples/mysql.mdx
@@ -18,12 +18,12 @@ This document explains how to connect to a MySQL or MariaDB database through an
 :::
 
 :::tip
-This example assumes you've already [created a TCP route](/docs/capabilities/tcp#configure-tcp-routes) for this service.
+This example assumes you've already [created a TCP route](/docs/capabilities/non-http#configure-tcp-routes) for this service.
 :::
 
  ## Basic Connection
 
- 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/clients/pomerium-cli) or the Pomerium Desktop client:
+ 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/deploy/clients) or the Pomerium Desktop client:
 
     
     
diff --git a/content/docs/capabilities/tcp/examples/postgres.mdx b/content/docs/capabilities/non-http/examples/postgres.mdx
similarity index 91%
rename from content/docs/capabilities/tcp/examples/postgres.mdx
rename to content/docs/capabilities/non-http/examples/postgres.mdx
index 11651094a..8a00be352 100644
--- a/content/docs/capabilities/tcp/examples/postgres.mdx
+++ b/content/docs/capabilities/non-http/examples/postgres.mdx
@@ -11,7 +11,7 @@ PostgreSQL is a popular relational database used in many modern applications. Th
 
 ## Basic Connection
 
-1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/clients/pomerium-cli) or the Pomerium Desktop client:
+1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/deploy/clients) or the Pomerium Desktop client:
 
 
 
diff --git a/content/docs/capabilities/tcp/examples/rdp.mdx b/content/docs/capabilities/non-http/examples/rdp.mdx
similarity index 94%
rename from content/docs/capabilities/tcp/examples/rdp.mdx
rename to content/docs/capabilities/non-http/examples/rdp.mdx
index a91cc0c72..b4265e8a3 100644
--- a/content/docs/capabilities/tcp/examples/rdp.mdx
+++ b/content/docs/capabilities/non-http/examples/rdp.mdx
@@ -19,12 +19,12 @@ Remote Desktop Protocol (**RDP**) is a standard for using a desktop computer rem
 :::
 
 :::tip
-This example assumes you've already [created a TCP route](/docs/capabilities/tcp#configure-tcp-routes) for this service.
+This example assumes you've already [created a TCP route](/docs/capabilities/non-http#configure-tcp-routes) for this service.
 :::
 
 ## Basic Connection
 
-1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/clients/pomerium-cli) or the Pomerium Desktop client:
+1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/deploy/clients) or the Pomerium Desktop client:
 
     
     
diff --git a/content/docs/capabilities/tcp/examples/redis.mdx b/content/docs/capabilities/non-http/examples/redis.mdx
similarity index 91%
rename from content/docs/capabilities/tcp/examples/redis.mdx
rename to content/docs/capabilities/non-http/examples/redis.mdx
index 48dedc1db..88c4bf15c 100644
--- a/content/docs/capabilities/tcp/examples/redis.mdx
+++ b/content/docs/capabilities/non-http/examples/redis.mdx
@@ -18,12 +18,12 @@ Redis is a popular in-memory data structure store. It can be run locally or conf
 :::
 
 :::tip
-This example assumes you've already [created a TCP route](/docs/capabilities/tcp#configure-tcp-routes) for this service.
+This example assumes you've already [created a TCP route](/docs/capabilities/non-http#configure-tcp-routes) for this service.
 :::
 
 ## Basic Connection
 
- 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/clients/pomerium-cli) or the Pomerium Desktop client:
+ 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/deploy/clients) or the Pomerium Desktop client:
 
     
     
diff --git a/content/docs/capabilities/tcp/examples/ssh.mdx b/content/docs/capabilities/non-http/examples/ssh.mdx
similarity index 94%
rename from content/docs/capabilities/tcp/examples/ssh.mdx
rename to content/docs/capabilities/non-http/examples/ssh.mdx
index 21d756fb0..8d7bcb695 100644
--- a/content/docs/capabilities/tcp/examples/ssh.mdx
+++ b/content/docs/capabilities/non-http/examples/ssh.mdx
@@ -25,12 +25,12 @@ By tunneling SSH connections through your Pomerium service:
 :::
 
 :::tip
-This example assumes you've already [created a TCP route](/docs/capabilities/tcp#configure-tcp-routes) for this service.
+This example assumes you've already [created a TCP route](/docs/capabilities/non-http#configure-tcp-routes) for this service.
 :::
 
  ## Basic Connection
 
- 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/clients/pomerium-cli) or the Pomerium Desktop client:
+ 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/deploy/clients) or the Pomerium Desktop client:
 
     
     
diff --git a/content/docs/capabilities/tcp/img/tcp-ssh-route.png b/content/docs/capabilities/non-http/img/tcp-ssh-route.png
similarity index 100%
rename from content/docs/capabilities/tcp/img/tcp-ssh-route.png
rename to content/docs/capabilities/non-http/img/tcp-ssh-route.png
diff --git a/content/docs/capabilities/tcp.mdx b/content/docs/capabilities/non-http/tcp.mdx
similarity index 93%
rename from content/docs/capabilities/tcp.mdx
rename to content/docs/capabilities/non-http/tcp.mdx
index 31b6cadaf..c66a61393 100644
--- a/content/docs/capabilities/tcp.mdx
+++ b/content/docs/capabilities/non-http/tcp.mdx
@@ -1,5 +1,7 @@
 ---
 description: This article describes how to leverage pomerium for TCP proxying.
+sidebar_label: TCP
+sidebar_position: 1
 keywords:
   [
     pomerium,
@@ -22,7 +24,7 @@ import LongLivedConnections from '@site/content/docs/admonitions/_long-lived-con
 
 # TCP over HTTP Support
 
-In addition to managing HTTP based applications, Pomerium can be used to protect non-HTTP systems with the same consistent authorization policy. This is achieved by tunneling TCP over HTTP with the help of a client side command built into [`pomerium-cli`](/docs/clients/pomerium-cli).
+In addition to managing HTTP based applications, Pomerium can be used to protect non-HTTP systems with the same consistent authorization policy. This is achieved by tunneling TCP over HTTP with the help of a client side command built into [`pomerium-cli`](/docs/deploy/clients).
 
 Operations and engineering teams frequently require access to lower level administrative and data protocols such as SSH, RDP, Postgres, MySQL, Redis, etc.
 
@@ -63,7 +65,7 @@ When creating TCP routes, note the following:
 
 ## Connect to TCP Routes
 
-While HTTP routes can be consumed with just a normal browser, `pomerium-cli` or Pomerium Desktop must serve as a proxy for TCP routes. See [Pomerium Desktop and CLI Clients](tcp/client) for more information.
+While HTTP routes can be consumed with just a normal browser, `pomerium-cli` or Pomerium Desktop must serve as a proxy for TCP routes. See [Pomerium Desktop and CLI Clients](/docs/deploy/clients) for more information.
 
 To connect, you normally need just the external hostname and port of your TCP route:
 
@@ -95,7 +97,7 @@ localhost:52046>
 
 You may specify an optional address and port for the `tcp` command to listen on.
 
-`-` specifies that STDIN and STDOUT should be directly attached to the remote TCP connection. This is useful for [SSH](tcp/examples/ssh#tunnel-and-connect-simultaneously) or for sending data through a shell pipe.
+`-` specifies that STDIN and STDOUT should be directly attached to the remote TCP connection. This is useful for [SSH](./examples/ssh#tunnel-and-connect-simultaneously) or for sending data through a shell pipe.
 
 ### Bastion host
 
@@ -167,11 +169,11 @@ routes:
 
 The guides below demonstrate how to proxy TCP tunnels with Pomerium to well-known services:
 
-- [**Git**](tcp/examples/git)
-- [**Microsoft SQL**](tcp/examples/ms-sql)
-- [**MySQL and MariaDB**](tcp/examples/mysql)
-- [**RDP**](tcp/examples/rdp)
-- [**Redis**](tcp/examples/redis)
-- [**SSH**](tcp/examples/ssh)
+- [**Git**](./examples/git)
+- [**Microsoft SQL**](./examples/ms-sql)
+- [**MySQL and MariaDB**](./examples/mysql)
+- [**RDP**](./examples/rdp)
+- [**Redis**](./examples/redis)
+- [**SSH**](./examples/ssh)
 
 :::
diff --git a/content/docs/capabilities/non-http/udp.mdx b/content/docs/capabilities/non-http/udp.mdx
new file mode 100644
index 000000000..6ee94a072
--- /dev/null
+++ b/content/docs/capabilities/non-http/udp.mdx
@@ -0,0 +1,71 @@
+---
+description: This article describes how to leverage pomerium for UDP proxying.
+sidebar_label: UDP
+sidebar_position: 2
+keywords:
+  [
+    pomerium,
+    pomerium-cli,
+    proxy,
+    identity access proxy,
+    ssh,
+    udp,
+    application,
+    non http,
+    tunnel,
+  ]
+---
+
+import CLIClientCertificates from './_cli-client-certificates.mdx';
+
+# UDP over HTTP Support
+
+Starting in v0.29, Pomerium can be used to protect UDP systems with the same consistent authorization policy. This is achieved by tunneling UDP over HTTP with the help of a client side command built into [`pomerium-cli`](/docs/deploy/clients).
+
+Internally, Pomerium uses [`CONNECT-UDP`](https://datatracker.ietf.org/doc/html/rfc9298) to establish the UDP tunnel.
+
+## Configure UDP Routes
+
+UDP configuration is simple. Just specify the correct scheme and ports in your route [`to`](/docs/reference/routes/to) and [`from`](/docs/reference/routes/from) fields.
+
+Example:
+
+```yaml
+routes:
+  - from: udp+https://time.corp.example.com:13
+    to: udp://time.internal.example.com:13
+    policy:
+      - allow:
+          or:
+            - email:
+                is: contractor@not-example.com
+            - claim/groups: 'datascience@example.com'
+```
+
+When creating UDP routes, note the following:
+
+- When configuring a UDP route, any HTTP specific settings such as `regex_rewrite_pattern` or `set_request_headers` have no effect.
+- The port defined in `from` does not dictate what port the tunneled traffic uses. This will always be the port defined by [`address`](/docs/reference/address) in your Pomerium configuration (`443` by default). The port instead differentiates multiple routes to the same hostname for different services.
+
+## Connect to UDP Routes
+
+While HTTP routes can be consumed with just a normal browser, `pomerium-cli` or Pomerium Desktop must serve as a proxy for UDP routes.
+
+To connect, you normally need just the external hostname and port of your UDP route:
+
+```shell-session
+$ pomerium-cli udp udp.localhost.pomerium.io:1234
+2023/10/02 11:19:59 listening on 127.0.0.1:52046
+```
+
+By default, `pomerium-cli` will start a listener on loopback on a random port.
+
+On first connection, you will be sent through a standard Pomerium HTTP authentication flow. After completing this, your UDP connection should be established!
+
+## Advanced capabilities
+
+### Listen configuration
+
+You may specify an optional address and port for the `udp` command to listen on.
+
+
diff --git a/content/docs/capabilities/original-request-context.md b/content/docs/capabilities/original-request-context.md
index 2847cf531..5bdb5c3b5 100644
--- a/content/docs/capabilities/original-request-context.md
+++ b/content/docs/capabilities/original-request-context.md
@@ -9,7 +9,7 @@ description: This article describes how the original user context is passed seco
 
 :::enterprise
 
-This article describes a use case available to [Pomerium Enterprise](/docs/enterprise/install) customers.
+This article describes a use case available to [Pomerium Enterprise](/docs/deploy/enterprise/install) customers.
 
 :::
 
diff --git a/content/docs/capabilities/rego.mdx b/content/docs/capabilities/rego.mdx
deleted file mode 100644
index 38dc98546..000000000
--- a/content/docs/capabilities/rego.mdx
+++ /dev/null
@@ -1,165 +0,0 @@
----
-# cSpell:ignore unvalidated, gset
-id: rego
-title: Custom Rego Policies
-description: Learn how Pomerium Enterprise supports custom Rego policies.
----
-
-# Custom Rego Policies
-
-Pomerium supports policies expressed in [Rego](https://www.openpolicyagent.org/docs/latest/#rego) for organizations that prefer to use [OPA](https://www.openpolicyagent.org/).
-
-See the [Outputs](#outputs), [Inputs](#inputs), and [Functions](#functions) reference sections below to learn how Rego policies apply to policy evaluation.
-
-:::enterprise
-
-Custom Rego policies is a [Pomerium Enterprise](/docs/enterprise) feature.
-
-:::
-
-In the [Enterprise Console](/docs/enterprise#enterprise-console), you can write custom Rego policies in the Rego Editor:
-
-![Apply Rego in Console editor](./img/authorization/ppl-rego-policy.png)
-
-:::note
-
-A policy can only support PPL or Rego. Once one is set, the other tab is disabled.
-
-:::
-
-## Outputs
-
-Authorization policy written in Rego is expected to return results in `allow` and/or `deny` rules:
-
-```rego
-# a policy that always allows access
-allow := true
-```
-
-```rego
-# a policy that always denies access
-deny := true
-```
-
-Pomerium grants access according to the same rules as [PPL](/docs/capabilities/ppl#actions):
-
-> Only two actions are supported: allow and deny. deny takes precedence over allow. More precisely: a user will have access to a route if at least one allow rule matches and no deny rules match.
-
-`allow` and `deny` rules support four forms:
-
-1. A simple boolean:
-
-```rego
-allow := true
-```
-
-2. An array with a single boolean value:
-
-```rego
-deny := [true]
-```
-
-3. An array with two values: a boolean and a **reason**:
-
-```rego
-allow := [false, "user-unauthorized"]
-```
-
-4. An array with three values: a boolean, a reason, and additional data:
-
-```rego
-allow := [false, "user-unauthorized", { "key": "value" }]
-```
-
-The **reason** value is useful for debugging, since it appears in [authorization logs](/docs/reference/authorize-log-fields#find-authorize-logs). There are two special reasons that trigger functionality in Pomerium:
-
-- `user-unauthenticated` indicates that the user needs to sign in, and results in a redirect to the Authenticate service
-- `device-unauthenticated` indicates that the user needs to register a new device
-
-## Inputs
-
-Rego scripts are evaluated with inputs available on the `input` object:
-
-```rego
-allow if input.http.method == "POST"
-```
-
-Rego defines the following inputs:
-
-| **Input name** | **Type** | **Description** |
-| :-- | :-- | :-- |
-| `http` | Object | Represents the HTTP request |
-| `http.method` | String | The method used in the HTTP request |
-| `http.hostname` | String | The hostname in the HTTP request |
-| `http.path` | String | The path in the HTTP request |
-| `http.url` | String | The full URL in the HTTP request |
-| `http.headers` | Object | The headers in the HTTP request |
-| `http.client_certificate` | Object | The client certificate details |
-| `http.client_certificate.presented` | Boolean | `true` if the client presented a certificate |
-| `http.client_certificate.leaf` | String | The leaf certificated provided by the client (unvalidated) |
-| `http.client_certificate.intermediates` | String | The remainder of the client certificate chain |
-| `http.ip` | String | The user's IP address |
-| `http.session` | Object | Represents the user's session |
-| `http.session.id` | String | The session ID |
-| `http.is_valid_client_certificate` | Boolean | `true` if the presented client certificate is valid |
-
-## Functions
-
-The function below is available in Rego scripts:
-
-- `get_databroker_record(record_type, record_id)`: Returns data from the Databroker service.
-
-For example:
-
-```rego
-session := get_databroker_record("type.googleapis.com/session.Session", input.session.id)
-```
-
-### Example Rego policy
-
-This example policy compares the `given_name` claim from a user's session against a list of popular first names, and only allows the 100 most popular first names.
-
-```rego
-package pomerium.policy
-session = s {
-  s = gset_databroker_record("type.googleapis.com/user.ServiceAccount", input.session.id)
-  s != null
-} else = s {
-  s = get_databroker_record("type.googleapis.com/session.Session", input.session.id)
-  s != null
-} else = {} {
-  true
-}
-user = u {
-  u = get_databroker_record("type.googleapis.com/user.User", session.user_id)
-} else = {} {
-  true
-}
-allow = [true, {"custom-rego-authorized"}] {
-  # grab all the claims from the user and session objects
-  session_claims := object.get(session, "claims", {})
-  user_claims := object.get(user, "claims", {})
-  all_claims := object.union(session_claims, user_claims)
-  # get the given_name claim. claim values are always an array of strings
-  given_names := object.get(all_claims, "given_name", [])
-  # query a JSON dump of the most popular baby names from 2020
-  response := http.send({
-    "method": "GET",
-    "url": "https://raw.githubusercontent.com/aruljohn/popular-baby-names/master/2020/boy_names_2020.json",
-    "force_json_decode": true,
-  })
-  # only include the top 100 names
-  all_names := response.body.names
-  popular_names := array.slice(all_names, 0, 99)
-  # check that there's a given name in the popular names
-  some i
-  some j
-  popular_names[i] == given_names[j]
-} else = [false, {"custom-rego-unauthorized"}] {
-  session.id != ""
-} else = [false, {"user-unauthenticated"}] {
-  true
-}
-```
-
-This example pulls session data from the Databroker service using `type.googleapis.com/session.Session` for users and `type.googleapis.com/user.ServiceAccount` for service accounts.
diff --git a/content/docs/capabilities/routing.mdx b/content/docs/capabilities/routing.mdx
index 458920b0b..95da48ff3 100644
--- a/content/docs/capabilities/routing.mdx
+++ b/content/docs/capabilities/routing.mdx
@@ -1,9 +1,9 @@
 ---
 # cSpell:ignore cm9vdDpodW50ZXI0Mg
 
-title: Routing
+title: Routing, Proxying, and Load Balancing with Pomerium
 lang: en-US
-sidebar_label: Routing
+sidebar_label: 'Proxying & Routing'
 description: How to get Pomerium's CLI which be used to proxy TCP services and kubernetes commands
 keywords:
   [
@@ -20,19 +20,17 @@ keywords:
   ]
 ---
 
-# Routing, Proxying, and Load Balancing
-
-## Routes
-
 
 
+## Routing
+
 A **Route** defines how to access a service running behind Pomerium. This includes authentication (both for Pomerium and passed through to the service), rewrites, header management, load balancing, etc.
 
 When first installing Pomerium Enterprise, users may want to import existing routes from the open-source Pomerium core. The **Migrate Routes** button accepts the open-source `config.yaml` file and imports routes from it to Pomerium Enterprise.
@@ -51,7 +49,7 @@ The sections below cover the options available when creating or editing a route.
 
 ### General
 
-The **General** tab defines the route path, both from the internet and to the internal service, and the policies attached. Note that policies enforced on a [Namespace](/docs/capabilities/namespacing#hierarchical-policy-enforcement) the route resides in will also be applied.
+The **General** tab defines the route path, both from the internet and to the internal service, and the policies attached. Note that policies enforced on a [Namespace](/docs/internals/namespacing#hierarchical-policy-enforcement) the route resides in will also be applied.
 
 #### Name
 
@@ -61,7 +59,7 @@ This value is only visible in the Console UI.
 
 `From` is the externally accessible URL for the proxied request.
 
-Specifying `tcp+https` for the scheme enables [TCP proxying](/docs/capabilities/tcp) support for the route. You may map more than one port through the same hostname by specifying a different `:port` in the URL.
+Specifying `tcp+https` or `udp+https` for the scheme enables [TCP proxying](/docs/capabilities/non-http) or [UDP proxying](/docs/capabilities/non-http/udp) support for the route. You may map more than one port through the same hostname by specifying a different `:port` in the URL.
 
 :::warning
 
@@ -84,13 +82,13 @@ Once a Route is created, the Metric Name field will populate. You can use this n
     - https://b.example.com
 ```
 
-A load balancing weight may be associated with a particular upstream by appending `,[weight]` to the URL. The exact behavior depends on your [`lb_policy`](/docs/reference/routes/load-balancing#load-balancing-policy) setting. See [Load Balancing](/docs/capabilities/load-balancing) for example [configurations](/docs/capabilities/load-balancing#load-balancing-weight).
+A load balancing weight may be associated with a particular upstream by appending `,[weight]` to the URL. The exact behavior depends on your [`lb_policy`](#load-balancing-method) setting.
 
-Must be `tcp` if `from` is `tcp+https`.
+> **For more details and examples, see our dedicated [Upstream Load Balancing page](/docs/capabilities/routing).**
 
-:::warning
+Should be `tcp://` if `from` is `tcp+https://`, or `udp://` if `from` is `udp+https://`.
 
-Be careful with trailing slash.
+:::warning Be careful with trailing slash.
 
 With rule:
 
@@ -99,7 +97,8 @@ With rule:
   to: https://verify.pomerium.com/anything
 ```
 
-Requests to `https://verify.corp.example.com` will be forwarded to `https://verify.pomerium.com/anything`, while requests to `https://verify.corp.example.com/foo` will be forwarded to `https://verify.pomerium.com/anythingfoo`.To make the request forwarded to `https://httbin.org/anything/foo`, you can use double slashes in your request `https://httbin.corp.example.com//foo`.
+Requests to `https://verify.corp.example.com` will be forwarded to `https://verify.pomerium.com/anything`, while requests to `https://verify.corp.example.com/foo` will be forwarded to `https://verify.pomerium.com/anythingfoo`.  
+To make the request forwarded to `https://httbin.org/anything/foo`, you can use double slashes in your request `https://httbin.corp.example.com//foo`.
 
 While the rule:
 
@@ -108,7 +107,7 @@ While the rule:
   to: https://verify.pomerium.com/anything/
 ```
 
-All requests to `https://verify.corp.example.com/*` will be forwarded to `https://verify.pomerium.com/anything/*`. That means accessing to `https://verify.corp.example.com` will be forwarded to `https://verify.pomerium.com/anything/`. That said, if your application does not handle trailing slash, the request will end up with 404 not found.
+All requests to `https://verify.corp.example.com/*` will be forwarded to `https://verify.pomerium.com/anything/*`. That means accessing `https://verify.corp.example.com` will be forwarded to `https://verify.pomerium.com/anything/`. That said, if your application does not handle trailing slash, the request will end up with 404 not found.
 
 Either `redirect` or `to` must be set.
 
@@ -140,13 +139,9 @@ When enabled, this option will pass identity headers to upstream applications. T
 
 Add or remove Policies to be applied to the Route. Note that Policies enforced in the Route's Namespace will be applied automatically.
 
-:::note
-
-See the [**Policy setting**](/docs/reference/routes/policy) page to learn how to apply a PPL policy to a route.
+:::note See the [**Policy setting**](/docs/reference/routes/policy) page to learn how to apply a PPL policy to a route.
 
-For information and examples related to PPL, see [**Policy Language**](/docs/capabilities/ppl).
-
-:::
+For information and examples related to PPL, see [**Policy Language**](/docs/internals/ppl). :::
 
 #### Enable Google Cloud Serverless Authentication
 
@@ -313,15 +308,16 @@ routes:
 
 :::tip
 
-In the presence of multiple upstream servers, make sure to specify either an active or passive health check, or both, to avoid requests being served to an unhealthy backend.
+In the presence of multiple upstream servers, make sure to specify either an **active** or **passive** health check, or both, to avoid requests being served to an unhealthy backend.
 
 :::
 
-###### Active Health Checks
+#### Active Health Checks
 
-Active health checks issue periodic requests to each upstream to determine its health. See [Health Checking](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/health_checking) for a comprehensive overview.
+Active health checks issue periodic requests to each upstream to determine its health. See [Envoy Health Checking](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/health_checking) for more details.
 
-#### HTTP Example
+
+HTTP Example ```yaml routes: @@ -338,7 +334,10 @@ routes: path: '/' ``` -#### TCP Example +
+ +
+TCP Example ```yaml routes: @@ -358,9 +357,11 @@ routes: text: '504F4E47' #PONG ``` +
+ #### Passive Health Checks -Passive health check tries to deduce upstream server health based on recent observed responses. See [Outlier Detection](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/outlier) for comprehensive overview. +Passive health check tries to deduce upstream server health based on recent observed responses. See [Outlier Detection](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/outlier) for a comprehensive overview. ```yaml routes: @@ -376,12 +377,17 @@ routes: `lb_policy` should be set to [one of the values](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers): - [`ROUND_ROBIN`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-round-robin) (default) -- [`LEAST_REQUEST`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-least-request) and may be further configured using [`least_request_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-leastrequestlbconfig) -- [`RING_HASH`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#ring-hash) and may be further configured using [`ring_hash_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-ringhashlbconfig) option +- [`LEAST_REQUEST`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-least-request) + _May be further configured via [`least_request_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-leastrequestlbconfig)._ +- [`RING_HASH`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#ring-hash) + _May be further configured via [`ring_hash_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-ringhashlbconfig)._ - [`RANDOM`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#random) -- [`MAGLEV`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#maglev) and may be further configured using [`maglev_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-maglevlbconfig) option +- [`MAGLEV`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#maglev) + _May be further configured via [`maglev_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-maglevlbconfig)._ + +> **Some policy types support additional advanced configuration**, such as [least request randomization](/docs/reference/routes/load-balancing-policy-config). See [Load Balancing Policy Config](/docs/reference/routes/load-balancing-policy-config) for details. -#### Example +##### Example ```yaml routes: @@ -401,9 +407,7 @@ routes: When a list of upstream URLs is specified in the `to` field, you may append an optional load balancing weight parameter. The individual [`lb_policy`](#load-balancing-method) settings will take this weighting into account when making routing decisions. -#### Example - -This configuration uses the default `round_robin` load balancer policy but specifies different frequency of selection be applied to the upstream servers. +##### Example ```yaml routes: @@ -416,7 +420,7 @@ routes: - http://myapp-srv-5:8080,10 ``` -## Route matching order +### Route matching order Pomerium matches routes in a specific order; an incoming request will be sent to the first route that matches. @@ -425,9 +429,9 @@ Pomerium considers routes defined in a configuration file first, in the order in Routes from the Enterprise Console or Ingress Controller are sorted in the following order: 1. Ascending by `host` -1. Descending by `path` -1. Descending by `regex` -1. Descending by `prefix` +2. Descending by `path` +3. Descending by `regex` +4. Descending by `prefix` The example below defines two routes in a configuration file that both point to the same domain. The first route contains a prefix (`api`). @@ -444,24 +448,6 @@ If Pomerium receives a request to access `https://a.example.com:8080`, Pomerium allow_any_authenticated_user: true ``` -## Further reading - -- [Introduction to modern network load balancing and proxying](https://blog.envoyproxy.io/introduction-to-modern-network-load-balancing-and-proxying-a57f6ff80236) - -#### Load Balancing Policy - -In presence of multiple upstream servers, defines load balancing strategy between them. - -See [Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-enum-config-cluster-v3-cluster-lbpolicy) for more details. - -- [`ROUND_ROBIN`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-round-robin) (default) -- [`LEAST_REQUEST`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-least-request) and may be further configured using [`least_request_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-leastrequestlbconfig) -- [`RING_HASH`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#ring-hash) and may be further configured using [`ring_hash_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-ringhashlbconfig) option -- [`RANDOM`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#random) -- [`MAGLEV`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#maglev) and may be further configured using [`maglev_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-maglevlbconfig) option - -Some policy types support additional [configuration](/docs/reference/routes/load-balancing-policy-config). - ## Certificates Certificates are the x509 _public-key_ and _private-key_ used to establish secure HTTP and gRPC connections. Any combination of the above can be used together, and are additive. You can also use any of these settings in conjunction with `Autocert` to get OCSP stapling. diff --git a/content/docs/capabilities/self-hosted-authenticate-service.md b/content/docs/capabilities/self-hosted-authenticate-service.md deleted file mode 100644 index b9f9cfb46..000000000 --- a/content/docs/capabilities/self-hosted-authenticate-service.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -id: self-hosted-authenticate-service -title: Self-Hosted Authenticate Service -sidebar_label: Self-Hosted Authenticate Service -keywords: [self-hosted authenticate service url, self-hosted identity provider] -description: Use Pomerium's Self-Hosted Authenticate Service to deploy Pomerium with your own identity provider. ---- - -# Self-Hosted Authenticate Service - -Pomerium's **Self-Hosted Authenticate Service** allows you to configure Pomerium with the identity provider of your choice. - -The self-hosted authenticate service is available for open-source Pomerium, Pomerium Zero, and Pomerium Enterprise. - -:::info - -The _authenticate service_ is one of the [four logical services](/docs/internals/architecture#component-level) that make up Pomerium. The authenticate service is unique in that Pomerium can either run this service itself, or instead use the [Hosted Authenticate Service](/docs/capabilities/hosted-authenticate-service). - -::: - -## How the self-hosted authenticate service works - -To configure the self-hosted authenticate service, you will need to set up: - -- a URL for the authenticate service -- an identity provider (IdP) - -### Authenticate service URL - -The authenticate service URL is a public-facing URL that should resolve to your Pomerium instance. (If running in split service mode, this URL should resolve to the authenticate service.) Whenever a user is required to log in to access a route, Pomerium will redirect the user to the authenticate service using this URL. - -This URL should not contain a path or query parameters. For example, `https://authenticate.corp.example.com`. - -This URL must be different from any of the route URLs you use with Pomerium. - -See the [Authenticate Service URL](/docs/reference/service-urls#authenticate-service-url) reference page for details on how to configure this setting. - -:::info Why does Pomerium use a separate authenticate service URL? - -In a typical OIDC authentication flow, all redirect URLs must be pre-registered with the IdP. Pomerium uses a single authenticate service URL so that you need to register only one redirect URL with your IdP. This way, Pomerium can protect multiple upstream services without requiring you to update your IdP client whenever you add a new service. - -::: - -### Identity provider - -Pomerium relies on an IdP to authenticate users. Pomerium can use any IdP that implements the OpenID Connect (OIDC) protocol. - -The steps to configure your IdP will vary depending on the specific provider. See [**Identity Providers**](/docs/identity-providers) for a list of guides to configure commonly-used IdPs. - -You will generally need to configure your IdP client to allow an OAuth redirect URL based on your chosen authenticate service URL, with the path `/oauth2/callback` appended to it. - -For example, if your authenticate service URL is `https://authenticate.corp.example.com`, you should configure your identity provider to allow the redirect URI `https://authenticate.corp.example.com/oauth2/callback`. - -:::tip - -If you require a different callback path than `/oauth2/callback`, you can use the [Authenticate Callback Path](/docs/reference/authenticate-callback-path) setting to change the callback path. - -::: - -Once you have set up an IdP client, you will need to configure Pomerium with the IdP name, client ID and client secret, and possibly a URL assigned to your individual IdP client. - -See the [Identity Provider Settings](/docs/reference/identity-provider-settings#identity-provider-client-id) reference page for details on how to configure these settings. diff --git a/content/docs/capabilities/self-remediation.mdx b/content/docs/capabilities/self-remediation.mdx new file mode 100644 index 000000000..cfe809295 --- /dev/null +++ b/content/docs/capabilities/self-remediation.mdx @@ -0,0 +1,76 @@ +--- +title: 'Self-Remediation & Custom Error Pages' +sidebar_label: 'Self-Remediation' +description: "Enable user-driven fixes with custom explanations and remediation steps directly on Pomerium's denial pages." +keywords: + - 'pomerium' + - 'error messages' + - 'self-remediation' + - 'beyondcorp' + - 'device compliance' + - 'zero trust' +--- + +# Self-Remediation & Custom Error Pages + +:::enterprise + +This article describes a use case available to [Pomerium Enterprise](/docs/deploy/enterprise/install) customers. + +::: + +## Overview + +Pomerium can transform a typical “Access Denied” screen into an actionable self-help workflow. Rather than simply blocking users with a generic error, you can provide a direct explanation of **why** a request was denied and specific **remediation** steps they can follow to fix the issue. This approach not only streamlines user support but also dramatically speeds up your response to new security vulnerabilities or non-compliant devices. + +Consider a scenario where a user's OS is missing an important patch. Instead of seeing a cryptic error, they encounter a branded page that says: + +> “You need patch KB12345. Click here to download.” + +Once updated, they can immediately retry access—no waiting on IT, and no protracted back-and-forth with help desk tickets. + +## Error Details Setting + +To enable these expanded messages, toggle **Error Details** for a particular route. Go to the **General** tab of that route and activate “Error Details”: + +![Enable Error Details on a Route](./img/branding/enable_error_details.png) + +If you leave it off, users only see a generic 403 error without any additional instructions. + +## Explanation & Remediation Fields + +Each policy can include: + +- **Explanation**: A quick, human-readable note on why the policy denied access (e.g. “Your browser version is outdated.”). +- **Remediation**: Concrete steps to resolve it (e.g. “Download the latest Chrome update.”). + +![Add custom error messages.](./img/branding/policy_with_explanation_and_remediation.png) + +Pomerium displays these fields on denial pages. If a field is left blank, Pomerium shows the **Policy ID** to aid in troubleshooting. + +## Custom Header & Markdown + +You can define a global Header in the Branding settings, which appears at the top of every denial page. This header supports basic Markdown, allowing you to include help desk links, disclaimers, or even images. + +![Markdown Header](./img/branding/first_paragraph_setting.png) + +Use this to highlight urgent security notices, direct employees to an internal status page, or provide a quick path to open a help desk ticket. + +## Example Workflow + +1. **New Zero-Day Vulnerability**: A critical exploit is discovered in an outdated browser version. +2. **Policy Update**: Security updates the Pomerium policy to deny access unless users are on the patched browser. +3. **Explanation & Remediation**: + - Explanation: “Your browser is missing patch version 105.3.” + - Remediation: “Download the latest update from our software portal.” +4. **Real-Time Enforcement**: Any user on an unpatched browser sees a custom denial page. A single click takes them to the correct download. +5. **Instant Self-Fix**: The user installs the update, refreshes the page, and is granted access—no waiting on support. + +## Benefits of Self-Remediation + +- **Speedy Fixes**: Users solve common issues themselves without opening tickets or waiting on email responses. +- **Reduced Risk**: Admins can quickly enforce mandatory patching. Users have no workaround except to comply. +- **Lower IT Load**: Repetitive issues (outdated antivirus, missing OS patches) no longer flood the help desk queue. +- **Improved User Experience**: A direct, helpful message fosters trust, demonstrating that security policies exist to protect them—not block them arbitrarily. + +Coupled with [White Labeling](/docs/capabilities/branding), you can present these remediation messages in a fully branded interface, strengthening user confidence in your zero-trust security posture. By offering immediate guidance at the point of denial, you'll see fewer escalations, faster compliance, and a safer network overall. diff --git a/content/docs/capabilities/service-accounts.md b/content/docs/capabilities/service-accounts.md index c39a87815..855494da5 100644 --- a/content/docs/capabilities/service-accounts.md +++ b/content/docs/capabilities/service-accounts.md @@ -19,7 +19,7 @@ Service accounts offer a protected and standardized method of authenticating mac :::enterprise -Service Accounts are a Pomerium Enterprise feature. The steps below show you how to create and use a Service Account in the Enterprise Console. See our [Pomerium Enterprise](/docs/enterprise) page for more information. +Service Accounts are a Pomerium Enterprise feature. The steps below show you how to create and use a Service Account in the Enterprise Console. See our [Pomerium Enterprise](/docs/deploy/enterprise) page for more information. ::: @@ -45,7 +45,7 @@ Before you begin, confirm you are in the correct Namespace. You can only use a s See the following pages for more information: - - [**Directory Sync**](/docs/capabilities/directory-sync) + - [**Directory Sync**](/docs/integrations/user-standing/directory-sync) - [**User Impersonation**](/docs/capabilities/impersonation) ::: diff --git a/content/docs/capabilities/single-sign-out.md b/content/docs/capabilities/single-sign-out.md deleted file mode 100644 index 147a18532..000000000 --- a/content/docs/capabilities/single-sign-out.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -title: Single Sign-out -description: This article describes Pomerium's support for Single Sign-out according to OpenID Connect Front-Channel Logout 1.0. -pagination_next: null ---- - -Single sign-out (SSO) signs a user out of a secured application and clears both the remote application session generated by the identity provider and the local Pomerium session. - -## OIDC Front-Channel Logout - -Pomerium supports Front-Channel Logout as described in [OpenID Connect Front-Channel Logout 1.0](https://openid.net/specs/openid-connect-frontchannel-1_0.html). - -### Identity provider support - -See if your identity provider (IdP) supports Front-Channel Logout by checking your IdP’s `/.well-known/openid-configuration` endpoint. If your IdP supports it, you may see something similar to the JSON data below: - -```json -{ - "frontchannel_logout_session_supported": true -} -``` - -### Configure single sign-out - -To correctly implement SSO, you must register a `frontchannel_logout_uri` for your application that includes the path `/.pomerium/sign_out`. - -The `frontchannel_logout_uri` must match the external route in your policy. For example, `app.corp.example.com/.pomerium/sign_out`. - -If configured correctly, the following actions occur: - -1. The proxy service receives the sign-out request and clears the local Pomerium session -2. The proxy service redirects the request to the authenticate service URL’s `/.pomerium/sign_out` endpoint -3. The authentication service clears the remote application session - -![Single sign-out flow](./img/single-sign-out/sign-out-flow.svg) - -:::caution - -While it is possible to implement SSO using the **authenticate service URL** and the `/.pomerium/sign_out` endpoint, this method is not recommended. - -Signing out with the authenticate service URL won’t delete the session cookie on the route itself. To terminate the remote application and Pomerium sessions, you must point sign-out requests to the external route. - -::: - -
- Well-known Pomerium endpoint -
- -See Pomerium's `/.well-known/pomerium` endpoint to view OAuth, OIDC, and JWKS data. - -For example: - -```json -{ - "authentication_callback_endpoint": "https://authenticate.localhost.pomerium.io/oauth2/callback", - "jwks_uri": "https://authenticate.localhost.pomerium.io/.well-known/pomerium/jwks.json", - "frontchannel_logout_uri": "https://authenticate.localhost.pomerium.io/.pomerium/sign_out" -} -``` - -Note, a CSRF token is required for the single sign out endpoint (despite supporting `GET` and `POST`) and can be retrieved from the `X-CSRF-Token` response header on the well known endpoint above or using the `_pomerium_csrf` session set. - -
-
- -### Single sign-out example with Pomerium - -The example below demonstrates how to correctly implement SSO using the [JavaScript SDK](/docs/guides/verify-jwt): - -```js -export const signOut = (redirectUrl) => { - let location = window.location.origin + '/.pomerium/sign_out'; - if (redirectUrl) { - location += '?pomerium_redirect_uri=' + encodeURIComponent(redirectUrl); - } - window.location.href = location; -}; -``` - -In the example above, the `signOut` function appends the `/.pomerium/sign_out` endpoint to the external route URL, then redirects the user. - -From here, the proxy service clears the external route session and redirects the user to the authenticate service URL to clear the Pomerium session. diff --git a/content/docs/capabilities/tcp/client.mdx b/content/docs/capabilities/tcp/client.mdx deleted file mode 100644 index 76509f2c1..000000000 --- a/content/docs/capabilities/tcp/client.mdx +++ /dev/null @@ -1,160 +0,0 @@ ---- -# cSpell:ignore windowscentral - -title: Pomerium TCP Clients -sidebar_label: Desktop & CLI Clients -lang: en-US -keywords: - [ - pomerium, - identity access proxy, - pomerium desktop, - pomerium cli, - pomerium tcp over http, - ] -description: Learn how to create secured TCP connections to services behind Pomerium. -sidebar_position: 0 ---- - -import Tabs from '@theme/Tabs'; -import TabItem from '@theme/TabItem'; - -# Pomerium Desktop and CLI Clients - -This document describes how to use Pomerium's Desktop and CLI clients to connect to TCP routes in Pomerium. - -:::info What's a TCP route? - -A TCP route is for use with upstream services that don't speak HTTP — for example SSH, Redis, or MySQL. With a TCP route, the entire connection is proxied to the upstream service, rather than each individual request separately. - -In Pomerium, TCP routes are denoted with a `tcp+` prefix in the route's **From** URL. - -::: - -## Create a TCP route - -1. Specify this new Route as a TCP Route by prefixing `tcp+` in the **From** field, along with a port number -1. Set the **To** field using `tcp://` as the scheme, along with the address and port that the upstream service is listening on - -The example below demonstrates a route to an SSH service on the host running Pomerium: - - - - -![Creating a TCP route in the Zero Console](./examples/img/desktop/zero-ssh-route-example.png) - - - - -![Example TCP route for SSH](./img/tcp-ssh-route.png) - - - - -```yaml -- from: tcp+https://ssh.localhost.pomerium.io:22 - to: tcp://127.0.0.1:22 - policy: - - allow: - or: - - email: - is: user@companydomain.com -``` - - - - -:::tip - -The port number in the route **From** URL is not used in the initial connection to Pomerium itself. This connection will still use port 443, unless you use a bastion host (see [**Advanced configuration**](#advanced-configuration) below). - -Rather, the port defined in **From** is part of the mapping to the individual route. In this way, you can create multiple routes that share a DNS entry, differentiated by the port to determine which route they use. - -For example, suppose we have a server called `augur` running behind Pomerium that has a MySQL server and also listens for SSH connections. We can create routes for `tcp+https://augur.example.com:22` and `tcp+https://augur.example.com:3306`. - -::: - -:::info - -To learn about building TCP routes, see: - -- [**Configure TCP Routes**](/docs/capabilities/tcp#configure-tcp-routes) -- [**Advanced TCP usage**](/docs/capabilities/tcp#advanced-capabilities) - -::: - -## Access TCP routes with a client - -You can connect to this route with either the Pomerium CLI or Pomerium Desktop client. - -### Desktop client steps - -If you haven't, install [Pomerium Desktop](/docs/clients/pomerium-desktop). - -Then, add a connection by filling in the fields defined below: - -- **Name**: A local name for the route -- **Destination**: Matches the [From](/docs/reference/routes/from) value of the route, without the protocol. Always include the port specified in the route, and do not include the `https://` protocol. -- **Local Address**: The local address and port number from which to access the service locally. If left blank, the client will choose a random port to listen to on the loopback address. -- **Tags**: Customizable tags to sort and organize TCP routes - -![Adding a new connection in the Pomerium Desktop client](./examples/img/desktop/desktop-new-connection.png) - -#### Advanced Settings - -- **Pomerium URL**: The Pomerium Proxy service address. This is required if the **Destination URL** can't be resolved from DNS or a local `hosts` entry, or if the Proxy service uses a non-standard port. -- **Disable TLS Verification**: Allows untrusted certificates from the Pomerium gateway -- **Client Certificates**: For routes that enforce [mTLS](/docs/concepts/mutual-auth), you can **set a client certificate manually** or automatically [**search the OS certificate store**](/docs/capabilities/tcp#client-certificates) for a trusted certificate (note: macOS and Windows only). - -![Reviewing the Advanced Settings in the Pomerium Desktop client](./examples/img/desktop/advanced-settings.png) - -### Pomerium CLI steps - -If you haven't, install [Pomerium CLI](/docs/clients/pomerium-cli). - -Then, connect to a TCP route: - -1. Invoke `pomerium-cli` with the `tcp` option, and provide the route to your service (as defined in [`from`](/docs/reference/routes/from) in your Route specification). - - ```shell-session - $ pomerium-cli tcp ssh.localhost.pomerium.io:22 - 2023/10/02 11:29:22 listening on 127.0.0.1:53656 - ``` - - You can optionally supply an address and/or port to the `listen` flag: - - ```shell-session - $ pomerium-cli tcp ssh.localhost.pomerium.io:22 --listen :2222 - 2023/10/02 11:30:03 listening on [::]:2222 - ``` - -1. Connect to your service using the local address and port specified in the output of `pomerium-cli`: - - ```bash - ssh 127.0.0.1 -p 2222 - ``` - -1. When the connection starts, the CLI will open your browser and direct you to your Identity Provider to authenticate your session. Once authenticated, the connection will continue and you can close the browser window. - -1. In this example, since we are using SSH we can consolidate the TCP and SSH connections into a single command: - - ```bash - ssh -o ProxyCommand='pomerium-cli tcp --listen - %h:%p' ssh.localhost.pomerium.io - ``` - -:::info - -For more examples and detailed usage information, see the following docs: - -- [**TCP Reference**](/docs/capabilities/tcp/reference) -- [**Securing TCP-based Services**](/docs/capabilities/tcp) - -::: - -## Advanced configuration - -If Pomerium is listening on a port other than `443` (set with the [`address` key](/docs/reference/address)), the full TCP URL can be specified with a bastion host: - -```bash -pomerium-cli tcp tcp+https://ssh.localhost:pomerium.io:8443/ssh.localhost.pomerium.io:2222 --listen :2222 -``` diff --git a/content/docs/capabilities/tcp/examples/img/desktop/advanced-settings.png b/content/docs/capabilities/tcp/examples/img/desktop/advanced-settings.png deleted file mode 100644 index a3f1d1a8b..000000000 Binary files a/content/docs/capabilities/tcp/examples/img/desktop/advanced-settings.png and /dev/null differ diff --git a/content/docs/capabilities/tcp/examples/img/desktop/desktop-new-connection.png b/content/docs/capabilities/tcp/examples/img/desktop/desktop-new-connection.png deleted file mode 100644 index d06353c2e..000000000 Binary files a/content/docs/capabilities/tcp/examples/img/desktop/desktop-new-connection.png and /dev/null differ diff --git a/content/docs/capabilities/tcp/examples/img/desktop/example-git-connection.png b/content/docs/capabilities/tcp/examples/img/desktop/example-git-connection.png deleted file mode 100644 index d1ca8fc8b..000000000 Binary files a/content/docs/capabilities/tcp/examples/img/desktop/example-git-connection.png and /dev/null differ diff --git a/content/docs/capabilities/tcp/examples/img/desktop/example-mssql-connection.png b/content/docs/capabilities/tcp/examples/img/desktop/example-mssql-connection.png deleted file mode 100644 index ada93a136..000000000 Binary files a/content/docs/capabilities/tcp/examples/img/desktop/example-mssql-connection.png and /dev/null differ diff --git a/content/docs/capabilities/tcp/examples/img/desktop/pomerium-desktop-postgres.png b/content/docs/capabilities/tcp/examples/img/desktop/pomerium-desktop-postgres.png deleted file mode 100644 index bc7c4fa98..000000000 Binary files a/content/docs/capabilities/tcp/examples/img/desktop/pomerium-desktop-postgres.png and /dev/null differ diff --git a/content/docs/capabilities/tcp/examples/img/desktop/zero-ssh-route-example.png b/content/docs/capabilities/tcp/examples/img/desktop/zero-ssh-route-example.png deleted file mode 100644 index 977436413..000000000 Binary files a/content/docs/capabilities/tcp/examples/img/desktop/zero-ssh-route-example.png and /dev/null differ diff --git a/content/docs/capabilities/tcp/reference.md b/content/docs/capabilities/tcp/reference.md deleted file mode 100644 index 4495daeac..000000000 --- a/content/docs/capabilities/tcp/reference.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Pomerium-CLI TCP Reference -sidebar_label: Reference -hide_table_of_contents: false -description: Manage your TCP connections from the command line with Pomerium-CLI. -keywords: [tcp, cli, pomerium] ---- - -# TCP reference for pomerium-cli - -This TCP reference covers `pomerium-cli` commands you can use to manage TCP connections in Pomerium. - -## Usage - -```shell -pomerium-cli tcp [destination] [flags] -``` - -## Flags - -| Flags | Description | Type | -| :-- | :-- | --- | -| #--alternate-ca-path | Path to CA certificate to use for HTTP requests. | string | -| #--browser-cmd | Custom browser command to run when opening a URL. | string | -| #--ca-cert | Path to CA certificate to use for HTTP requests. | string | -| #--client-cert | (optional) PEM-encoded client certificate. | string | -| # --client-key | (optional) PEM-encoded client certificate key. | string | -| # --client-cert-from-store | (optional) If provided, pomerium-cli will attempt to use a client certificate from the system trust store (macOS and Windows only), searching for a certificate based on the trusted CA names advertised by Pomerium in the TLS handshake. | none | -| # --client-cert-issuer | (optional) When used in combination with --client-cert-from-store, restricts the client certificate search based on a particular attribute of the certificate's [Issuer name](#certificate-name-filters). | string | -| # --client-cert-subject | (optional) When used in combination with --client-cert-from-store, restricts the client certificate search based on a particular attribute of the certificate's [Subject name](#certificate-name-filters). | string | -| #--disable-tls-verification | Disables TLS verification. | none | -| #-h, --help | Help for tcp. | none | -| #--listen | Local address to start a listener on (default "127.0.0.1:0"). | string | -| #--pomerium-url | The URL of the Pomerium server to connect to. | string | -| #-v, --version | Version for pomerium-cli. | none | - -### Certificate name filters - -The certificate name filter syntax is `attribute=value`. A name filter can accept only one name attribute. The value must be an exact match (not a substring match). Make sure to quote name filters as appropriate for your shell. - -For example, `--client-cert-issuer "CN=My Trusted CA"` would filter for a certificate directly issued by a CA with the Common Name "My Trusted CA". - -Or, `--client-cert-subject "OU=My Department"` would filter for a certificate whose Subject name contains the Organizational Unit Name "My Department". - -The supported name attributes are: - -- commonName (CN) -- countryName (C) -- localityName (L) -- organizationName (O) -- organizationalUnitName (OU) -- postalCode -- serialNumber -- stateOrProvinceName (ST) -- streetAddress (STREET) - -Either the long or abbreviated attribute name may be used (for example, `localityName=New York` or `L=New York`). - -Values are case sensitive: `L=new york` will not match the Locality Name "New York". diff --git a/content/docs/clients.md b/content/docs/clients.md deleted file mode 100644 index a69f0f2da..000000000 --- a/content/docs/clients.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -id: clients -title: Pomerium Core Clients -sidebar_label: Clients ---- - -# Pomerium Core Clients - -Pomerium offers optional CLI and Desktop clients: - -- [Pomerium CLI](/docs/clients/pomerium-cli) -- [Pomerium Desktop](/docs/clients/pomerium-desktop) - -Both the CLI and Desktop clients act as an authentication helper for tools like kubectl and TCP-based connections. - -See the [Pomerium Desktop and CLI Clients](/docs/capabilities/tcp/client) page for more information. diff --git a/content/docs/clients/pomerium-cli.mdx b/content/docs/clients/pomerium-cli.mdx deleted file mode 100644 index 58d933501..000000000 --- a/content/docs/clients/pomerium-cli.mdx +++ /dev/null @@ -1,119 +0,0 @@ ---- -# cSpell:ignore commandline armv abnf gpgcheck gpgkey sslverify dockerhub - -title: Pomerium CLI -lang: en-US -pagination_prev: null -pagination_next: null -description: How to get Pomerium's CLI which be used to proxy TCP services and kubernetes commands -keywords: - [ - pomerium, - cli, - commandline, - command line interface, - kubectl, - tcp, - tcp over http, - ] -sidebar_label: Pomerium CLI -sidebar_position: 3 ---- - -import Tabs from '@theme/Tabs'; -import TabItem from '@theme/TabItem'; - -# Pomerium's Command Line Interface - -Pomerium CLI is an optional command-line client that works as an authentication helper for tools like [kubectl](/docs/k8s/configure.md) and [TCP-based applications](/docs/capabilities/tcp/). - -- Supported Operating Systems: `linux`, `darwin`, `windows`, `freebsd` -- Supported Architectures: `amd64`, `arm64`, `armv6`, `armv7` - -### Binaries - -You can find official binaries on our [GitHub Releases](https://github.com/pomerium/cli/releases) page. - -```shell -ARCH=[your arch] -OS=[your os] -VERSION=[desired version] -curl -L https://github.com/pomerium/cli/releases/download/${VERSION}/pomerium-cli-${OS}-${ARCH}.tar.gz \ - | tar -z -x -``` - -### Packages - -Supported formats include `rpm` and `deb`. - -You can find official packages on our [GitHub Releases](https://github.com/pomerium/cli/releases) page or from [Cloudsmith](https://cloudsmith.io/~pomerium/repos/pomerium/packages/). - -- [RPM Instructions](https://cloudsmith.io/~pomerium/repos/pomerium/setup/#formats-rpm) -- [Deb Instructions](https://cloudsmith.io/~pomerium/repos/pomerium/setup/#formats-deb) - - - - - -```abnf title="/etc/yum.repos.d/pomerium-cli.repo" -[pomerium-pomerium] -name=pomerium-pomerium -baseurl=https://dl.cloudsmith.io/public/pomerium/pomerium/rpm/el/$releasever/$basearch -repo_gpgcheck=1 -enabled=1 -gpgkey=https://dl.cloudsmith.io/public/pomerium/pomerium/gpg.6E388440B94E1407.key -gpgcheck=1 -sslverify=1 -pkg_gpgcheck=1 -``` - - - - -```bash -curl -1sLf 'https://dl.cloudsmith.io/public/pomerium/pomerium/gpg.6E388440B94E1407.key' | apt-key add - -echo "deb https://dl.cloudsmith.io/public/pomerium/pomerium/deb/debian buster main" > /etc/apt/sources.list.d/pomerium-pomerium.list -``` - - - - -### Homebrew - -```shell -brew tap pomerium/tap -brew install pomerium-cli -``` - -### Docker Image - -Pomerium CLI uses a [minimal](https://github.com/GoogleContainerTools/distroless) Docker container. You can find the CLI image on [Docker Hub](https://hub.docker.com/r/pomerium/cli), and pull it in several flavors and architectures. Refer to the example commands below to pull specific versions of Pomerium CLI. - -- The `:vX.Y.Z` tag pulls a [specific tagged release](https://github.com/pomerium/cli/tags). - - ```bash {2} - docker run cr.pomerium.com/pomerium/cli:v0.1.0 --version - v0.1.0+53bfa4e - ``` - -- The `:latest` tag pulls the [most recent tagged release](https://github.com/pomerium/cli/releases). - - ```bash {2} - docker run cr.pomerium.com/pomerium/cli:latest --version - v0.2.0+87e214b - ``` - -- The `:main` tag pulls an image in sync with git's [main](https://github.com/pomerium/pomerium/tree/main) branch. - - ```bash - docker pull cr.pomerium.com/pomerium/cli:main - ``` - -### Source - -```shell -git clone git@github.com:pomerium/cli.git -cd pomerium -make build -./bin/pomerium-cli --help -``` diff --git a/content/docs/clients/pomerium-desktop.mdx b/content/docs/clients/pomerium-desktop.mdx deleted file mode 100644 index ccc2fc20e..000000000 --- a/content/docs/clients/pomerium-desktop.mdx +++ /dev/null @@ -1,48 +0,0 @@ ---- -# cSpell:ignore commandline armv - -title: Pomerium Desktop -lang: en-US -sidebar_label: Pomerium Desktop -pagination_prev: null -pagination_next: null -description: How to get Pomerium's CLI which be used to proxy TCP services and kubernetes commands -keywords: - [ - pomerium, - cli, - commandline, - command line interface, - kubectl, - tcp, - tcp over http, - gui, - ] -sidebar_position: 4 ---- - -# Pomerium Desktop - -Pomerium Desktop does everything `pomerium-cli` does, but is designed for users who prefer a graphical user interface. - -Functions include acting as an authentication helper for tools like [kubectl](/docs/k8s/configure.md) or TCP [based applications](/docs/capabilities/tcp/). - -- Supported Operating Systems: `linux`, `darwin`, `windows`, -- Supported Architectures: `amd64`, `arm64`, `armv6`, `armv7` - -## Packages - -Download the latest release from [GitHub](https://github.com/pomerium/desktop-client/releases). - -- **Windows**: The installer `.exe` file will install and open the Desktop Client. Right click on the system tray icon to interact with it. -- **Linux**: We provide Linux binaries as `.AppImage` files, which can be executed in place or managed with a tool like [AppImageLauncher](https://github.com/TheAssassin/AppImageLauncher). Interact with the client from the system tray icon. -- **macOS**: Open the `dmg` and move the binary to **Applications**. Interact with the client from the system tray icon. - -## Brew (OSX) - -Alternatively, on Mac. - -```shell -brew tap pomerium/tap -brew install pomerium-desktop -``` diff --git a/content/docs/community.mdx b/content/docs/community.mdx deleted file mode 100644 index bd8af7170..000000000 --- a/content/docs/community.mdx +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Community -lang: en-US -keywords: [pomerium, community, help, bugs, updates, features] -description: This document describes how you users can stay up to date with pomerium, report issues, get help, and suggest new features. ---- - -import {CommunityNewsletterForm} from '../../src/components/Newsletter'; - -## Get updates - -- [Pomerium-announce](https://groups.google.com/forum/#!forum/pomerium-announce) is a low traffic mailing list for important releases and security announcements. - -- Follow us on Twitter [@pomerium_io](https://twitter.com/pomerium_io) or [LinkedIn](https://www.linkedin.com/company/pomerium-inc) for the latest updates and industry news. - -- Check out our forum, [Discuss](https://discuss.pomerium.com/), where the community explores Pomerium's uses and shares their best practices. - -- Want updates delivered directly to your inbox? Sign up for our newsletter here: - - - -## Get help - -For general help and configuration questions, discussions about integrations or complex setups, or anything else related to Pomerium, head to our [Discuss](https://discuss.pomerium.com/) forum, where you can search for open threads or start a new one. - -## Report bugs - -Like every software, Pomerium has its flaws. If you find one, [search the issues](https://github.com/pomerium/pomerium/issues) to see if it has already been reported. If not, [open a new issue](https://github.com/pomerium/pomerium/issues/new) and describe the bug, and somebody will look into it! - -Please follow the issue template so we have all the needed information. We need to be able to repeat the bug using your instructions. Please simplify the issue as much as possible. The more detailed and specific you are, the faster we will be able to help you! - -We suggest reading [How to Report Bugs Effectively](http://www.chiark.greenend.org.uk/~sgtatham/bugs.html). - -## Suggest features - -First, search to see if your feature has already been requested on [GitHub](https://github.com/pomerium/pomerium/issues) or [Discuss](https://discuss.pomerium.com/). If it has, you can add a :+1: reaction to vote for it. If your feature idea is new, open an issue to request the feature. You don't have to follow the bug template for feature requests. Please describe your idea thoroughly so that we know how to implement it! Really vague requests may not be helpful or actionable and without clarification will have to be closed. - -While we really do value your requests and implement many of them, not all features are a good fit for Pomerium. If a feature is not in the best interest of the Pomerium project or its users in general, we may politely decline to implement it. diff --git a/content/docs/community/code-of-conduct.md b/content/docs/community/code-of-conduct.md deleted file mode 100644 index 0acaec7e1..000000000 --- a/content/docs/community/code-of-conduct.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Contributor Covenant Code of Conduct -sidebar_label: Code of Conduct -lang: en-US -keywords: [pomerium, community, contributing, code of conduct] ---- - -## Our Pledge - -In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation. - -## Our Standards - -Examples of behavior that contributes to creating a positive environment include: - -- Using welcoming and inclusive language -- Being respectful of differing viewpoints and experiences -- Gracefully accepting constructive criticism -- Focusing on what is best for the community -- Showing empathy towards other community members - -Examples of unacceptable behavior by participants include: - -- The use of sexualized language or imagery and unwelcome sexual attention or advances -- Trolling, insulting/derogatory comments, and personal or political attacks -- Public or private harassment -- Publishing others' private information, such as a physical or electronic address, without explicit permission -- Other conduct which could reasonably be considered inappropriate in a professional setting - -## Our Responsibilities - -Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior. - -Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. - -## Scope - -This Code of Conduct applies within all project spaces, and it also applies when an individual is representing the project or its community in public spaces. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers. - -## Enforcement - -Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at info@pomerium.io. All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately. - -Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership. - -## Attribution - -This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html - -[homepage]: https://www.contributor-covenant.org - -For answers to common questions about this code of conduct, see https://www.contributor-covenant.org/faq diff --git a/content/docs/community/contributing.md b/content/docs/community/contributing.md deleted file mode 100644 index 60251419f..000000000 --- a/content/docs/community/contributing.md +++ /dev/null @@ -1,172 +0,0 @@ ---- -# cSpell:ignore zerolog jsonnet -title: Contributing -lang: en-US -keywords: [pomerium, community, contributing, pr, code] -description: This document describes how you can find issues to work on, fix/add documentation, and how setup Pomerium for local development. ---- - -First of all, thank you for considering contributing to Pomerium! You can have a direct impact on Pomerium by helping with its code or documentation. - -- To contribute to Pomerium, open a [pull request](https://github.com/pomerium/pomerium/pulls) (PR) to the Pomerium repository -- To contribute to the documentation, open a PR to the documentation repository - -If you're new to our community, that's okay: **we gladly welcome pull requests from anyone, regardless of your native language or coding experience.** - -## General - -We try to hold contributions to a high standard for quality, so don't be surprised if we ask for revisions--even if it seems small or insignificant. Please don't take it personally. If your change is on the right track, we can guide you to make it mergeable. - -Here are some of the expectations we have of contributors: - -- If your change is more than just a minor alteration, **open an issue to propose your change first.** This way we can avoid confusion, coordinate what everyone is working on, and ensure that changes are in-line with the project's goals and the best interests of its users. If there's already an issue about it, comment on the existing issue to claim it. - -- **Keep pull requests small.** Smaller PRs are more likely to be merged because they are easier to review! We might ask you to break up large PRs into smaller ones. [An example of what we DON'T do.](https://twitter.com/iamdevloper/status/397664295875805184) - -- **Keep related commits together in a PR.** We do want pull requests to be small, but you should also keep multiple related commits in the same PR if they rely on each other. - -- **Write tests.** Tests are essential! Written properly, they ensure your change works, and that other changes in the future won't break your change. CI checks should pass. - -- **Benchmarks should be included for optimizations.** Optimizations sometimes make code harder to read or have changes that are less than obvious. They should be proven with benchmarks or profiling. - -- **[Squash](http://gitready.com/advanced/2009/02/10/squashing-commits-with-rebase.html) insignificant commits.** Every commit should be significant. Commits which merely rewrite a comment or fix a typo can be combined into another commit that has more substance. Interactive rebase can do this, or a simpler way is `git reset --soft ` then `git commit -s`. - -- **Own your contributions.** Pomerium is a growing project, and it's much better when individual contributors help maintain their change after it is merged. - -- **Use comments properly.** We expect good godoc comments for package-level functions, types, and values. Comments are also useful whenever the purpose for a line of code is not obvious. - -:::info **Recommended reading** - -- [**CodeReviewComments**](https://github.com/golang/go/wiki/CodeReviewComments) -- [**Linus Torvalds describes a good commit message**](https://gist.github.com/matthewhudson/1475276) -- [**Best Practices for Maintainers**](https://opensource.guide/best-practices/) -- [**Shrinking Code Review**](https://alexgaynor.net/2015/dec/29/shrinking-code-review/) - -::: - -### Versioning - -Pomerium uses [Semantic Versioning](https://semver.org/). In practice, this means for a given version number **vMAJOR**.**MINOR**.**PATCH** (for example, `v0.1.0`): - -- **MAJOR** indicates an incompatible API change -- **MINOR** indicates a new, backwards-compatible functionality -- **PATCH** indicates a backwards-compatible bug fix - -As Pomerium is still pre-`v1.0.0`, you should expect breaking changes between releases. - -### Development - -See [Building Pomerium From Source](/docs/core/from-source) for information on getting started developing for Pomerium. - -To run the unit tests locally: - -```bash -make test -``` - -The instrumentation tests run using [Docker Compose]. To run the instrumentation tests locally, first build a development Docker image: - -```bash -./scripts/build-dev-docker.bash -``` - -Next pick a configuration from the `integration/clusters` directory, for example `single-stateful`, and use Docker Compose to start that configuration. Use the `POMERIUM_TAG` environment variable to specify the `dev` docker image built in the previous step: - -```bash -cd integration/clusters/single-stateful -env POMERIUM_TAG=dev docker compose up -V -``` - -Once that's up and running you can run the integration tests from another terminal: - -```bash -go test -count=1 -v ./integration/... -``` - -If you need to make a change to the test configuration itself, there's a [tpl](https://github.com/pomerium/pomerium/tree/main/integration/tpl) folder that contains `jsonnet` files. Make a change and then rebuild the configuration by running: - -```bash -go run ./integration/cmd/pomerium-integration-tests/ generate-configuration -``` - -### Logging - -Pomerium uses the [zerolog](https://github.com/rs/zerolog) package for logging. Guidelines for log levels: - -| Level | When to use | -| --- | --- | -| Panic | _Do not use._ Use Fatal instead. | -| Fatal | For unrecoverable errors at startup, or extremely exceptional circumstances at normal runtime. | -| Error | Something has failed, and an operator should know about it. | -| Warning | _Do not use._ Use Info or Error instead. | -| Info | An operator should want to see this during normal operation or routine inspection. | -| Debug | Verbose operational information that might be useful during troubleshooting. | -| Trace | Information that you would care about only when trying to understand code behavior/ordering/interaction. Intended for someone looking at or familiar with the code, not most end users. | - -## Docs - -Pomerium's documentation is available at [https://www.pomerium.io/docs](https://www.pomerium.io/docs). If you find a typo, feel a section could be better described, or have an idea for a totally new application or section, don't hesitate to make a PR change. There are few ways you can do this. - -### Simple edits - -The easiest way to fix minor documentation issues in Pomerium is to click on the **Edit this page** link at the bottom of any page. - -![Selecting the Edit this page link on a docs page](./img/contributing-edit-this-page.png) - -Doing so will redirect you to the the respective file in the Documentation repository. Here, you can [update the page](https://guides.github.com/features/mastering-markdown/) and commit your changes. - -Committing your changes will create a new branch and start a PR. - -![Adding proposed changes in the docs repository](./img/contributing-proposed-changes.png) - -### Bigger changes - -If you need to add a new page, or would like greater control over the editing process you can edit the docs similar to how you would make changes to the source code. - -#### Prerequisites - -We use [Docusaurus](https://docusaurus.io/) to generate our docs. Docusaurus is a React-powered static-site generator designed for documentation. - -Before building the docs, you'll need the following packages: - -- [Node.js](https://nodejs.org/en/download/) -- [Yarn](https://yarnpkg.com/lang/en/docs) - -#### Make changes - -Once you've installed Node and Yarn, in a terminal run the following command: - -```bash -yarn start -``` - -You should see a link to the development server: - -```bash -[INFO] Starting the development server... -[SUCCESS] Docusaurus website is running at: http://localhost:3001/ -``` - -Once you have the development server up and running, any changes you make will automatically be reloaded and accessible in your browser. - -To add a new document, simply add a new file with the `.md` markdown extension. For example, this document would be `docs/community/contributing.md`. - -To make changes to the sidebar or navigation, see the following Docusaurus docs for instructions: - -- [Sidebar](https://docusaurus.io/docs/sidebar) -- [Navbar](https://docusaurus.io/docs/api/themes/configuration#navbar) - -### PR previews - -We use [Netlify](https://www.netlify.com) to build and host our docs. A nice feature of Netlify is the [Deploy Preview URL](https://docs.netlify.com/site-deploys/deploy-previews/#deploy-preview-urls), which generates a link for PRs. This is helpful if you want to compare your local changes to what will ultimately be deployed in production. - -After you've pushed your PR, a member of the documentation team will review your PR and communicate any next steps or suggestions before the PR is merged. - -[configuration variables]: /docs/reference -[docker compose]: https://docs.docker.com/compose/ -[download]: https://github.com/pomerium/pomerium/releases -[environmental configuration variables]: https://12factor.net/config -[verify]: https://verify.pomerium.com/ -[identity provider]: /docs/identity-providers -[make]: https://en.wikipedia.org/wiki/Make_(software) -[tls certificates]: /docs/guides/certificates diff --git a/content/docs/community/img/contributing-edit-this-page.png b/content/docs/community/img/contributing-edit-this-page.png deleted file mode 100644 index 68c7c64cd..000000000 Binary files a/content/docs/community/img/contributing-edit-this-page.png and /dev/null differ diff --git a/content/docs/community/img/contributing-proposed-changes.png b/content/docs/community/img/contributing-proposed-changes.png deleted file mode 100644 index 4646ba1e4..000000000 Binary files a/content/docs/community/img/contributing-proposed-changes.png and /dev/null differ diff --git a/content/docs/concepts/access-control.mdx b/content/docs/concepts/access-control.mdx deleted file mode 100644 index c36502774..000000000 --- a/content/docs/concepts/access-control.mdx +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: Identity and Access Control (IAM) -sidebar_label: Identity & Access Management (IAM) -lang: en-US -keywords: - [ - access, - authentication, - authorization, - Users, - groups, - rbac, - access control, - namespacing, - ] ---- - -# Identity and Access Management (IAM) - -## What is identity and access management? - -Identity and access management (IAM) is the process of verifying a user’s identity and determining what resources they can access. By enforcing an IAM policy within your organization, you can control what permissions a user has, where they can access resources from, and when. - -This degree of fine-grained access control is key to implementing a zero-trust security framework within your organization. Learn how Pomerium helps organizations adopt zero trust starting with IAM. - -If you're unfamiliar with IAM, review the following core concepts below: - -- [OAuth 2.0 and OIDC](#oauth-20-and-open-id-connect-oidc) -- [Identity providers](#identity-provider-idp) -- [Authentication and authorization](#how-pomerium-handles-authentication-and-authorization) - -### OAuth 2.0 and Open ID Connect (OIDC) - -[OAuth 2.0](https://www.rfc-editor.org/rfc/rfc6749) is an authorization protocol that defines how a user can grant an application limited access to their resources without exchanging details like their username or password. Instead, the application uses an authorization grant to request access to the user's resources from a resource server. - -[Open ID Connect](https://openid.net/specs/openid-connect-core-1_0.html#toc) (OIDC) is an authentication protocol built on top of OAuth 2.0. In the case of OIDC, an authorization server verifies the identity of the user and stores that information in an ID token (JWT). The ID token contains identity-related data in the form of claims, and the ID token is passed from the server to the application. - -Together, these protocols offer a secure and scalable method for organizations to authenticate and authorize users. - -### Identity provider (IdP) - -An identity provider (IdP) is a service, like Google or Okta, that stores digital identities (information about a user). When an application needs to verify a user’s identity (OIDC) or request resources on behalf of a user (OAuth 2.0), it speaks to the IdP first. This way, the user only needs to authenticate against the IdP, not the application they want to access. - -In the case of Pomerium, the proxy service routes requests to upstream applications and relies on other Pomerium services, like the authentication and authorization services, to handle identity verification with your IdP and to process policy to make access control decisions. - -## How Pomerium handles authentication and authorization - -Two core concepts within IAM are [**authentication** vs. **authorization**](https://www.pomerium.com/blog/authentication-v-authorization/): - -- **Authentication** (AuthN) verifies your identity (Are you who you say you are?) -- **Authorization** (AuthZ) determines if you’re allowed to do what you’re trying to do (Do you have permission to access the resource?) - -Pomerium provides a standardized interface to add access control, regardless if an application itself has authorization or authentication baked in. This allows developers to focus on their app's functionality, not reinventing access control. - -### Authentication (AuthN) - -Pomerium provides authentication through your existing IdP and supports all major [single sign-on](/docs/identity-providers) (SSO) providers, including Okta, Google, Azure AD, AuthO, Ping, and GitHub. - -### Authorization (AuthZ) - -Pomerium handles authorization with its high-level, declarative [Pomerium Policy Language](/docs/capabilities/ppl) (PPL). You can configure an authorization policy using PPL to enforce attribute-based access control (ABAC), role-based access control (RBAC), or any other governance policy controls. - -Pomerium can make holistic policy and authorization decisions using external data and request context factors such as user groups, roles, time, day, location, and vulnerability status. - -### Zero-trust access - -Pomerium enables zero-trust access. This means trust flows from identity, device state, and context – not network connection. - -With Pomerium: - -- Requests are continuously re-evaluated on a per-request basis -- Authorization is context- and identity-aware: You can use Pomerium to integrate data from any source into authorization policy decisions -- Trust flows from user and device identity, meaning you can authenticate, authorize, and encrypt communication between every user, device, and application - -### Audit logs - -Pomerium provides detailed [audit logs](/docs/capabilities/audit-logs) for all activity in your environment. This enables you to quickly detect anomalies to mitigate bad actors and revoke access. - -### Users and groups​ - -Pomerium populates users and groups from your IdP. This data is cached to prevent hitting API rate-limits, ensure policy enforcement performance, and provide look-ahead support when adding users or groups to [Namespaces](/docs/capabilities/namespacing) and [Policies](/docs/capabilities/ppl). - -### Non-domain users​ - -You may encounter a situation where you may want to add users that are not directly associated with your corporate IdP service. For example, if you have a corporate Google Workspace account and want to add a contractor with a Gmail account, you would have two options: - -- Create a group within your IdP directly with the non-domain users in it. This group can be found and added to Namespaces and Policies. -- Manually add the user's unique ID. Identify the ID from a user's **Session Details** page, or the [Sessions](/docs/capabilities/metrics#sessions-enterprise) page in [Pomerium Enterprise](/docs/enterprise). A user can see their session ID by navigating to the special `/.pomerium` URL endpoint from any Pomerium-managed route. The unique ID is listed as **Sub** under User Details: - - ![The User Details page, showing the "sub" data](img/access-control/session-details.png) diff --git a/content/docs/concepts/img/access-control/session-details.png b/content/docs/concepts/img/access-control/session-details.png deleted file mode 100644 index 47648f81a..000000000 Binary files a/content/docs/concepts/img/access-control/session-details.png and /dev/null differ diff --git a/content/docs/concepts/img/auth-flow-diagram.svg b/content/docs/concepts/img/auth-flow-diagram.svg deleted file mode 100644 index f361156fe..000000000 --- a/content/docs/concepts/img/auth-flow-diagram.svg +++ /dev/null @@ -1,399 +0,0 @@ -BrowserIdentity ProviderIngressPomeriumPomerium AuthNPomerium AuthZappGET /app/verify/appAuthenticated?No!HTTP 301 sign in callback urlHTTP 301: Oauth2 callback endpointSave sessionHTTP 301 app/verify/appAuthenticated?Yes!Authorized?Yes?HTTP 200OK!BrowserIdentity ProviderIngressPomeriumPomerium AuthNPomerium AuthZapp \ No newline at end of file diff --git a/content/docs/concepts/img/clusters/cluster-ip-address-settings.png b/content/docs/concepts/img/clusters/cluster-ip-address-settings.png deleted file mode 100644 index 000a2fe1f..000000000 Binary files a/content/docs/concepts/img/clusters/cluster-ip-address-settings.png and /dev/null differ diff --git a/content/docs/concepts/img/clusters/cluster-name-table.png b/content/docs/concepts/img/clusters/cluster-name-table.png deleted file mode 100644 index e3b9e100c..000000000 Binary files a/content/docs/concepts/img/clusters/cluster-name-table.png and /dev/null differ diff --git a/content/docs/concepts/img/clusters/clusters-architecture.png b/content/docs/concepts/img/clusters/clusters-architecture.png deleted file mode 100644 index b3b97e069..000000000 Binary files a/content/docs/concepts/img/clusters/clusters-architecture.png and /dev/null differ diff --git a/content/docs/concepts/img/clusters/replica-status.png b/content/docs/concepts/img/clusters/replica-status.png deleted file mode 100644 index e539710bb..000000000 Binary files a/content/docs/concepts/img/clusters/replica-status.png and /dev/null differ diff --git a/content/docs/concepts/img/clusters/update-cluster-token.png b/content/docs/concepts/img/clusters/update-cluster-token.png deleted file mode 100644 index 7fa5495b1..000000000 Binary files a/content/docs/concepts/img/clusters/update-cluster-token.png and /dev/null differ diff --git a/content/docs/concepts/img/clusters/zero-databroker-connection-string.png b/content/docs/concepts/img/clusters/zero-databroker-connection-string.png deleted file mode 100644 index d5e0c836c..000000000 Binary files a/content/docs/concepts/img/clusters/zero-databroker-connection-string.png and /dev/null differ diff --git a/content/docs/concepts/img/jaeger.png b/content/docs/concepts/img/jaeger.png deleted file mode 100644 index ea1b1b53d..000000000 Binary files a/content/docs/concepts/img/jaeger.png and /dev/null differ diff --git a/content/docs/concepts/img/mutual-authentication/jwt-verification.svg b/content/docs/concepts/img/mutual-authentication/jwt-verification.svg deleted file mode 100644 index 27e446796..000000000 --- a/content/docs/concepts/img/mutual-authentication/jwt-verification.svg +++ /dev/null @@ -1,16 +0,0 @@ - - - - - - - End UserPomeriumUpstream ServiceIdentity ProviderInternal NetworkJWKS Endpoint \ No newline at end of file diff --git a/content/docs/concepts/img/mutual-authentication/pomerium-basic-hacker.svg b/content/docs/concepts/img/mutual-authentication/pomerium-basic-hacker.svg deleted file mode 100644 index b52f29753..000000000 --- a/content/docs/concepts/img/mutual-authentication/pomerium-basic-hacker.svg +++ /dev/null @@ -1,16 +0,0 @@ - - - - - - - End UserPomeriumUpstream ServiceHackerInternal Network \ No newline at end of file diff --git a/content/docs/concepts/img/mutual-authentication/pomerium-basic.svg b/content/docs/concepts/img/mutual-authentication/pomerium-basic.svg deleted file mode 100644 index 06e08d67c..000000000 --- a/content/docs/concepts/img/mutual-authentication/pomerium-basic.svg +++ /dev/null @@ -1,16 +0,0 @@ - - - - - - - End UserPomeriumUpstream ServiceIdentity ProviderInternal Network \ No newline at end of file diff --git a/content/docs/concepts/img/verge-apple.png b/content/docs/concepts/img/verge-apple.png deleted file mode 100644 index b014cf0b4..000000000 Binary files a/content/docs/concepts/img/verge-apple.png and /dev/null differ diff --git a/content/docs/core.mdx b/content/docs/core.mdx deleted file mode 100644 index 28fb22043..000000000 --- a/content/docs/core.mdx +++ /dev/null @@ -1,141 +0,0 @@ ---- -# cSpell:ignore nonroot gpgcheck sslverify gpgkey abnf - -title: Pomerium Core (server) -lang: en-US -id: core -sidebar_label: Pomerium Core -pagination_prev: null -pagination_next: null -description: How to get the open-source core component of Pomerium -keywords: [pomerium, server, proxy, context-aware proxy, open source] -sidebar_position: 1 ---- - -import Tabs from '@theme/Tabs'; -import TabItem from '@theme/TabItem'; - -# Pomerium Core (Server) - -Pomerium Core (sometimes referred to as _Pomerium Open Source_) is the primary server component. Pomerium Core is open source, and all other components build on top of it. - -- Supported Operating Systems: Linux and macOS -- Supported Architectures: `amd64`, `arm64` - -### Binaries - -Official binaries can be found on our [GitHub Releases](https://github.com/pomerium/pomerium/releases) page. - -- The Linux binaries require glibc 2.30 or later. -- The macOS binaries require macOS 12 (Monterey) or later. - -```shell -ARCH=[your arch] -OS=[your os] -VERSION=[desired version] -curl -L https://github.com/pomerium/pomerium/releases/download/${VERSION}/pomerium-${OS}-${ARCH}.tar.gz \ - | tar -z -x -``` - -### Linux Packages {#packages} - -- Supported formats: `rpm`, `deb` -- Requires `systemd` support - -Official packages can be found on our [GitHub Releases](https://github.com/pomerium/pomerium/releases) page or from [Cloudsmith](https://cloudsmith.io/~pomerium/repos/pomerium/packages/). - -- [RPM Instructions](https://cloudsmith.io/~pomerium/repos/pomerium/setup/#formats-rpm) -- [Deb Instructions](https://cloudsmith.io/~pomerium/repos/pomerium/setup/#formats-deb) - - - - - -```abnf title="/etc/yum.repos.d/pomerium-pomerium.repo" -[pomerium-pomerium] -name=pomerium-pomerium -baseurl=https://dl.cloudsmith.io/public/pomerium/pomerium/rpm/el/$releasever/$basearch -repo_gpgcheck=1 -enabled=1 -gpgkey=https://dl.cloudsmith.io/public/pomerium/pomerium/gpg.6E388440B94E1407.key -gpgcheck=1 -sslverify=1 -pkg_gpgcheck=1 -``` - - - - -```bash -curl -1sLf 'https://dl.cloudsmith.io/public/pomerium/pomerium/gpg.6E388440B94E1407.key' | apt-key add - -echo "deb https://dl.cloudsmith.io/public/pomerium/pomerium/deb/debian buster main" > /etc/apt/sources.list.d/pomerium-pomerium.list -``` - - - - -### Docker Image - -Pomerium also provides [Docker container images](https://www.docker.com/resources/what-container). You can find Pomerium's images on [Docker Hub](https://hub.docker.com/r/pomerium/pomerium). Pomerium can be pulled in several flavors and architectures. - -- `:vX.Y.Z` corresponds to a [specific tagged release](https://github.com/pomerium/pomerium/tags). - - ```shell-session - $ docker run pomerium/pomerium:v0.27.2 --version - pomerium version pomerium: 0.27.2+788017f1 - envoy: 1.31.0+d879aa604b9bdfcb2ed669098a7d062862dc5ea1e90e540338b2e532554bb0a6 - ``` - -- `:vX.Y` corresponds to the latest patch release for a specific minor version (starting with v0.25). - - ```shell-session - $ docker pull cr.pomerium.com/pomerium/pomerium:v0.27 - ``` - -- `:latest` corresponds to the [most recent tagged release](https://github.com/pomerium/pomerium/releases/latest). - - ```shell-session - $ docker pull cr.pomerium.com/pomerium/pomerium:latest - ``` - -- `:main` corresponds to the most recent development build from the [main](https://github.com/pomerium/pomerium/tree/main) git branch. - - ```shell-session - $ docker pull cr.pomerium.com/pomerium/pomerium:main - ``` - -Rootless images for official releases are also published to provide additional security. In these images, Pomerium runs as the `nonroot` user. Depending on your deployment environment, you may need to grant the container additional [capabilities](https://linux-audit.com/linux-capabilities-hardening-linux-binaries-by-removing-setuid/) or change the [listen address](/docs/reference/address) to use a port number other than 443. - -- `:nonroot-vX.Y.Z` is the rootless image for a specific release. -- `:nonroot` is the rootless equivalent to the `:latest` tag. - -All of the above images use a [minimal base image](https://github.com/GoogleContainerTools/distroless#readme), but "debug" images are also available. Debug images include a shell environment, to allow operators to perform debugging steps from inside the container. Prepend `debug-` to any other image tag to obtain the corresponding debug image. For example: - -- `:debug-vX.Y.Z` is the debug image for a specific release. -- `:debug-nonroot` is the debug image for the latest `:nonroot` image. -- `:debug` is the debug equivalent of the `:latest` tag. - -### Kubernetes - -:::warning - -As of v0.19.0, Pomerium no longer supports Helm for Kubernetes deployments. - -::: - -We recommend following the steps in the Kubernetes [Installation](/docs/k8s/install) guide to deploy Pomerium with Kubernetes, or see the Kubernetes [Quickstart](/docs/k8s/quickstart) for a proof of concept of how to configure and deploy Pomerium with Kubernetes. - -### Source - -:::note - -Officially supported build platforms are limited by [envoy proxy](https://www.envoyproxy.io/). - -::: - -```shell -git clone git@github.com:pomerium/pomerium.git -cd pomerium -make -./bin/pomerium --version -``` diff --git a/content/docs/core/_category_.json b/content/docs/core/_category_.json deleted file mode 100644 index faa8b6a80..000000000 --- a/content/docs/core/_category_.json +++ /dev/null @@ -1,3 +0,0 @@ -{ - "label": "Pomerium Core" -} diff --git a/content/docs/core/binary.mdx b/content/docs/core/binary.mdx deleted file mode 100644 index e606c3c4f..000000000 --- a/content/docs/core/binary.mdx +++ /dev/null @@ -1,85 +0,0 @@ ---- -title: Binaries -lang: en-US -keywords: - - pomerium - - identity access proxy - - identity aware proxy - - reverse proxy - - deployment - - pre-built binaries -pagination_prev: null -pagination_next: null -sidebar_label: Binaries ---- - -import ConfigMinimal from '@site/content/examples/config/config.minimal.yaml.md'; - -# Pre-built binaries - -This document covers how to configure and run Pomerium using the official prebuilt binaries. - -## Prerequisites - -- A configured [identity provider] -- [TLS certificates] - -## Download - -You can download the latest release from [GitHub][download], or use the repositories we provide through [Cloudsmith][cloudsmith-repo]. In addition to the easy updates provided by the package manager, the `deb` and `rpm` packages include systemd service unit configurations. - -### Operating System Packages - -Through [Cloudsmith][cloudsmith-repo], we provide OS packages for Linux distributions using `deb` and `rpm` style package managers. Select your system's package format and architecture, then use the **Setup** tab to add the repository to your package manager. - -### Standalone Binary - -[Download] the latest release of Pomerium for your machine's operating system and architecture. - -## Configure - -Pomerium supports setting [configuration variables] using both environmental variables and using a configuration file. - -When using our OS packages, we provide a default configuration at `/etc/pomerium/config.yaml`. Otherwise, create the config file (`config.yaml`) in your preferred location. - -This file will be used to determine Pomerium's configuration settings, routes, and access-policies. Consider the following example: - - - -You can also set some or all of your configuration keys as environment variables, in an `env` file for example. See the [Reference] page to identify the environment variable for each configuration option. - -## Run - -### OS Package - -1. The following command allows the Pomerium systemd service to bind to [privileged port] `443`: - - ```bash - echo -e "[Service]\nAmbientCapabilities=CAP_NET_BIND_SERVICE" | sudo SYSTEMD_EDITOR=tee systemctl edit pomerium - ``` - -1. Enable and start the service: - - ```bash - sudo systemctl enable --now pomerium.service - ``` - -### Manual Installation - -Source the configuration `env` file, if present, and run pomerium specifying the `config.yaml` . - -```bash -./bin/pomerium -config config.yaml -``` - -Browse to `external-verify.your.domain.example`. Connections between you and [verify] will now be proxied and managed by Pomerium. - -[configuration variables]: /docs/reference -[download]: https://github.com/pomerium/pomerium/releases -[verify]: https://verify.pomerium.com/ -[identity provider]: /docs/identity-providers -[tls certificates]: /docs/guides/certificates -[cloudsmith]: https://cloudsmith.io -[cloudsmith-repo]: https://cloudsmith.io/~pomerium/repos/pomerium/groups/ -[reference]: /docs/reference -[privileged port]: https://www.w3.org/Daemon/User/Installation/PrivilegedPorts.html diff --git a/content/docs/core/changelog.mdx b/content/docs/core/changelog.mdx deleted file mode 100644 index e60cb16f7..000000000 --- a/content/docs/core/changelog.mdx +++ /dev/null @@ -1,5868 +0,0 @@ ---- -title: Changelog -lang: en-US -sidebar_position: 2 -# cSpell:disable ---- - -import Versioning from '../admonitions/_semantic-versioning.mdx'; - -# Core Changelog - -Please refer to the [upgrade guide](/docs/core/upgrading) before upgrading. - -:::note - - - -::: - -## [v0.28.0](https://github.com/pomerium/pomerium/tree/v0.28.0) (2024-11-11) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.27.2...v0.28.0) - -### New - -- More flexible PPL string matchers. -- Add new jwt issuer format route option. -- Add an 'issuer' field to the /.well-known/pomerium endpoint. -- Add new request header variable 'pomerium.jwt'. - -### Changed - -- Better error serialization for requests from kubectl. -- Improved header evaluation performance in the authorize service. -- Improved RouteID calculation performance (used for generating configuration with large numbers of routes). - -### Bug Fixes - -- Fix enterprise detection in the dashboard. -- Fix response code redirect option. - -## [v0.27.2](https://github.com/pomerium/pomerium/tree/v0.27.2) (2024-10-22) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.27.1...v0.27.2) - -### Pomerium Zero - -- Add a Pomerium Core to Pomerium Zero import tool, allowing you to bring your existing Pomerium configuration into Pomerium Zero. -- Add active users reporting, for self-serve billing in Pomerium Zero. End user information is pseudonymized and reported to Pomerium Zero, in order to bill paid organizations according to the number of active users across the organization as a whole. - -### Fixed - -- Improve handling of transient errors from the databroker. -- Fix a data race in the in-memory databroker storage backend. -- Remove an incorrect “unknown config option” warning message when the `set_response_headers` config file key is present. - -### Changes - -- For any routes where the [Kubernetes Service Account Token](https://www.pomerium.com/docs/reference/routes/kubernetes-service-account-token) option is set, allow both websockets and SPDY connection upgrades. (One of these is necessary for commands like `kubectl exec` and `kubectl port-forward` to work correctly, depending on your version of Kubernetes.) -- Previously, the [Log Level](https://www.pomerium.com/docs/reference/log-level) option could affect the default value of the [Authorize Log Fields](https://www.pomerium.com/docs/reference/authorize-log-fields) option: setting the main log level to `debug` would change the default set of authorize log fields to include `headers` (logging all HTTP request headers). This undocumented behavior has been removed, and these two options are now entirely independent. -- Remove some currently-unused configuration options: - - `databroker_storage_cert_file` - - `databroker_storage_key_file` - - `databroker_storage_ca_file` - - `databroker_storage_tls_skip_verify` - - `grpc_client_dns_roundrobin` -- Various other minor code clean-up. - -## [v0.27.1](https://github.com/pomerium/pomerium/tree/v0.27.1) (2024-09-26) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.27.0...v0.27.1) - -Pomerium v0.27.1 includes a fix to the databroker service API authorization logic. Certain service account tokens from Pomerium Zero or Pomerium Enterprise could grant unintended authorization to the databroker service API. See the [CVE-2024-47616](https://github.com/pomerium/pomerium/security/advisories/GHSA-r7rh-jww5-5fjr) for more information. - -### Security - -- Additional validation checks for gRPC API authorization. This update resolves a security vulnerability that we believe affects only certain Pomerium Enterprise and Pomerium Zero deployments. - -### Fixed - -- The user info dashboard page (at URL path `/.pomerium/`) now provides user info also for the [programmatic access](https://www.pomerium.com/docs/capabilities/programmatic-access) flow (see issue [#5246](https://github.com/pomerium/pomerium/issues/5246)). -- The user info dashboard page now correctly displays group membership info for Pomerium Enterprise deployments with [directory sync](https://www.pomerium.com/docs/capabilities/directory-sync) configured. - -## [v0.27.0](https://github.com/pomerium/pomerium/tree/v0.27.0) (2024-09-10) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.26.1...v0.27.0) - -## What's Changed - -### Breaking - -- **proxy**: deprecate the /.pomerium/jwt endpoint by @kenjenkins in https://github.com/pomerium/pomerium/pull/5254 -- **zero/k8s**: use Deployment instead of StatefulSet by @wasaga in https://github.com/pomerium/pomerium/pull/5248 - -### New - -- **authorize**: use uuid for jti, current time for iat and exp by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5147 -- **config**: add `databroker_storage_connection_string_file` by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5242 -- **config**: add mTLS UserPrincipalName SAN match by @kenjenkins in https://github.com/pomerium/pomerium/pull/5177 -- **config**: add runtime flag to allow disabling config hot-reload (#5079) by @kralicky in https://github.com/pomerium/pomerium/pull/5112 -- **envoy**: allow TLS 1.3 for upstream connections by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5263 -- **envoy**: log TLS connection failures in the mTLS `reject_connection` mode by @kralicky in https://github.com/pomerium/pomerium/pull/5210 -- **envoy**: resource monitoring & overload manager configuration by @kralicky in https://github.com/pomerium/pomerium/pull/5106 -- **envoy**: support http2 prior knowledge for insecure upstream targets (h2c://) by @kralicky in https://github.com/pomerium/pomerium/pull/5205 -- **ui**: add "Policy ID" label to error details page by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5127 -- **ui**: add request id to upstream error page by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5166 -- **ui**: add user info link to error page by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5158 -- **ui**: user info dashboard improvements by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5128 -- **zero/connect**: add re-run health checks command by @wasaga in https://github.com/pomerium/pomerium/pull/5219 -- **zero/k8s**: write bootstrap configuration to a secret by @kralicky in https://github.com/pomerium/pomerium/pull/5114 - -### Fixes - -- **authorize**: require new login when authenticate url changes by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5165 -- **controlplane**: avoid calling Close on nil listener by @kenjenkins in https://github.com/pomerium/pomerium/pull/5156 -- **databroker/leaser**: set timeout on ReleaseLease by @wasaga in https://github.com/pomerium/pomerium/pull/5208 -- **logging**: add support for using the standard grpc env vars to control log severity and verbosity by @kralicky in https://github.com/pomerium/pomerium/pull/5120 -- **session**: do not invalidate based on ID token by @kenjenkins in https://github.com/pomerium/pomerium/pull/5182 -- **ui**: fix cycle in profile data by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5168 -- **ui**: set Cache-Control: no-cache, tweak sign-out cancel button behavior by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5264 -- **zero/connect**: ignore unknown message types by @wasaga in https://github.com/pomerium/pomerium/pull/5223 -- **zero/health-checks**: fix early checks sometimes missing by @wasaga in https://github.com/pomerium/pomerium/pull/5229 -- **zero/health-checks**: zero route availability improvements by @wasaga in https://github.com/pomerium/pomerium/pull/5111 - -### Changed - -- **authenticate**: rework session ID token handling by @kenjenkins in https://github.com/pomerium/pomerium/pull/5178 -- **authorize**: add request-id to error messages by @wasaga in https://github.com/pomerium/pomerium/pull/5267 -- **ci**: do not include timestamp into buildmeta by @wasaga in https://github.com/pomerium/pomerium/pull/5215 -- **config**: optimize policy iterators by @kralicky in https://github.com/pomerium/pomerium/pull/5184 -- **config**: sort runtime flags, name consistency by @kenjenkins in https://github.com/pomerium/pomerium/pull/5255 -- **envoy**: upgrade to v1.31.0 by @kenjenkins in https://github.com/pomerium/pomerium/pull/5183 -- **github**: update README.md by @cmo-pomerium in https://github.com/pomerium/pomerium/pull/5163 -- **github**: update README.md by @nikhil-pomerium in https://github.com/pomerium/pomerium/pull/5253 -- **go**: update to Go 1.23 by @kralicky in https://github.com/pomerium/pomerium/pull/5216 -- **logging**: change log.Error function by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5251 -- **logging**: convert warnings to info or error by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5235 -- **proto**: update protoc dependencies by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5218 -- **ui**: update logo by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5249 -- **zero**: refactor controller by @wasaga in https://github.com/pomerium/pomerium/pull/5134 -- **zero/api**: generate error methods for response types by @kralicky in https://github.com/pomerium/pomerium/pull/5252 -- **zero/api**: reset token and url cache if 401 is received by @wasaga in https://github.com/pomerium/pomerium/pull/5256 -- **zero/api**: switch to github.com/oapi-codegen/oapi-codegen by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5226 -- **zero/bundle-download**: update metadata by @wasaga in https://github.com/pomerium/pomerium/pull/5212 -- **zero/cmd**: make it more evident what caused shutdown by @wasaga in https://github.com/pomerium/pomerium/pull/5209 -- **zero/connect**: add telemetry request command by @wasaga in https://github.com/pomerium/pomerium/pull/5131 -- **zero/k8s**: set externalTrafficPolicy: Local by @wasaga in https://github.com/pomerium/pomerium/pull/5266 -- **zero/telemetry**: add hostname and version by @wasaga in https://github.com/pomerium/pomerium/pull/5146 -- **zero/telemetry**: add prometheus streaming converter to OTLP by @wasaga in https://github.com/pomerium/pomerium/pull/5132 -- **zero/telemetry**: collect limited core metrics by @wasaga in https://github.com/pomerium/pomerium/pull/5142 -- **zero/telemetry**: internal envoy stats scraper and metrics producer by @wasaga in https://github.com/pomerium/pomerium/pull/5136 -- **zero/telemetry**: refactor telemetry and controller by @wasaga in https://github.com/pomerium/pomerium/pull/5135 - -### Dependency Updates - -- bump busybox from `5eef5ed` to `9ae97d3` in /.github in the docker group by @dependabot in https://github.com/pomerium/pomerium/pull/5161 -- bump busybox from `9ae97d3` to `8274294` in /.github in the docker group by @dependabot in https://github.com/pomerium/pomerium/pull/5260 -- bump braces from 3.0.2 to 3.0.3 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/5139 -- bump the docker group in /.github with 3 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5124 -- bump the docker group in /.github with 2 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5202 -- bump the docker group with 3 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5123 -- bump the docker group with 2 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5159 -- bump the docker group with 3 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5201 -- bump the docker group with 2 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5258 -- bump the github-actions group with 9 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5121 -- bump the github-actions group with 4 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5160 -- bump the github-actions group with 9 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5200 -- bump the github-actions group with 6 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5259 -- bump the go group with 27 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5122 -- bump the go group with 21 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5162 -- bump the go group across 1 directory with 26 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5207 -- bump the go group across 1 directory with 28 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5262 -- bump github.com/docker/docker from 27.0.3+incompatible to 27.1.0+incompatible by @dependabot in https://github.com/pomerium/pomerium/pull/5193 -- bump github.com/opencontainers/runc from 1.1.12 to 1.1.14 by @dependabot in https://github.com/pomerium/pomerium/pull/5261 -- bump google.golang.org/grpc from 1.64.0 to 1.64.1 by @dependabot in https://github.com/pomerium/pomerium/pull/5169 -- bump micromatch from 4.0.5 to 4.0.8 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/5240 -- replace usages of x/exp/maps + bump golang.org/x/exp by @kralicky in https://github.com/pomerium/pomerium/pull/5221 - -## [v0.26.1](https://github.com/pomerium/pomerium/tree/v0.26.1) (2024-07-01) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.26.0...v0.26.1) - -Pomerium v0.26.1 includes multiple security updates: - -- The Pomerium user info page (at `/.pomerium`) unintentionally included serialized OAuth 2.0 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users, and have now been removed. For more details, please see the official [CVE statement](https://github.com/pomerium/pomerium/security/advisories/GHSA-rrqr-7w59-637v). - - Credit to Vadim Sheydaev, also known as Enr1g for reporting this issue. - -- This release includes an update from Envoy 1.30.1 to Envoy 1.30.3 to address the following security issues: - - - [CVE-2024-34362](https://github.com/envoyproxy/envoy/security/advisories/GHSA-hww5-43gv-35jv): Crash (use-after-free) in EnvoyQuicServerStream - - [CVE-2024-34363](https://github.com/envoyproxy/envoy/security/advisories/GHSA-g979-ph9j-5gg4): Crash due to uncaught nlohmann JSON exception - - [CVE-2024-34364](https://github.com/envoyproxy/envoy/security/advisories/GHSA-xcj3-h7vf-fw26): Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response, and other components - - [CVE-2024-32974](https://github.com/envoyproxy/envoy/security/advisories/GHSA-mgxp-7hhp-8299): Crash in EnvoyQuicServerStream::OnInitialHeadersComplete() - - [CVE-2024-32975](https://github.com/envoyproxy/envoy/security/advisories/GHSA-g9mq-6v96-cpqc): Crash in QuicheDataReader::PeekVarInt62Length() - - [CVE-2024-32976](https://github.com/envoyproxy/envoy/security/advisories/GHSA-7wp5-c2vq-4f8m): Endless loop while decompressing Brotli data with extra input - - [CVE-2024-23326](https://github.com/envoyproxy/envoy/security/advisories/GHSA-vcf8-7238-v74c): Envoy incorrectly accepts HTTP 200 response for entering upgrade mode - - [CVE-2024-38525](https://github.com/envoyproxy/envoy/security/advisories/GHSA-8mq4-c2v5-3h39): datadog tracer does not handle trace headers with unicode characters - -- The release also removes a transitive dependency on the gopkg.in/square/go-jose.v2 library which is vulnerable to https://github.com/advisories/GHSA-c5q2-7r4c-mv6g. - -### Security - -- envoy: upgrade to v1.30.3 by @kenjenkins in https://github.com/pomerium/pomerium/pull/5155 -- userinfo: remove excess userinfo data by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5148 -- update the pomerium/webauthn dependency (#5125) by @kenjenkins in https://github.com/pomerium/pomerium/pull/5157 - -### Fixed - -- autocert: fix filter chain, handshake by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5151 - -## [v0.26.0](https://github.com/pomerium/pomerium/tree/v0.26.0) (2024-05-17) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.25.2...v0.26.0) - -### Breaking - -Changes that are expected to cause an incompatibility. - -- **config**: remove deprecated client_ca option by @kenjenkins in https://github.com/pomerium/pomerium/pull/4918 -- **envoy**: set explicit hostname on cluster endpoints by @kenjenkins in https://github.com/pomerium/pomerium/pull/5018 - -### New - -- **authenticate**: apply branding to sign out pages by @kenjenkins in https://github.com/pomerium/pomerium/pull/5044 -- **authorize**: add support for rego print statements by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5049 -- **authorize**: log service account user ID by @kenjenkins in https://github.com/pomerium/pomerium/pull/4964 -- **authorize**: return non-html errors on denied by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4904 -- **config**: add runtime flags by @wasaga in https://github.com/pomerium/pomerium/pull/5050 -- **config**: add support for TCP proxy chaining by @kenjenkins in https://github.com/pomerium/pomerium/pull/5053 -- **config**: add support for stripping the port for matching routes by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5085 -- **config**: disable gRPC ingress when address is the empty string by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5058 -- **config**: implement direct response by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4960 -- **databroker**: disable identity manager user refresh when hosted authenticate is used by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4905 -- **envoy**: clean up temporary directory on start by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4914 -- **envoy**: format envoy local replies by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5067 -- **envoy**: only enable port reuse on linux by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5066 -- **identity**: add enabler by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5084 -- **identity**: dynamic authenticator registration by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5105 -- **identity**: refactor identity manager by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5091 -- **logging**: less verbose logs by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5040 -- **ppl**: add client cert SAN match criteria by @kenjenkins in https://github.com/pomerium/pomerium/pull/4913 -- **ppl**: add groups criterion by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4916 -- **ui**: fix page title by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4957 -- **zero**: add route reachability health check by @wasaga in https://github.com/pomerium/pomerium/pull/5093 -- **zero**: add service accounts support by @wasaga in https://github.com/pomerium/pomerium/pull/5031 -- **zero**: add storage health check by @wasaga in https://github.com/pomerium/pomerium/pull/5074 -- **zero**: health check building config from databroker source by @wasaga in https://github.com/pomerium/pomerium/pull/5104 -- **zero**: lower log level by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5065 -- **zero**: upgrade oapi-codegen by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4953 - -### Fixed - -- **authenticate**: redirect to /.pomerium/signed_out when no signout redirect url is defined by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5060 -- **envoy**: exclude unauthorized access from local replies by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5108 -- **kubernetes**: fix impersonate group header by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5090 -- **zero**: add gRPC keep-alive by @wasaga in https://github.com/pomerium/pomerium/pull/4961 -- **zero**: fix bootstrap config path by @wasaga in https://github.com/pomerium/pomerium/pull/5035 -- **zero**: fix ticker usage by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4969 - -### Changed - -- **authenticate**: rework CORS headers log entry by @kenjenkins in https://github.com/pomerium/pomerium/pull/4900 -- **authorize**: result denied improvements by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4952 -- **config**: remove cookie secure option by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4907 -- **config**: fix typo by @wasaga in https://github.com/pomerium/pomerium/pull/4963 -- **core**: move telemetry requestid to pkg directory by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4911 -- **core**: switch to uber mock by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5073 -- **core**: use context.WithoutCancel by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4959 -- **envoy**: address strconv.Atoi warnings by @kenjenkins in https://github.com/pomerium/pomerium/pull/5076 -- **envoy**: enable TCP keepalive for internal clusters by @kenjenkins in https://github.com/pomerium/pomerium/pull/4902 -- **envoy**: migrate deprecated overload setting by @kenjenkins in https://github.com/pomerium/pomerium/pull/5082 -- **envoy**: preserve Go's max file limit for Envoy by @kenjenkins in https://github.com/pomerium/pomerium/pull/5102 -- **envoy**: upgrade to v1.30.1 by @kenjenkins in https://github.com/pomerium/pomerium/pull/5080 -- **logging**: use standard logger by @wasaga in https://github.com/pomerium/pomerium/pull/5096 -- **opa**: update for rego 1.0 by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4895 -- **ui**: adds upstream error page by @nhayfield in https://github.com/pomerium/pomerium/pull/5113 -- **ui**: improve frontend build size by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5109 -- **zero**: add user-agent to requests by @wasaga in https://github.com/pomerium/pomerium/pull/5078 -- **zero**: add checks for ability to save bootstrap parameter and bundle status reporting by @wasaga in https://github.com/pomerium/pomerium/pull/5064 -- **zero**: add connect health check by @wasaga in https://github.com/pomerium/pomerium/pull/5086 -- **zero**: add common healthcheck package, zero reporter and first xds check by @wasaga in https://github.com/pomerium/pomerium/pull/5059 -- **zero**: add shared secret to the cluster bootstrap params by @wasaga in https://github.com/pomerium/pomerium/pull/5030 -- **zero**: only report healthcheck transitions by @wasaga in https://github.com/pomerium/pomerium/pull/5068 -- **zero**: remove unused changeset code by @wasaga in https://github.com/pomerium/pomerium/pull/4915 -- **zero**: reset back to inmem databroker if connection string is empty by @wasaga in https://github.com/pomerium/pomerium/pull/4955 -- **zero**: simplify control loop lease retry code by @wasaga in https://github.com/pomerium/pomerium/pull/4979 -- **zero**: update oapi-codegen by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4898 - -### Dependency Updates - -- chore(deps): bump actions/setup-node from 4.0.1 to 4.0.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4974 -- chore(deps): bump actions/upload-artifact from 4.0.0 to 4.3.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4922 -- chore(deps): bump actions/upload-artifact from 4.3.0 to 4.3.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4972 -- chore(deps): bump busybox from `ba76950` to `6d9ac92` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4950 -- chore(deps): bump cloud.google.com/go/storage from 1.36.0 to 1.37.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4926 -- chore(deps): bump cloud.google.com/go/storage from 1.37.0 to 1.39.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4989 -- chore(deps): bump distroless/base-debian12 from `0a93daa` to `5eae9ef` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4970 -- chore(deps): bump distroless/base-debian12 from `996c583` to `1d91d5f` by @dependabot in https://github.com/pomerium/pomerium/pull/4980 -- chore(deps): bump distroless/base from `6c1e34e` to `9d4e568` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4971 -- chore(deps): bump docker/metadata-action from 5.4.0 to 5.5.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4923 -- chore(deps): bump docker/setup-buildx-action from 3.0.0 to 3.1.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4978 -- chore(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.26.2 to 1.26.6 by @dependabot in https://github.com/pomerium/pomerium/pull/4932 -- chore(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.26.6 to 1.27.6 by @dependabot in https://github.com/pomerium/pomerium/pull/5015 -- chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.24.0 to 1.24.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4930 -- chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.24.1 to 1.25.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4992 -- chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.48.1 to 1.51.3 by @dependabot in https://github.com/pomerium/pomerium/pull/5016 -- chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.47.7 to 1.48.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4939 -- chore(deps): bump github.com/docker/docker from 24.0.7+incompatible to 25.0.2+incompatible by @dependabot in https://github.com/pomerium/pomerium/pull/4942 -- chore(deps): bump github.com/docker/docker from 25.0.4+incompatible to 25.0.5+incompatible by @dependabot in https://github.com/pomerium/pomerium/pull/5032 -- chore(deps): bump github.com/docker/docker from 26.0.0+incompatible to 26.0.2+incompatible by @dependabot in https://github.com/pomerium/pomerium/pull/5075 -- chore(deps): bump github.com/envoyproxy/go-control-plane from 0.11.1 to 0.12.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4935 -- chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 1.0.2 to 1.0.4 by @dependabot in https://github.com/pomerium/pomerium/pull/4945 -- chore(deps): bump github.com/google/uuid from 1.5.0 to 1.6.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4933 -- chore(deps): bump github.com/go-chi/chi/v5 from 5.0.11 to 5.0.12 by @dependabot in https://github.com/pomerium/pomerium/pull/4986 -- chore(deps): bump github.com/go-jose/go-jose/v3 from 3.0.1 to 3.0.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4984 -- chore(deps): bump github.com/jackc/pgx/v5 from 5.5.1 to 5.5.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4944 -- chore(deps): bump github.com/jackc/pgx/v5 from 5.5.2 to 5.5.3 by @dependabot in https://github.com/pomerium/pomerium/pull/5000 -- chore(deps): bump github.com/klauspost/compress from 1.17.4 to 1.17.5 by @dependabot in https://github.com/pomerium/pomerium/pull/4940 -- chore(deps): bump github.com/klauspost/compress from 1.17.5 to 1.17.7 by @dependabot in https://github.com/pomerium/pomerium/pull/4995 -- chore(deps): bump github.com/minio/minio-go/v7 from 7.0.66 to 7.0.67 by @dependabot in https://github.com/pomerium/pomerium/pull/4996 -- chore(deps): bump github.com/opencontainers/runc from 1.1.5 to 1.1.12 by @dependabot in https://github.com/pomerium/pomerium/pull/4919 -- chore(deps): bump github.com/open-policy-agent/opa from 0.60.0 to 0.61.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4937 -- chore(deps): bump github.com/open-policy-agent/opa from 0.61.0 to 0.62.1 by @dependabot in https://github.com/pomerium/pomerium/pull/5017 -- chore(deps): bump github.com/prometheus/common from 0.45.0 to 0.46.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4949 -- chore(deps): bump github.com/prometheus/common from 0.46.0 to 0.49.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4998 -- chore(deps): bump github.com/prometheus/client_golang from 1.18.0 to 1.19.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4999 -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.23.12 to 3.24.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4928 -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.24.1 to 3.24.2 by @dependabot in https://github.com/pomerium/pomerium/pull/5001 -- chore(deps): bump github.com/stretchr/testify from 1.8.4 to 1.9.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4990 -- chore(deps): bump github.com/rs/zerolog from 1.31.0 to 1.32.0 by @dependabot in https://github.com/pomerium/pomerium/pull/5004 -- chore(deps): bump golang from 1.21.5-bookworm to 1.21.6-bookworm by @dependabot in https://github.com/pomerium/pomerium/pull/4920 -- chore(deps): bump golang.org/x/crypto from 0.18.0 to 0.21.0 by @dependabot in https://github.com/pomerium/pomerium/pull/5013 -- chore(deps): bump golang.org/x/net from 0.22.0 to 0.23.0 by @dependabot in https://github.com/pomerium/pomerium/pull/5077 -- chore(deps): bump golang.org/x/oauth2 from 0.16.0 to 0.18.0 by @dependabot in https://github.com/pomerium/pomerium/pull/5012 -- chore(deps): bump google-github-actions/setup-gcloud from 2.0.1 to 2.1.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4924 -- chore(deps): bump google-github-actions/auth from 2.0.0 to 2.1.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4925 -- chore(deps): bump google-github-actions/auth from 2.1.0 to 2.1.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4976 -- chore(deps): bump google.golang.org/api from 0.154.0 to 0.161.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4938 -- chore(deps): bump google.golang.org/api from 0.161.0 to 0.168.0 by @dependabot in https://github.com/pomerium/pomerium/pull/5010 -- chore(deps): bump google.golang.org/grpc from 1.60.1 to 1.61.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4948 -- chore(deps): bump google.golang.org/grpc from 1.61.0 to 1.62.1 by @dependabot in https://github.com/pomerium/pomerium/pull/5011 -- chore(deps): bump google.golang.org/protobuf from 1.32.0 to 1.33.0 by @kenjenkins in https://github.com/pomerium/pomerium/pull/5009 -- chore(deps): bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4975 -- chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 0.44.0 to 0.45.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4947 -- chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 0.45.0 to 1.24.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4983 -- chore(deps): bump go.opentelemetry.io/otel/sdk/metric from 1.21.0 to 1.22.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4946 -- chore(deps): bump go.opentelemetry.io/otel/sdk/metric from 1.22.0 to 1.24.0 by @dependabot in https://github.com/pomerium/pomerium/pull/5003 -- chore(deps): bump go.uber.org/zap from 1.26.0 to 1.27.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4987 -- chore(deps): bump mikefarah/yq from 4.40.5 to 4.42.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4977 -- chore(deps): bump node from `8d0f16f` to `fd01154` by @dependabot in https://github.com/pomerium/pomerium/pull/4921 -- chore(deps): bump node from `fd01154` to `f3299f1` by @dependabot in https://github.com/pomerium/pomerium/pull/4981 -- chore(deps): bump pre-commit/action from 3.0.0 to 3.0.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4973 -- chore(deps): bump the docker group with 2 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5024 -- chore(deps): bump the docker group in /.github with 2 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5023 -- chore(deps): bump the docker group with 3 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5045 -- chore(deps): bump the docker group in /.github with 3 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5046 -- chore(deps): bump the docker group in /.github with 3 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5095 -- chore(deps): bump the docker group with 3 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5098 -- chore(deps): bump the github-actions group with 1 update by @dependabot in https://github.com/pomerium/pomerium/pull/5025 -- chore(deps): bump the github-actions group with 6 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5047 -- chore(deps): bump the github-actions group with 5 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5094 -- chore(deps): bump the go group with 10 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5026 -- chore(deps): bump the go group with 15 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5048 -- chore(deps): bump the go group with 29 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5097 -- chore(deps): update UI dependencies by @kenjenkins in https://github.com/pomerium/pomerium/pull/5088 -- chore(deps): bump @trivago/prettier-plugin-sort-imports from 2.0.4 to 4.3.0 by @kenjenkins in https://github.com/pomerium/pomerium/pull/5054 -- chore(deps): bump @babel/traverse from 7.16.10 to 7.23.2 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/5055 -- ci: upgrade to Go 1.22 by @wasaga in https://github.com/pomerium/pomerium/pull/4967 -- core/lint: upgrade golangci-lint, replace interface{} with any by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5099 -- envoy: set to v1.29.2 by @wasaga in https://github.com/pomerium/pomerium/pull/5042 -- envoy: upgrade to v1.29.3 by @wasaga in https://github.com/pomerium/pomerium/pull/5056 -- update dev Dockerfiles to use Go 1.22.2 by @kenjenkins in https://github.com/pomerium/pomerium/pull/5063 - -## [v0.25.2](https://github.com/pomerium/pomerium/tree/v0.25.2) (2024-04-05) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.25.1...v0.25.2) - -### Changed - -- **envoy**: upgrade to v1.28.2 by @wasaga in https://github.com/pomerium/pomerium/pull/5057 - -## [v0.25.1](https://github.com/pomerium/pomerium/tree/v0.25.1) (2024-03-13) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.25.0...v0.25.1) - -### Changed - -- **ci**: bump Go to 1.21.8 in docker by @wasaga in https://github.com/pomerium/pomerium/pull/5027 -- **connect**: add gRPC keep-alive by @wasaga in https://github.com/pomerium/pomerium/pull/4962 -- **core/ci**: check docker base images by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5028 -- **core/zero**: fix ticker usage by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5019 - -## [v0.25.0](https://github.com/pomerium/pomerium/tree/v0.25.0) (2024-01-10) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.24.0...v0.25.0) - -### Breaking - -- **config**: remove support for base64 encoded certificates in the [`certificates`](https://www.pomerium.com/docs/reference/certificates#certificates) field. It may only contain file locations. See https://github.com/pomerium/pomerium/pull/4718 by @calebdoxsey for details. -- **config**: remove [`debug`](https://www.pomerium.com/docs/reference/debug#summary) option, always use json logs by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4857 - -### New - -- **authenticate**: Refactoring identity authenticators to initiate redirect. For AWS Cognito, please allow the following sign out `https://{AUTHENTICATE_DOMAIN}/.pomerium/signed_out` URL. See more details in https://github.com/pomerium/pomerium/pull/4858 by @calebdoxsey. -- Initial support for the [Pomerium Zero](https://www.pomerium.com/pomerium-zero/) closed beta is included in this release. - -### Fixed - -- **config**: add support for maps in environments, i.e. `env IDP_REQUEST_PARAMS='{"x":"y"}' ...` by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4717 -- **core**: fix graceful stop by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4865 -- **databroker**: fix nil data unmarshal by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4734 -- **databroker**: fix Patch() error handling for in-memory databroker backend by @kenjenkins in https://github.com/pomerium/pomerium/pull/4838 -- **databroker**: hijack connections for notification listeners by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4806 -- **databroker**: prevent `nil` data in the databroker deleted records by @wasaga in https://github.com/pomerium/pomerium/pull/4736 -- **databroker**: REDIS backend has been removed in the previous release, https://github.com/pomerium/pomerium/pull/4768 by @calebdoxsey cleans up some remaining references. -- **envoy**: Rewrite the remove_pomerium_cookie lua function to handle `=` inside of cookie values. by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4641 -- **metrics**: enforce `text/plain` metric format by @kenjenkins in https://github.com/pomerium/pomerium/pull/4774 -- **zero**: group funcs that need run within a lease by @wasaga in https://github.com/pomerium/pomerium/pull/4862 - -### Changed - -- **authenticate**: add stateful flow by @kenjenkins in https://github.com/pomerium/pomerium/pull/4822 -- **authenticate**: change how sessions are deleted by @kenjenkins in https://github.com/pomerium/pomerium/pull/4893 -- **authenticate**: getUserInfoData() cleanup by @kenjenkins in https://github.com/pomerium/pomerium/pull/4818 -- **authenticate**: move events.go out of internal/authenticateflow by @kenjenkins in https://github.com/pomerium/pomerium/pull/4852 -- **authenticate**: move stateless flow logic by @kenjenkins in https://github.com/pomerium/pomerium/pull/4820 -- **authenticate**: move logAuthenticateEvent by @kenjenkins in https://github.com/pomerium/pomerium/pull/4821 -- **authenticate**: remove extra UpdateUserInfo() call by @kenjenkins in https://github.com/pomerium/pomerium/pull/4813 -- **authenticate**: Update the initialization logic for the authenticate, authorize, and proxy services to automatically select between the stateful authentication flow and the stateless authentication flow, depending on whether Pomerium is configured to use the hosted authenticate service. This change ensures a single IdP session is maintained for all user visits, enabling a single sign out behaviour for installations with IdP configured. @kenjenkins in https://github.com/pomerium/pomerium/pull/4765 -- **authenticate**: verify redirect in Callback test by @kenjenkins in https://github.com/pomerium/pomerium/pull/4894 -- **config**: Add a global config option for pass_identity_headers, in addition to existing per-route option by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4720 -- **config**: disable strict-transport-security header with staging autocert by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4741 -- **config**: no longer stub out HPKE public key fetch by @kenjenkins in https://github.com/pomerium/pomerium/pull/4853 -- **config**: remove unnecessary authenticate route when using hosted authenticate (authenticate.pomerium.app) by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4719 -- **runtime**: automatically determine goroutine max cap by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4766 -- **runtime**: update to Go 1.21.4 by @kenjenkins in https://github.com/pomerium/pomerium/pull/4770 -- **session**: add unit tests for gRPC wrapper methods by @kenjenkins in https://github.com/pomerium/pomerium/pull/4713 -- **tests**: add tool for renewing test certs by @kenjenkins in https://github.com/pomerium/pomerium/pull/4742 -- **tests**: check for profile cookies by @kenjenkins in https://github.com/pomerium/pomerium/pull/4847 -- **tests**: renew test certs by @kenjenkins in https://github.com/pomerium/pomerium/pull/4738 -- **tests**: re-generate test configurations by @kenjenkins in https://github.com/pomerium/pomerium/pull/4816 -- **zero**: add linear probabilistic counter for MAU estimation by @wasaga in https://github.com/pomerium/pomerium/pull/4776 -- **zero**: add more verbose logging about background control loops by @wasaga in https://github.com/pomerium/pomerium/pull/4815 -- **zero**: add reporter by @wasaga in https://github.com/pomerium/pomerium/pull/4855 -- **zero**: add support for managed mode from config file by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4756 -- **zero**: better code reuse by @wasaga in https://github.com/pomerium/pomerium/pull/4758 -- **zero**: calculate DAU and MAU by @wasaga in https://github.com/pomerium/pomerium/pull/4810 -- **zero**: fix restart behavior by @kenjenkins in https://github.com/pomerium/pomerium/pull/4753 -- **zero**: rebase and merge feature/zero branch by @kenjenkins in https://github.com/pomerium/pomerium/pull/4745 -- **zero**: set drwx------ for cache dir by @wasaga in https://github.com/pomerium/pomerium/pull/4764 -- **zero**: support gzipped blobs by @wasaga in https://github.com/pomerium/pomerium/pull/4767 -- **zero**: use os.UserCacheDir for boostrap config path by @kenjenkins in https://github.com/pomerium/pomerium/pull/4744 -- **zero**: use production urls by default by @wasaga in https://github.com/pomerium/pomerium/pull/4814 - -### Dependency - -- bump actions/checkout from 4.1.0 to 4.1.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4692 -- bump actions/setup-go from 4.1.0 to 5.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4830 -- bump actions/setup-node from 3.8.1 to 4.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4694 -- bump actions/setup-node from 4.0.0 to 4.0.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4888 -- bump actions/setup-python from 4.7.0 to 5.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4827 -- bump actions/stale from 8.0.0 to 9.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4825 -- bump actions/upload-artifact from 3.1.3 to 4.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4889 -- bump busybox from `3fbc632` to `1ceb872` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4824 -- bump busybox from `1ceb872` to `ba76950` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4884 -- bump cloud.google.com/go/storage from 1.33.0 to 1.35.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4750 -- bump cloud.google.com/go/storage from 1.35.1 to 1.36.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4873 -- bump distroless/base from `46c5b9b` to `b31a6e0` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4670 -- bump distroless/base from `b31a6e0` to `6c1e34e` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4885 -- bump distroless/base-debian12 from `5e24c7a` to `996c583` by @dependabot in https://github.com/pomerium/pomerium/pull/4882 -- bump distroless/base-debian12 from `d2890b2` to `5e24c7a` by @dependabot in https://github.com/pomerium/pomerium/pull/4658 -- bump distroless/base-debian12 from `d64f548` to `1dfdb5e` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4671 -- bump distroless/base-debian12 from `1dfdb5e` to `0a93daa` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4886 -- bump docker/build-push-action from 5.0.0 to 5.1.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4777 -- bump docker/metadata-action from 5.0.0 to 5.3.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4826 -- bump docker/metadata-action from 5.3.0 to 5.4.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4891 -- bump github.com/aws/aws-sdk-go-v2 from 1.22.2 to 1.24.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4840 -- bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.40.0 to 1.42.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4751 -- bump github.com/bits-and-blooms/bitset from 1.11.0 to 1.13.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4876 -- bump github.com/caddyserver/certmagic from 0.19.2 to 0.20.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4836 -- bump github.com/cloudflare/circl from 1.3.3 to 1.3.6 by @dependabot in https://github.com/pomerium/pomerium/pull/4674 -- bump github.com/coreos/go-oidc/v3 from 3.6.0 to 3.8.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4791 -- bump github.com/coreos/go-oidc/v3 from 3.8.0 to 3.9.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4880 -- bump github.com/fsnotify/fsnotify from 1.6.0 to 1.7.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4680 -- bump github.com/google/go-cmp from 0.5.9 to 0.6.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4685 -- bump github.com/google/uuid from 1.3.1 to 1.4.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4677 -- bump github.com/google/uuid from 1.4.0 to 1.5.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4878 -- bump github.com/gorilla/mux from 1.8.0 to 1.8.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4790 -- bump github.com/gorilla/websocket from 1.5.0 to 1.5.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4793 -- bump github.com/go-chi/chi/v5 from 5.0.10 to 5.0.11 by @dependabot in https://github.com/pomerium/pomerium/pull/4875 -- bump github.com/go-jose/go-jose/v3 from 3.0.0 to 3.0.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4760 -- bump github.com/jackc/pgx/v5 from 5.4.3 to 5.5.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4803 -- bump github.com/jackc/pgx/v5 from 5.5.0 to 5.5.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4871 -- bump github.com/klauspost/compress from 1.17.0 to 1.17.4 by @dependabot in https://github.com/pomerium/pomerium/pull/4798 -- bump github.com/mattn/go-isatty from 0.0.19 to 0.0.20 by @dependabot in https://github.com/pomerium/pomerium/pull/4801 -- bump github.com/minio/minio-go/v7 from 7.0.63 to 7.0.65 by @dependabot in https://github.com/pomerium/pomerium/pull/4812 -- bump github.com/minio/minio-go/v7 from 7.0.65 to 7.0.66 by @dependabot in https://github.com/pomerium/pomerium/pull/4868 -- bump github.com/oapi-codegen/runtime from 1.0.0 to 1.1.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4870 -- bump github.com/open-policy-agent/opa from 0.57.0 to 0.59.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4799 -- bump github.com/open-policy-agent/opa from 0.59.0 to 0.60.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4879 -- bump github.com/prometheus/client_golang from 1.17.0 to 1.18.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4872 -- bump github.com/prometheus/client_model from 0.4.1-0.20230718164431-9a2bf3000d16 to 0.5.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4672 -- bump github.com/prometheus/common from 0.44.0 to 0.45.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4686 -- bump github.com/shirou/gopsutil/v3 from 3.23.9 to 3.23.11 by @dependabot in https://github.com/pomerium/pomerium/pull/4794 -- bump github.com/shirou/gopsutil/v3 from 3.23.11 to 3.23.12 by @dependabot in https://github.com/pomerium/pomerium/pull/4874 -- bump github.com/spf13/viper from 1.16.0 to 1.18.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4861 -- bump github.com/VictoriaMetrics/fastcache from 1.12.1 to 1.12.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4802 -- bump github.com/yuin/gopher-lua from 1.1.0 to 1.1.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4832 -- bump golang from 1.21.4-bookworm to 1.21.5-bookworm by @dependabot in https://github.com/pomerium/pomerium/pull/4828 -- bump golang from `a6b787c` to `1415bb0` by @dependabot in https://github.com/pomerium/pomerium/pull/4883 -- bump golang.org/x/crypto from 0.16.0 to 0.17.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4860. This includes a patch for [GO-2023-2402](https://pkg.go.dev/vuln/GO-2023-2402) / [CVE-2023-48795](https://github.com/advisories/GHSA-45x7-px36-x8w8) (Terrapin). Note that Pomerium does not use the affected [golang.org/x/crypto/ssh](https://pkg.go.dev/golang.org/x/crypto/ssh) package from this module. -- bump golang.org/x/net from 0.17.0 to 0.19.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4792 -- bump golang.org/x/oauth2 from 0.12.0 to 0.15.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4797 -- bump golang.org/x/sync from 0.3.0 to 0.5.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4748 -- bump golang.org/x/time from 0.3.0 to 0.5.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4796 -- bump google-github-actions/auth from 1.1.1 to 2.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4778 -- bump google-github-actions/setup-gcloud from 1.1.1 to 2.0.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4890 -- bump google.golang.org/api from 0.143.0 to 0.153.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4835 -- bump google.golang.org/api from 0.153.0 to 0.154.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4867 -- bump google.golang.org/protobuf from 1.31.1-0.20231027082548-f4a6c1f6e5c1 to 1.32.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4877 -- bump mikefarah/yq from 4.35.2 to 4.40.3 by @dependabot in https://github.com/pomerium/pomerium/pull/4780 -- bump mikefarah/yq from 4.40.3 to 4.40.4 by @dependabot in https://github.com/pomerium/pomerium/pull/4829 -- bump mikefarah/yq from 4.40.4 to 4.40.5 by @dependabot in https://github.com/pomerium/pomerium/pull/4887 -- bump node from `42a4d97` to `5f21943` by @dependabot in https://github.com/pomerium/pomerium/pull/4659 -- bump node from `445acd9` to `8d0f16f` by @dependabot in https://github.com/pomerium/pomerium/pull/4881 -- bump sigs.k8s.io/yaml from 1.3.0 to 1.4.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4688 -- bump stefanzweifel/git-auto-commit-action from 4.16.0 to 5.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4693 -- zero/openapi: pin v1.0.0 of a runtime by @wasaga in https://github.com/pomerium/pomerium/pull/4851 - -## [v0.24.0](https://github.com/pomerium/pomerium/tree/v0.24.0) (2023-11-16) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.23.0...v0.24.0) - -### Breaking - -- config: remove set_authorization_header option by @kenjenkins in https://github.com/pomerium/pomerium/pull/4489 -- core/config: remove support for base64 encoded certificates by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4725 -- databroker: remove redis storage backend by @kenjenkins in https://github.com/pomerium/pomerium/pull/4699 - -### New - -- databroker: build config concurrently, option to bypass validation by @wasaga in https://github.com/pomerium/pomerium/pull/4655 - -### Fixed - -- core/authenticate: refactor idp sign out by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4582 -- core/authenticate: validate the identity profile by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4545 -- core/authorize: check for expired tokens by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4543 -- core/identity: fix slow restart by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4542 -- core/storage: fix nil data unmarshal by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4739 - -### Changed - -- Add metric request error in log by @sylr in https://github.com/pomerium/pomerium/pull/4585 -- authorize: build evaluators cache in parallel by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4731 -- authorize: reuse policy evaluators where possible by @kenjenkins in https://github.com/pomerium/pomerium/pull/4710 -- config: do not add route headers to global map by @kenjenkins in https://github.com/pomerium/pomerium/pull/4629 -- core/config: add config version, additional telemetry by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4645 -- core/config: add support for maps in environments by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4728 -- core/config: refactor change dispatcher by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4657 -- core/config: refactor file watcher by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4702 -- core/config: remove version by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4653 -- core/controlplane: apply configuration changes in a background thread by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4649 -- core/envoy: fix remove cookie lua script by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4732 -- core/events: refactor the events.Target to use mutexes instead of a background goroutine by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4700 -- core/filemgr: use xxhash instead of sha512 for filenames by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4697 -- core/hpke: reduce memory usage from zstd by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4650 -- cryptutil: remove unused functions by @kenjenkins in https://github.com/pomerium/pomerium/pull/4541 -- databroker: add patch method by @kenjenkins in https://github.com/pomerium/pomerium/pull/4704 -- databroker: add reconciler by @wasaga in https://github.com/pomerium/pomerium/pull/4709 -- databroker: add utility recordset and changeset by @wasaga in https://github.com/pomerium/pomerium/pull/4701 -- databroker: changeset: prevent nil data in the deleted records by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4737 -- Docs: remove tcp example by @ZPain8464 in https://github.com/pomerium/pomerium/pull/4616 -- identity: override TokenSource expiry behavior by @kenjenkins in https://github.com/pomerium/pomerium/pull/4632 -- identity: preserve session refresh schedule by @kenjenkins in https://github.com/pomerium/pomerium/pull/4633 -- identity: rework session refresh error handling by @kenjenkins in https://github.com/pomerium/pomerium/pull/4638 -- integration: renew test certs by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4740 -- proto: add id to certificate by @wasaga in https://github.com/pomerium/pomerium/pull/4706 -- protoutil: add OverwriteMasked method by @kenjenkins in https://github.com/pomerium/pomerium/pull/4651 -- reconciler: allow custom comparison function by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4727 -- rework session updates to use new patch method by @kenjenkins in https://github.com/pomerium/pomerium/pull/4705 -- storage/inmemory: implement patch operation by @kenjenkins in https://github.com/pomerium/pomerium/pull/4654 -- storage/postgres: implement patch operation by @kenjenkins in https://github.com/pomerium/pomerium/pull/4656 -- upgrade envoy to v1.28.0 by @kenjenkins in https://github.com/pomerium/pomerium/pull/4635 -- xds: add type url to log by @wasaga in https://github.com/pomerium/pomerium/pull/4696 - -### Dependency - -- chore(deps): bump actions/checkout from 3.5.3 to 3.6.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4496 -- chore(deps): bump actions/checkout from 3.6.0 to 4.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4562 -- chore(deps): bump actions/checkout from 4.0.0 to 4.1.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4611 -- chore(deps): bump actions/setup-go from 4.0.1 to 4.1.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4497 -- chore(deps): bump actions/setup-node from 3.7.0 to 3.8.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4501 -- chore(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 by @dependabot in https://github.com/pomerium/pomerium/pull/4557 -- chore(deps): bump busybox from `caa382c` to `3fbc632` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4549 -- chore(deps): bump cloud.google.com/go/storage from 1.31.0 to 1.32.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4518 -- chore(deps): bump cloud.google.com/go/storage from 1.32.0 to 1.33.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4579 -- chore(deps): bump coverallsapp/github-action from 2.2.1 to 2.2.3 by @dependabot in https://github.com/pomerium/pomerium/pull/4560 -- chore(deps): bump distroless/base from `b0216a3` to `46c5b9b` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4550 -- chore(deps): bump docker/build-push-action from 4.1.1 to 5.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4554 -- chore(deps): bump docker/login-action from 2.2.0 to 3.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4552 -- chore(deps): bump docker/metadata-action from 4.6.0 to 5.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4553 -- chore(deps): bump docker/setup-buildx-action from 2.9.1 to 2.10.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4498 -- chore(deps): bump docker/setup-buildx-action from 2.10.0 to 3.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4555 -- chore(deps): bump docker/setup-qemu-action from 2.2.0 to 3.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4559 -- chore(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.18.32 to 1.18.38 by @dependabot in https://github.com/pomerium/pomerium/pull/4522 -- chore(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.18.38 to 1.18.40 by @dependabot in https://github.com/pomerium/pomerium/pull/4581 -- chore(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.18.40 to 1.18.42 by @dependabot in https://github.com/pomerium/pomerium/pull/4599 -- chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.20.0 to 1.21.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4524 -- chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.38.1 to 1.38.5 by @dependabot in https://github.com/pomerium/pomerium/pull/4521 -- chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.38.5 to 1.40.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4600 -- chore(deps): bump github.com/caddyserver/certmagic from 0.19.1 to 0.19.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4526 -- chore(deps): bump github.com/CAFxX/httpcompression from 0.0.8 to 0.0.9 by @dependabot in https://github.com/pomerium/pomerium/pull/4572 -- chore(deps): bump github.com/docker/docker from 24.0.2+incompatible to 24.0.6+incompatible by @dependabot in https://github.com/pomerium/pomerium/pull/4570 -- chore(deps): bump github.com/docker/docker from 24.0.6+incompatible to 24.0.7+incompatible by @dependabot in https://github.com/pomerium/pomerium/pull/4646 -- chore(deps): bump github.com/google/uuid from 1.3.0 to 1.3.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4517 -- chore(deps): bump github.com/hashicorp/golang-lru/v2 from 2.0.4 to 2.0.6 by @dependabot in https://github.com/pomerium/pomerium/pull/4528 -- chore(deps): bump github.com/hashicorp/golang-lru/v2 from 2.0.6 to 2.0.7 by @dependabot in https://github.com/pomerium/pomerium/pull/4607 -- chore(deps): bump github.com/jackc/pgx/v5 from 5.4.2 to 5.4.3 by @dependabot in https://github.com/pomerium/pomerium/pull/4531 -- chore(deps): bump github.com/klauspost/compress from 1.16.7 to 1.17.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4566 -- chore(deps): bump github.com/minio/minio-go/v7 from 7.0.61 to 7.0.63 by @dependabot in https://github.com/pomerium/pomerium/pull/4527 -- chore(deps): bump github.com/open-policy-agent/opa from 0.55.0 to 0.56.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4530 -- chore(deps): bump github.com/open-policy-agent/opa from 0.56.0 to 0.57.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4606 -- chore(deps): bump github.com/openzipkin/zipkin-go from 0.4.1 to 0.4.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4523 -- chore(deps): bump github.com/prometheus/client_golang from 1.16.0 to 1.17.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4603 -- chore(deps): bump github.com/prometheus/procfs from 0.11.1 to 0.12.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4602 -- chore(deps): bump github.com/rs/cors from 1.9.0 to 1.10.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4574 -- chore(deps): bump github.com/rs/cors from 1.10.0 to 1.10.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4601 -- chore(deps): bump github.com/rs/zerolog from 1.30.0 to 1.31.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4598 -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.23.7 to 3.23.8 by @dependabot in https://github.com/pomerium/pomerium/pull/4519 -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.23.8 to 3.23.9 by @dependabot in https://github.com/pomerium/pomerium/pull/4605 -- chore(deps): bump golangci/golangci-lint-action from 3.6.0 to 3.7.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4499 -- chore(deps): bump google.golang.org/api from 0.134.0 to 0.138.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4532 -- chore(deps): bump google.golang.org/api from 0.138.0 to 0.141.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4578 -- chore(deps): bump google.golang.org/api from 0.141.0 to 0.143.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4608 -- chore(deps): bump google.golang.org/grpc from 1.57.0 to 1.58.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4575 -- chore(deps): bump google.golang.org/grpc from 1.58.2 to 1.58.3 by @dependabot in https://github.com/pomerium/pomerium/pull/4640 -- chore(deps): bump golang.org/x/net from 0.15.0 to 0.17.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4626 -- chore(deps): bump golang.org/x/oauth2 from 0.11.0 to 0.12.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4580 -- chore(deps): bump goreleaser/goreleaser-action from 4.3.0 to 4.4.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4502 -- chore(deps): bump goreleaser/goreleaser-action from 4.4.0 to 5.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4563 -- chore(deps): bump go.uber.org/zap from 1.24.0 to 1.25.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4516 -- chore(deps): bump go.uber.org/zap from 1.25.0 to 1.26.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4577 -- chore(deps): bump mikefarah/yq from 4.34.2 to 4.35.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4503 -- chore(deps): bump mikefarah/yq from 4.35.1 to 4.35.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4610 -- chore(deps): bump node from `f41231b` to `7923c64` by @dependabot in https://github.com/pomerium/pomerium/pull/4551 -- chore(deps): bump node from `7923c64` to `2daec43` by @dependabot in https://github.com/pomerium/pomerium/pull/4609 -- chore(deps): bump node from `850d8e1` to `f41231b` by @dependabot in https://github.com/pomerium/pomerium/pull/4533 -- chore(deps): bump tibdex/github-app-token from 1.8.0 to 1.8.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4505 -- chore(deps): bump tibdex/github-app-token from 1.8.2 to 2.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4556 -- chore(deps): bump tibdex/github-app-token from 2.0.0 to 2.1.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4612 -- chore(deps): bump @fontsource/dm-mono from 4.5.2 to 5.0.11 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/4515 -- chore(deps): bump @fontsource/dm-mono from 5.0.11 to 5.0.12 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/4573 -- chore(deps): bump @fontsource/dm-mono from 5.0.12 to 5.0.14 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/4619 -- chore(deps): bump @fontsource/dm-sans from 5.0.3 to 5.0.11 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/4508 -- chore(deps): bump @fontsource/dm-sans from 5.0.11 to 5.0.12 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/4561 -- chore(deps): bump @fontsource/dm-sans from 5.0.12 to 5.0.13 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/4593 -- chore(deps): bump @mui/icons-material from 5.3.1 to 5.14.9 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/4567 -- chore(deps-dev): bump ts-node from 10.4.0 to 10.9.1 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/4279 -- core/go: upgrade go.mod by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4711 - -## [v0.23.0](https://github.com/pomerium/pomerium/tree/v0.23.0) (2023-08-24) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.22.3...v0.23.0) - -### New - -- adds success colors for statuses in the 200 range [\#4314](https://github.com/pomerium/pomerium/pull/4314) (@nhayfield) -- authenticate: add aws cognito [\#4137](https://github.com/pomerium/pomerium/pull/4137) (@wasaga) -- authorize: log id token claims separately from id token [\#4394](https://github.com/pomerium/pomerium/pull/4394) (@calebdoxsey) -- config: add cookie_same_site option [\#4148](https://github.com/pomerium/pomerium/pull/4148) (@calebdoxsey) -- hpke: compress query string [\#4147](https://github.com/pomerium/pomerium/pull/4147) (@calebdoxsey) - -### Fixed - -- autocert: suppress OCSP stapling errors [\#4371](https://github.com/pomerium/pomerium/pull/4371) (@calebdoxsey) -- config: update logic for checking overlapping certificates [\#4216](https://github.com/pomerium/pomerium/pull/4216) (@calebdoxsey) -- config: validate log levels [\#4367](https://github.com/pomerium/pomerium/pull/4367) (@calebdoxsey) -- databroker: fix fast forward [\#4192](https://github.com/pomerium/pomerium/pull/4192) (@calebdoxsey) -- databroker: sort configs [\#4190](https://github.com/pomerium/pomerium/pull/4190) (@calebdoxsey) -- envoy: set re2 limits very high [\#4187](https://github.com/pomerium/pomerium/pull/4187) (@calebdoxsey) -- envoyconfig: disable validation context when no client certificates are required [\#4151](https://github.com/pomerium/pomerium/pull/4151) (@calebdoxsey) -- fix WillHaveCertificateForServerName check to be strict match for derived cert name [\#4167](https://github.com/pomerium/pomerium/pull/4167) (@wasaga) - -### Dependency - -- chore\(deps\): bump actions/checkout from 3.5.0 to 3.5.2 [\#4153](https://github.com/pomerium/pomerium/pull/4153) (@dependabot[bot]) -- chore\(deps\): bump actions/checkout from 3.5.2 to 3.5.3 [\#4239](https://github.com/pomerium/pomerium/pull/4239) (@dependabot[bot]) -- chore\(deps\): bump actions/setup-go from 4.0.0 to 4.0.1 [\#4176](https://github.com/pomerium/pomerium/pull/4176) (@dependabot[bot]) -- chore\(deps\): bump actions/setup-node from 3.6.0 to 3.7.0 [\#4432](https://github.com/pomerium/pomerium/pull/4432) (@dependabot[bot]) -- chore\(deps\): bump actions/setup-python from 4.6.0 to 4.6.1 [\#4203](https://github.com/pomerium/pomerium/pull/4203) (@dependabot[bot]) -- chore\(deps\): bump actions/setup-python from 4.6.1 to 4.7.0 [\#4429](https://github.com/pomerium/pomerium/pull/4429) (@dependabot[bot]) -- chore\(deps\): bump cloud.google.com/go/storage from 1.29.0 to 1.30.1 [\#4221](https://github.com/pomerium/pomerium/pull/4221) (@dependabot[bot]) -- chore\(deps\): bump cloud.google.com/go/storage from 1.30.1 to 1.31.0 [\#4332](https://github.com/pomerium/pomerium/pull/4332) (@dependabot[bot]) -- chore\(deps\): bump coverallsapp/github-action from 2.1.2 to 2.2.0 [\#4241](https://github.com/pomerium/pomerium/pull/4241) (@dependabot[bot]) -- chore\(deps\): bump coverallsapp/github-action from 2.2.0 to 2.2.1 [\#4430](https://github.com/pomerium/pomerium/pull/4430) (@dependabot[bot]) -- chore\(deps\): bump debian from `1fbdbcf` to `4291be2` [\#4160](https://github.com/pomerium/pomerium/pull/4160) (@dependabot[bot]) -- chore\(deps\): bump debian from `4291be2` to `cd9b6e7` [\#4206](https://github.com/pomerium/pomerium/pull/4206) (@dependabot[bot]) -- chore\(deps\): bump docker/build-push-action from 4.0.0 to 4.1.1 [\#4264](https://github.com/pomerium/pomerium/pull/4264) (@dependabot[bot]) -- chore\(deps\): bump docker/login-action from 2.1.0 to 2.2.0 [\#4274](https://github.com/pomerium/pomerium/pull/4274) (@dependabot[bot]) -- chore\(deps\): bump docker/metadata-action from 4.4.0 to 4.5.0 [\#4242](https://github.com/pomerium/pomerium/pull/4242) (@dependabot[bot]) -- chore\(deps\): bump docker/metadata-action from 4.5.0 to 4.6.0 [\#4273](https://github.com/pomerium/pomerium/pull/4273) (@dependabot[bot]) -- chore\(deps\): bump docker/setup-buildx-action from 2.4.1 to 2.5.0 [\#4154](https://github.com/pomerium/pomerium/pull/4154) (@dependabot[bot]) -- chore\(deps\): bump docker/setup-buildx-action from 2.5.0 to 2.7.0 [\#4262](https://github.com/pomerium/pomerium/pull/4262) (@dependabot[bot]) -- chore\(deps\): bump docker/setup-buildx-action from 2.7.0 to 2.8.0 [\#4330](https://github.com/pomerium/pomerium/pull/4330) (@dependabot[bot]) -- chore\(deps\): bump docker/setup-buildx-action from 2.8.0 to 2.9.1 [\#4433](https://github.com/pomerium/pomerium/pull/4433) (@dependabot[bot]) -- chore\(deps\): bump docker/setup-qemu-action from 2.1.0 to 2.2.0 [\#4263](https://github.com/pomerium/pomerium/pull/4263) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.21 to 1.18.25 [\#4208](https://github.com/pomerium/pomerium/pull/4208) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.25 to 1.18.27 [\#4286](https://github.com/pomerium/pomerium/pull/4286) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.27 to 1.18.32 [\#4436](https://github.com/pomerium/pomerium/pull/4436) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.31.2 to 1.33.0 [\#4139](https://github.com/pomerium/pomerium/pull/4139) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.33.0 to 1.34.0 [\#4260](https://github.com/pomerium/pomerium/pull/4260) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.34.0 to 1.34.1 [\#4290](https://github.com/pomerium/pomerium/pull/4290) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.34.1 to 1.36.0 [\#4323](https://github.com/pomerium/pomerium/pull/4323) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.36.0 to 1.38.1 [\#4435](https://github.com/pomerium/pomerium/pull/4435) (@dependabot[bot]) -- chore\(deps\): bump github.com/caddyserver/certmagic from 0.17.2 to 0.18.0 [\#4291](https://github.com/pomerium/pomerium/pull/4291) (@dependabot[bot]) -- chore\(deps\): bump github.com/caddyserver/certmagic from 0.18.0 to 0.18.2 [\#4334](https://github.com/pomerium/pomerium/pull/4334) (@dependabot[bot]) -- chore\(deps\): bump github.com/caddyserver/certmagic from 0.18.2 to 0.19.1 [\#4401](https://github.com/pomerium/pomerium/pull/4401) (@dependabot[bot]) -- chore\(deps\): bump github.com/cenkalti/backoff/v4 from 4.2.0 to 4.2.1 [\#4156](https://github.com/pomerium/pomerium/pull/4156) (@dependabot[bot]) -- chore\(deps\): bump github.com/cloudflare/circl from 1.3.2 to 1.3.3 [\#4158](https://github.com/pomerium/pomerium/pull/4158) (@dependabot[bot]) -- chore\(deps\): bump github.com/coreos/go-oidc/v3 from 3.5.0 to 3.6.0 [\#4226](https://github.com/pomerium/pomerium/pull/4226) (@dependabot[bot]) -- chore\(deps\): bump github.com/docker/distribution from 2.8.1+incompatible to 2.8.2+incompatible [\#4170](https://github.com/pomerium/pomerium/pull/4170) (@dependabot[bot]) -- chore\(deps\): bump github.com/docker/docker from 23.0.3+incompatible to 23.0.5+incompatible [\#4141](https://github.com/pomerium/pomerium/pull/4141) (@dependabot[bot]) -- chore\(deps\): bump github.com/docker/docker from 23.0.5+incompatible to 23.0.6+incompatible [\#4164](https://github.com/pomerium/pomerium/pull/4164) (@dependabot[bot]) -- chore\(deps\): bump github.com/docker/docker from 23.0.6+incompatible to 24.0.1+incompatible [\#4183](https://github.com/pomerium/pomerium/pull/4183) (@dependabot[bot]) -- chore\(deps\): bump github.com/docker/docker from 24.0.1+incompatible to 24.0.2+incompatible [\#4205](https://github.com/pomerium/pomerium/pull/4205) (@dependabot[bot]) -- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 1.0.0 to 1.0.1 [\#4185](https://github.com/pomerium/pomerium/pull/4185) (@dependabot[bot]) -- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 1.0.1 to 1.0.2 [\#4329](https://github.com/pomerium/pomerium/pull/4329) (@dependabot[bot]) -- chore\(deps\): bump github.com/envoyproxy/go-control-plane from 0.11.0 to 0.11.1 [\#4247](https://github.com/pomerium/pomerium/pull/4247) (@dependabot[bot]) -- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 0.10.1 to 1.0.0 [\#4155](https://github.com/pomerium/pomerium/pull/4155) (@dependabot[bot]) -- chore\(deps\): bump github.com/go-chi/chi/v5 from 5.0.8 to 5.0.10 [\#4407](https://github.com/pomerium/pomerium/pull/4407) (@dependabot[bot]) -- chore\(deps\): bump github.com/hashicorp/golang-lru/v2 from 2.0.2 to 2.0.3 [\#4267](https://github.com/pomerium/pomerium/pull/4267) (@dependabot[bot]) -- chore\(deps\): bump github.com/hashicorp/golang-lru/v2 from 2.0.3 to 2.0.4 [\#4327](https://github.com/pomerium/pomerium/pull/4327) (@dependabot[bot]) -- chore\(deps\): bump github.com/jackc/pgx/v5 from 5.3.1 to 5.4.0 [\#4293](https://github.com/pomerium/pomerium/pull/4293) (@dependabot[bot]) -- chore\(deps\): bump github.com/jackc/pgx/v5 from 5.4.0 to 5.4.1 [\#4324](https://github.com/pomerium/pomerium/pull/4324) (@dependabot[bot]) -- chore\(deps\): bump github.com/jackc/pgx/v5 from 5.4.1 to 5.4.2 [\#4409](https://github.com/pomerium/pomerium/pull/4409) (@dependabot[bot]) -- chore\(deps\): bump github.com/klauspost/compress from 1.16.0 to 1.16.5 [\#4177](https://github.com/pomerium/pomerium/pull/4177) (@dependabot[bot]) -- chore\(deps\): bump github.com/klauspost/compress from 1.16.5 to 1.16.6 [\#4281](https://github.com/pomerium/pomerium/pull/4281) (@dependabot[bot]) -- chore\(deps\): bump github.com/mholt/acmez from 1.1.0 to 1.1.1 [\#4184](https://github.com/pomerium/pomerium/pull/4184) (@dependabot[bot]) -- chore\(deps\): bump github.com/minio/minio-go/v7 from 7.0.52 to 7.0.55 [\#4202](https://github.com/pomerium/pomerium/pull/4202) (@dependabot[bot]) -- chore\(deps\): bump github.com/minio/minio-go/v7 from 7.0.55 to 7.0.56 [\#4243](https://github.com/pomerium/pomerium/pull/4243) (@dependabot[bot]) -- chore\(deps\): bump github.com/minio/minio-go/v7 from 7.0.56 to 7.0.57 [\#4280](https://github.com/pomerium/pomerium/pull/4280) (@dependabot[bot]) -- chore\(deps\): bump github.com/minio/minio-go/v7 from 7.0.57 to 7.0.59 [\#4333](https://github.com/pomerium/pomerium/pull/4333) (@dependabot[bot]) -- chore\(deps\): bump github.com/minio/minio-go/v7 from 7.0.59 to 7.0.61 [\#4415](https://github.com/pomerium/pomerium/pull/4415) (@dependabot[bot]) -- chore\(deps\): bump github.com/open-policy-agent/opa from 0.51.0 to 0.52.0 [\#4142](https://github.com/pomerium/pomerium/pull/4142) (@dependabot[bot]) -- chore\(deps\): bump github.com/open-policy-agent/opa from 0.52.0 to 0.53.1 [\#4235](https://github.com/pomerium/pomerium/pull/4235) (@dependabot[bot]) -- chore\(deps\): bump github.com/open-policy-agent/opa from 0.54.0 to 0.55.0 [\#4404](https://github.com/pomerium/pomerium/pull/4404) (@dependabot[bot]) -- chore\(deps\): bump github.com/prometheus/procfs from 0.10.1 to 0.11.0 [\#4276](https://github.com/pomerium/pomerium/pull/4276) (@dependabot[bot]) -- chore\(deps\): bump github.com/prometheus/procfs from 0.11.0 to 0.11.1 [\#4400](https://github.com/pomerium/pomerium/pull/4400) (@dependabot[bot]) -- chore\(deps\): bump github.com/prometheus/client_golang from 1.15.0 to 1.15.1 [\#4157](https://github.com/pomerium/pomerium/pull/4157) (@dependabot[bot]) -- chore\(deps\): bump github.com/prometheus/client_golang from 1.15.1 to 1.16.0 [\#4268](https://github.com/pomerium/pomerium/pull/4268) (@dependabot[bot]) -- chore\(deps\): bump github.com/prometheus/client_model from 0.3.0 to 0.4.0 [\#4162](https://github.com/pomerium/pomerium/pull/4162) (@dependabot[bot]) -- chore\(deps\): bump github.com/prometheus/common from 0.42.0 to 0.43.0 [\#4172](https://github.com/pomerium/pomerium/pull/4172) (@dependabot[bot]) -- chore\(deps\): bump github.com/prometheus/common from 0.43.0 to 0.44.0 [\#4244](https://github.com/pomerium/pomerium/pull/4244) (@dependabot[bot]) -- chore\(deps\): bump github.com/peterbourgon/ff/v3 from 3.3.0 to 3.3.1 [\#4204](https://github.com/pomerium/pomerium/pull/4204) (@dependabot[bot]) -- chore\(deps\): bump github.com/peterbourgon/ff/v3 from 3.3.1 to 3.3.2 [\#4248](https://github.com/pomerium/pomerium/pull/4248) (@dependabot[bot]) -- chore\(deps\): bump github.com/peterbourgon/ff/v3 from 3.3.2 to 3.4.0 [\#4399](https://github.com/pomerium/pomerium/pull/4399) (@dependabot[bot]) -- chore\(deps\): bump github.com/rs/cors from 1.8.3 to 1.9.0 [\#4179](https://github.com/pomerium/pomerium/pull/4179) (@dependabot[bot]) -- chore\(deps\): bump github.com/rs/zerolog from 1.29.1 to 1.30.0 [\#4406](https://github.com/pomerium/pomerium/pull/4406) (@dependabot[bot]) -- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.23.3 to 3.23.4 [\#4165](https://github.com/pomerium/pomerium/pull/4165) (@dependabot[bot]) -- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.23.4 to 3.23.5 [\#4225](https://github.com/pomerium/pomerium/pull/4225) (@dependabot[bot]) -- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.23.5 to 3.23.6 [\#4328](https://github.com/pomerium/pomerium/pull/4328) (@dependabot[bot]) -- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.23.6 to 3.23.7 [\#4402](https://github.com/pomerium/pomerium/pull/4402) (@dependabot[bot]) -- chore\(deps\): bump github.com/spf13/viper from 1.15.0 to 1.16.0 [\#4296](https://github.com/pomerium/pomerium/pull/4296) (@dependabot[bot]) -- chore\(deps\): bump github.com/stretchr/testify from 1.8.2 to 1.8.3 [\#4200](https://github.com/pomerium/pomerium/pull/4200) (@dependabot[bot]) -- chore\(deps\): bump golangci/golangci-lint-action from 3.5.0 to 3.6.0 [\#4238](https://github.com/pomerium/pomerium/pull/4238) (@dependabot[bot]) -- chore\(deps\): bump golang from 1.20.3-buster to 1.20.4-buster [\#4161](https://github.com/pomerium/pomerium/pull/4161) (@dependabot[bot]) -- chore\(deps\): bump golang from 1.20.4-buster to 1.20.5-buster [\#4227](https://github.com/pomerium/pomerium/pull/4227) (@dependabot[bot]) -- chore\(deps\): bump golang from `b0f97bf` to `eb3f9ac` [\#4271](https://github.com/pomerium/pomerium/pull/4271) (@dependabot[bot]) -- chore\(deps\): bump golang from `4cf6dc4` to `6be6011` [\#4207](https://github.com/pomerium/pomerium/pull/4207) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.118.0 to 0.120.0 [\#4143](https://github.com/pomerium/pomerium/pull/4143) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.120.0 to 0.121.0 [\#4159](https://github.com/pomerium/pomerium/pull/4159) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.121.0 to 0.125.0 [\#4222](https://github.com/pomerium/pomerium/pull/4222) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.121.0 to 0.126.0 [\#4236](https://github.com/pomerium/pomerium/pull/4236) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.126.0 to 0.128.0 [\#4283](https://github.com/pomerium/pomerium/pull/4283) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.128.0 to 0.130.0 [\#4348](https://github.com/pomerium/pomerium/pull/4348) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.130.0 to 0.134.0 [\#4403](https://github.com/pomerium/pomerium/pull/4403) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/grpc from 1.54.0 to 1.55.0 [\#4166](https://github.com/pomerium/pomerium/pull/4166) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/grpc from 1.55.0 to 1.56.0 [\#4278](https://github.com/pomerium/pomerium/pull/4278) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/grpc from 1.56.1 to 1.57.0 [\#4411](https://github.com/pomerium/pomerium/pull/4411) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/protobuf from 1.30.0 to 1.31.0 [\#4325](https://github.com/pomerium/pomerium/pull/4325) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/crypto from 0.8.0 to 0.9.0 [\#4182](https://github.com/pomerium/pomerium/pull/4182) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/crypto from 0.9.0 to 0.10.0 [\#4266](https://github.com/pomerium/pomerium/pull/4266) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/net from 0.9.0 to 0.10.0 [\#4174](https://github.com/pomerium/pomerium/pull/4174) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/oauth2 from 0.7.0 to 0.8.0 [\#4178](https://github.com/pomerium/pomerium/pull/4178) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/oauth2 from 0.8.0 to 0.9.0 [\#4287](https://github.com/pomerium/pomerium/pull/4287) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/sync from 0.1.0 to 0.2.0 [\#4163](https://github.com/pomerium/pomerium/pull/4163) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/sync from 0.2.0 to 0.3.0 [\#4294](https://github.com/pomerium/pomerium/pull/4294) (@dependabot[bot]) -- chore\(deps\): bump google-github-actions/auth from 1.1.0 to 1.1.1 [\#4173](https://github.com/pomerium/pomerium/pull/4173) (@dependabot[bot]) -- chore\(deps\): bump google-github-actions/setup-gcloud from 1.1.0 to 1.1.1 [\#4175](https://github.com/pomerium/pomerium/pull/4175) (@dependabot[bot]) -- chore\(deps\): bump goreleaser/goreleaser-action from 4.2.0 to 4.3.0 [\#4240](https://github.com/pomerium/pomerium/pull/4240) (@dependabot[bot]) -- chore\(deps\): bump markdown-to-jsx from 7.1.7 to 7.2.1 in /ui [\#4297](https://github.com/pomerium/pomerium/pull/4297) (@dependabot[bot]) -- chore\(deps\): bump mikefarah/yq from 4.33.3 to 4.34.1 [\#4201](https://github.com/pomerium/pomerium/pull/4201) (@dependabot[bot]) -- chore\(deps\): bump mikefarah/yq from 4.34.1 to 4.34.2 [\#4431](https://github.com/pomerium/pomerium/pull/4431) (@dependabot[bot]) -- chore\(deps\): bump node from `3801c22` to `850d8e1` [\#4416](https://github.com/pomerium/pomerium/pull/4416) (@dependabot[bot]) -- chore\(deps\): bump node from `05824f7` to `3801c22` [\#4322](https://github.com/pomerium/pomerium/pull/4322) (@dependabot[bot]) -- chore\(deps\): bump node from `f658ece` to `05824f7` [\#4272](https://github.com/pomerium/pomerium/pull/4272) (@dependabot[bot]) -- chore\(deps\): bump node from `df5a66e` to `f658ece` [\#4252](https://github.com/pomerium/pomerium/pull/4252) (@dependabot[bot]) -- chore\(deps\): bump react-feather from 2.0.9 to 2.0.10 in /ui [\#4306](https://github.com/pomerium/pomerium/pull/4306) (@dependabot[bot]) -- chore\(deps\): bump semver from 6.3.0 to 6.3.1 in /ui [\#4350](https://github.com/pomerium/pomerium/pull/4350) (@dependabot[bot]) -- chore\(deps\): bump word-wrap from 1.2.3 to 1.2.4 in /ui [\#4369](https://github.com/pomerium/pomerium/pull/4369) (@dependabot[bot]) -- chore\(deps\): bump @emotion/styled from 11.6.0 to 11.11.0 in /ui [\#4277](https://github.com/pomerium/pomerium/pull/4277) (@dependabot[bot]) -- chore\(deps\): bump @fontsource/dm-sans from 4.5.1 to 5.0.3 in /ui [\#4307](https://github.com/pomerium/pomerium/pull/4307) (@dependabot[bot]) -- chore\(deps-dev\): bump typescript from 4.5.5 to 5.1.3 in /ui [\#4289](https://github.com/pomerium/pomerium/pull/4289) (@dependabot[bot]) -- chore\(deps-dev\): bump @typescript-eslint/parser from 5.10.2 to 5.59.11 in /ui [\#4282](https://github.com/pomerium/pomerium/pull/4282) (@dependabot[bot]) -- dependencies: pin node to lts [\#4218](https://github.com/pomerium/pomerium/pull/4218) (@wasaga) -- dependencies: upgrade otel [\#4395](https://github.com/pomerium/pomerium/pull/4395) (@calebdoxsey) - -### Changed - -- add downstream mTLS integration test cases \(main\) [\#4234](https://github.com/pomerium/pomerium/pull/4234) (@kenjenkins) -- add integration test for client_crl setting [\#4384](https://github.com/pomerium/pomerium/pull/4384) (@kenjenkins) -- add integration test for https IP address route [\#4476](https://github.com/pomerium/pomerium/pull/4476) (@kenjenkins) -- add integration test for Pomerium JWT [\#4472](https://github.com/pomerium/pomerium/pull/4472) (@kenjenkins) -- add JWT timestamp formatting workaround [\#4270](https://github.com/pomerium/pomerium/pull/4270) (@kenjenkins) -- authenticate: remove extraneous error log [\#4319](https://github.com/pomerium/pomerium/pull/4319) (@kenjenkins) -- authorize: add support for logging id token [\#4392](https://github.com/pomerium/pomerium/pull/4392) (@calebdoxsey) -- authorize: allow client certificate intermediates [\#4451](https://github.com/pomerium/pomerium/pull/4451) (@kenjenkins) -- authorize: check CRLs only for leaf certificates [\#4480](https://github.com/pomerium/pomerium/pull/4480) (@kenjenkins) -- authorize: do not redirect if invalid client cert [\#4344](https://github.com/pomerium/pomerium/pull/4344) (@kenjenkins) -- authorize: do not rely on Envoy client cert validation [\#4438](https://github.com/pomerium/pomerium/pull/4438) (@kenjenkins) -- authorize: fix policy numbers in evaluator test [\#4387](https://github.com/pomerium/pomerium/pull/4387) (@kenjenkins) -- authorize: implement client certificate CRL check [\#4439](https://github.com/pomerium/pomerium/pull/4439) (@kenjenkins) -- authorize: incorporate mTLS validation from Envoy [\#4374](https://github.com/pomerium/pomerium/pull/4374) (@kenjenkins) -- authorize: remove a nolint directive [\#4375](https://github.com/pomerium/pomerium/pull/4375) (@kenjenkins) -- authorize: remove incorrect "valid-client-certificate" reason [\#4470](https://github.com/pomerium/pomerium/pull/4470) (@kenjenkins) -- authorize: remove JWT timestamp format workaround [\#4321](https://github.com/pomerium/pomerium/pull/4321) (@kenjenkins) -- authorize: rework token substitution in headers [\#4456](https://github.com/pomerium/pomerium/pull/4456) (@kenjenkins) -- autocert: use new OCSP error type [\#4437](https://github.com/pomerium/pomerium/pull/4437) (@kenjenkins) -- chore: unnecessary use of fmt.Sprintf [\#4349](https://github.com/pomerium/pomerium/pull/4349) (@testwill) -- ci: updates [\#4269](https://github.com/pomerium/pomerium/pull/4269) (@calebdoxsey) -- config: add decode hook for the SANMatcher type [\#4464](https://github.com/pomerium/pomerium/pull/4464) (@kenjenkins) -- config: deprecate tls_downstream_client_ca [\#4461](https://github.com/pomerium/pomerium/pull/4461) (@kenjenkins) -- config: simplify default set response headers [\#4196](https://github.com/pomerium/pomerium/pull/4196) (@calebdoxsey) -- config: support client certificate SAN match [\#4453](https://github.com/pomerium/pomerium/pull/4453) (@kenjenkins) -- config: support arbitrary nested config structs [\#4440](https://github.com/pomerium/pomerium/pull/4440) (@kenjenkins) -- config: validate cookie_secure option [\#4484](https://github.com/pomerium/pomerium/pull/4484) (@kenjenkins) -- cryptutil: update CRL parsing [\#4454](https://github.com/pomerium/pomerium/pull/4454) (@kenjenkins) -- dependabot: improvements [\#4261](https://github.com/pomerium/pomerium/pull/4261) (@calebdoxsey) -- envoy: add a filter to store client cert info [\#4372](https://github.com/pomerium/pomerium/pull/4372) (@kenjenkins) -- envoy: check for nil ssl\(\) in client cert script [\#4466](https://github.com/pomerium/pomerium/pull/4466) (@kenjenkins) -- envoy: configure upstream IP SAN match as needed [\#4380](https://github.com/pomerium/pomerium/pull/4380) (@kenjenkins) -- envoy: separate gRPC listener configuration [\#4365](https://github.com/pomerium/pomerium/pull/4365) (@kenjenkins) -- fix lint warning in pkg/envoy [\#4181](https://github.com/pomerium/pomerium/pull/4181) (@kenjenkins) -- improve certificate matching performance [\#4186](https://github.com/pomerium/pomerium/pull/4186) (@calebdoxsey) -- logs: add ip address to access logs [\#4391](https://github.com/pomerium/pomerium/pull/4391) (@calebdoxsey) -- organize go.mod [\#4320](https://github.com/pomerium/pomerium/pull/4320) (@kenjenkins) -- pin to a debian:latest image for casource base image [\#4250](https://github.com/pomerium/pomerium/pull/4250) (@kenjenkins) -- replace docker publish action ::set-output usage [\#4359](https://github.com/pomerium/pomerium/pull/4359) (@kenjenkins) -- storage: add indexes for postgres [\#4479](https://github.com/pomerium/pomerium/pull/4479) (@calebdoxsey) -- stub out HPKE public key fetch for self-hosted authenticate [\#4360](https://github.com/pomerium/pomerium/pull/4360) (@kenjenkins) -- upgrade main [\#4457](https://github.com/pomerium/pomerium/pull/4457) (@wasaga) -- Update README.md [\#4146](https://github.com/pomerium/pomerium/pull/4146) (@desimone) -- Update SECURITY.md [\#4144](https://github.com/pomerium/pomerium/pull/4144) (@desimone) - -## [v0.22.3](https://github.com/pomerium/pomerium/tree/v0.22.3) (2023-08-21) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.22.2...v0.22.3) - -### Changed - -- add integration test for https IP address route [\#4477](https://github.com/pomerium/pomerium/pull/4477) (@kenjenkins) -- add integration test for Pomerium JWT [\#4473](https://github.com/pomerium/pomerium/pull/4473) (@kenjenkins) -- add JWT timestamp formatting workaround [\#4309](https://github.com/pomerium/pomerium/pull/4309) (@backport-actions-token[bot]) -- authorize: populate issuer even when policy is nil [\#4213](https://github.com/pomerium/pomerium/pull/4213) (@backport-actions-token[bot]) -- autocert: suppress OCSP stapling errors [\#4373](https://github.com/pomerium/pomerium/pull/4373) (@backport-actions-token[bot]) -- backport [\#4368](https://github.com/pomerium/pomerium/pull/4368) (@calebdoxsey) -- ci: fix lint workflow \(\#4229\) [\#4311](https://github.com/pomerium/pomerium/pull/4311) (@kenjenkins) -- config: update logic for checking overlapping certificates \(\#4216\) [\#4217](https://github.com/pomerium/pomerium/pull/4217) (@calebdoxsey) -- config: simplify default set response headers [\#4212](https://github.com/pomerium/pomerium/pull/4212) (@backport-actions-token[bot]) -- envoy: configure upstream IP SAN match as needed [\#4382](https://github.com/pomerium/pomerium/pull/4382) (@backport-actions-token[bot]) -- github-actions: remove license check [\#4475](https://github.com/pomerium/pomerium/pull/4475) (@kenjenkins) -- pin to a debian:latest image for casource base image \(\#4250\) [\#4310](https://github.com/pomerium/pomerium/pull/4310) (@kenjenkins) - -## [v0.22.2](https://github.com/pomerium/pomerium/tree/v0.22.2) (2023-05-26) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.22.1...v0.22.2) - -### Security - -- This release fixes a bug whereby specially crafted requests could result in incorrect authorization decisions made by Pomerium. [CVE-2023-33189](https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p). - -### Changed - -- databroker: sort configs by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4191 -- databroker: fix fast forward by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4194 -- envoy: set re2 limits very high by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4189 -- fix WillHaveCertificateForServerName check to be strict match for derived cert name by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4169 -- improve certificate matching performance by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4188 - -## [v0.22.1](https://github.com/pomerium/pomerium/tree/v0.22.1) (2023-05-04) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.22.0...v0.22.1) - -### Changed - -- envoyconfig: disable validation context when no client certificates are required by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4152 - -## [v0.22.0](https://github.com/pomerium/pomerium/tree/v0.22.0) (2023-05-01) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.21.3...v0.22.0) - -### Security - -- Pomerium upgraded to [Go v1.20.3](https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8/m/OV40vnafAwAJ) and [Envoy v1.24.5](https://groups.google.com/g/envoy-announce/c/o_W9gYVU2js/m/kU77ha6tBAAJ) to address security issues exposed in these packages. See the release notes in the links for more information. - -### Changed - -- add google cloud creds to ignore [\#3906](https://github.com/pomerium/pomerium/pull/3906) (@wasaga) -- apple: fix userinfo [\#3974](https://github.com/pomerium/pomerium/pull/3974) (@calebdoxsey) -- Appleid [\#3959](https://github.com/pomerium/pomerium/pull/3959) (@mnestor) -- authenticate: add events [\#4051](https://github.com/pomerium/pomerium/pull/4051) (@wasaga) -- authenticate: don't require a session for sign_out [\#4009](https://github.com/pomerium/pomerium/pull/4009) (@backport-actions-token[bot]) -- authenticate: fix callback handler for split mode [\#4008](https://github.com/pomerium/pomerium/pull/4008) (@wasaga) -- chore\(deps\): bump actions/checkout from 3.4.0 to 3.5.0 [\#4078](https://github.com/pomerium/pomerium/pull/4078) (@dependabot[bot]) -- chore\(deps\): bump docker/setup-buildx-action from 2.2.1 to 2.4.0 [\#3924](https://github.com/pomerium/pomerium/pull/3924) (@dependabot[bot]) -- config: remove source, remove deadcode, fix linting issues [\#4118](https://github.com/pomerium/pomerium/pull/4118) (@calebdoxsey) -- databroker: add list types method [\#3937](https://github.com/pomerium/pomerium/pull/3937) (@calebdoxsey) -- envoy: optimize listener [\#3952](https://github.com/pomerium/pomerium/pull/3952) (@wasaga) -- maybe fix flaky test [\#3929](https://github.com/pomerium/pomerium/pull/3929) (@calebdoxsey) -- move hpke public key handler out of internal [\#4065](https://github.com/pomerium/pomerium/pull/4065) (@wasaga) -- remove log message when no provider defined [\#3936](https://github.com/pomerium/pomerium/pull/3936) (@calebdoxsey) -- Update SECURITY.md [\#4145](https://github.com/pomerium/pomerium/pull/4145) (@backport-actions-token[bot]) -- webauthn: only return known device credentials that match the given type [\#3981](https://github.com/pomerium/pomerium/pull/3981) (@calebdoxsey) - -### New - -- authenticate: fix authenticate_internal_service_url for all in one [\#4003](https://github.com/pomerium/pomerium/pull/4003) (@wasaga) -- authenticate: have an option to trim the contents of the callback [\#4090](https://github.com/pomerium/pomerium/pull/4090) (@wasaga) -- authenticate: only use csrf none for apple [\#3979](https://github.com/pomerium/pomerium/pull/3979) (@calebdoxsey) -- config: default to authenticate.pomerium.app when authenticate url is not specified [\#4132](https://github.com/pomerium/pomerium/pull/4132) (@calebdoxsey) -- cryptutil: generate certificates from deriveca [\#3992](https://github.com/pomerium/pomerium/pull/3992) (@calebdoxsey) -- envoyconfig: preserve case of HTTP headers when using HTTP/1 [\#3956](https://github.com/pomerium/pomerium/pull/3956) (@calebdoxsey) -- support loading route configuration via rds [\#4098](https://github.com/pomerium/pomerium/pull/4098) (@calebdoxsey) -- urlutil: add version to query string [\#4028](https://github.com/pomerium/pomerium/pull/4028) (@calebdoxsey) - -### Fixed - -- authenticate: always trust the passed in idp [\#3917](https://github.com/pomerium/pomerium/pull/3917) (@calebdoxsey) -- authenticate: don't require a session for sign_out [\#4007](https://github.com/pomerium/pomerium/pull/4007) (@calebdoxsey) -- authenticate: fix identity provider id in encrypted query string [\#4006](https://github.com/pomerium/pomerium/pull/4006) (@calebdoxsey) -- authenticate: save the session cookie with a different name [\#3978](https://github.com/pomerium/pomerium/pull/3978) (@calebdoxsey) -- authorize: allow access to /.pomerium/webauthn when policy denies access [\#4015](https://github.com/pomerium/pomerium/pull/4015) (@calebdoxsey) -- authorize: move sign out and jwks urls to route, update issuer for JWT [\#4046](https://github.com/pomerium/pomerium/pull/4046) (@calebdoxsey) -- autocert: fix certmagic cache logging [\#4134](https://github.com/pomerium/pomerium/pull/4134) (@calebdoxsey) -- config: fix set_response_headers [\#4026](https://github.com/pomerium/pomerium/pull/4026) (@calebdoxsey) -- derivecert: fix ecdsa code to be deterministic [\#3989](https://github.com/pomerium/pomerium/pull/3989) (@calebdoxsey) -- fix webauthn url [\#3983](https://github.com/pomerium/pomerium/pull/3983) (@calebdoxsey) -- hpke: move published public keys to a new endpoint [\#4044](https://github.com/pomerium/pomerium/pull/4044) (@calebdoxsey) -- identity: fix nil reference error when there is no authenticator [\#3930](https://github.com/pomerium/pomerium/pull/3930) (@calebdoxsey) -- lua: fix rewrite response headers to handle dashes in URLs [\#3980](https://github.com/pomerium/pomerium/pull/3980) (@calebdoxsey) -- store authenticate state on creation [\#4064](https://github.com/pomerium/pomerium/pull/4064) (@wasaga) -- tls: wildcard catch-all cert must be at the end of cert list [\#4119](https://github.com/pomerium/pomerium/pull/4119) (@wasaga) - -### Dependency - -- chore\(deps\): bump actions/cache from 3.2.3 to 3.2.4 [\#3923](https://github.com/pomerium/pomerium/pull/3923) (@dependabot[bot]) -- chore\(deps\): bump actions/cache from 3.2.4 to 3.2.5 [\#3962](https://github.com/pomerium/pomerium/pull/3962) (@dependabot[bot]) -- chore\(deps\): bump actions/cache from 3.2.5 to 3.2.6 [\#4019](https://github.com/pomerium/pomerium/pull/4019) (@dependabot[bot]) -- chore\(deps\): bump actions/cache from 3.2.6 to 3.3.1 [\#4054](https://github.com/pomerium/pomerium/pull/4054) (@dependabot[bot]) -- chore\(deps\): bump actions/checkout from 3.3.0 to 3.4.0 [\#4068](https://github.com/pomerium/pomerium/pull/4068) (@dependabot[bot]) -- chore\(deps\): bump actions/checkout from 3.5.0 to 3.5.2 [\#4108](https://github.com/pomerium/pomerium/pull/4108) (@dependabot[bot]) -- chore\(deps\): bump actions/setup-go from 3.5.0 to 4.0.0 [\#4067](https://github.com/pomerium/pomerium/pull/4067) (@dependabot[bot]) -- chore\(deps\): bump actions/setup-python from 4.5.0 to 4.6.0 [\#4123](https://github.com/pomerium/pomerium/pull/4123) (@dependabot[bot]) -- chore\(deps\): bump actions/stale from 7.0.0 to 8.0.0 [\#4077](https://github.com/pomerium/pomerium/pull/4077) (@dependabot[bot]) -- chore\(deps\): bump cloud.google.com/go/storage from 1.28.1 to 1.29.0 [\#3912](https://github.com/pomerium/pomerium/pull/3912) (@dependabot[bot]) -- chore\(deps\): bump coverallsapp/github-action from 1.1.3 to 1.2.2 [\#4017](https://github.com/pomerium/pomerium/pull/4017) (@dependabot[bot]) -- chore\(deps\): bump coverallsapp/github-action from 1.2.2 to 1.2.4 [\#4041](https://github.com/pomerium/pomerium/pull/4041) (@dependabot[bot]) -- chore\(deps\): bump coverallsapp/github-action from 1.2.4 to 2.0.0 [\#4069](https://github.com/pomerium/pomerium/pull/4069) (@dependabot[bot]) -- chore\(deps\): bump coverallsapp/github-action from 2.0.0 to 2.1.0 [\#4100](https://github.com/pomerium/pomerium/pull/4100) (@dependabot[bot]) -- chore\(deps\): bump coverallsapp/github-action from 2.1.0 to 2.1.2 [\#4124](https://github.com/pomerium/pomerium/pull/4124) (@dependabot[bot]) -- chore\(deps\): bump debian from `12931ad` to `50cf570` [\#3950](https://github.com/pomerium/pomerium/pull/3950) (@dependabot[bot]) -- chore\(deps\): bump debian from `50cf570` to `7b16406` [\#3970](https://github.com/pomerium/pomerium/pull/3970) (@dependabot[bot]) -- chore\(deps\): bump debian from `7b16406` to `c1c4bb9` [\#4042](https://github.com/pomerium/pomerium/pull/4042) (@dependabot[bot]) -- chore\(deps\): bump debian from `c1c4bb9` to `d4bbca2` [\#4085](https://github.com/pomerium/pomerium/pull/4085) (@dependabot[bot]) -- chore\(deps\): bump debian from `d4bbca2` to `1fbdbcf` [\#4115](https://github.com/pomerium/pomerium/pull/4115) (@dependabot[bot]) -- chore\(deps\): bump distroless/base from `4f9fe94` to `9687cd3` [\#3968](https://github.com/pomerium/pomerium/pull/3968) (@dependabot[bot]) -- chore\(deps\): bump distroless/base from `5812871` to `357bc96` [\#4102](https://github.com/pomerium/pomerium/pull/4102) (@dependabot[bot]) -- chore\(deps\): bump distroless/base from `76b0529` to `4f9fe94` [\#3948](https://github.com/pomerium/pomerium/pull/3948) (@dependabot[bot]) -- chore\(deps\): bump distroless/base from `8e770ae` to `5812871` [\#4025](https://github.com/pomerium/pomerium/pull/4025) (@dependabot[bot]) -- chore\(deps\): bump distroless/base from `9687cd3` to `8e770ae` [\#3995](https://github.com/pomerium/pomerium/pull/3995) (@dependabot[bot]) -- chore\(deps\): bump distroless/base from `9eeffdc` to `76b0529` [\#3928](https://github.com/pomerium/pomerium/pull/3928) (@dependabot[bot]) -- chore\(deps\): bump docker/build-push-action from 3.3.0 to 4.0.0 [\#3942](https://github.com/pomerium/pomerium/pull/3942) (@dependabot[bot]) -- chore\(deps\): bump docker/metadata-action from 4.3.0 to 4.4.0 [\#4122](https://github.com/pomerium/pomerium/pull/4122) (@dependabot[bot]) -- chore\(deps\): bump docker/setup-buildx-action from 2.4.0 to 2.4.1 [\#3941](https://github.com/pomerium/pomerium/pull/3941) (@dependabot[bot]) -- chore\(deps\): bump docker/setup-buildx-action from 2.4.1 to 2.5.0 [\#4055](https://github.com/pomerium/pomerium/pull/4055) (@dependabot[bot]) -- chore\(deps\): bump fossa-contrib/fossa-action from 1.2.0 to 2.0.0 [\#3961](https://github.com/pomerium/pomerium/pull/3961) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2 from 1.17.3 to 1.17.4 [\#3946](https://github.com/pomerium/pomerium/pull/3946) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2 from 1.17.5 to 1.17.6 [\#4059](https://github.com/pomerium/pomerium/pull/4059) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.10 to 1.18.14 [\#4002](https://github.com/pomerium/pomerium/pull/4002) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.14 to 1.18.15 [\#4018](https://github.com/pomerium/pomerium/pull/4018) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.15 to 1.18.18 [\#4070](https://github.com/pomerium/pomerium/pull/4070) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.18 to 1.18.19 [\#4080](https://github.com/pomerium/pomerium/pull/4080) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.19 to 1.18.21 [\#4126](https://github.com/pomerium/pomerium/pull/4126) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.8 to 1.18.10 [\#3927](https://github.com/pomerium/pomerium/pull/3927) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.30.0 to 1.30.1 [\#3925](https://github.com/pomerium/pomerium/pull/3925) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.30.1 to 1.30.2 [\#3944](https://github.com/pomerium/pomerium/pull/3944) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.30.2 to 1.30.3 [\#3998](https://github.com/pomerium/pomerium/pull/3998) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.30.3 to 1.30.5 [\#4024](https://github.com/pomerium/pomerium/pull/4024) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.30.5 to 1.31.2 [\#4106](https://github.com/pomerium/pomerium/pull/4106) (@dependabot[bot]) -- chore\(deps\): bump github.com/cloudflare/circl from 1.3.1 to 1.3.2 [\#3947](https://github.com/pomerium/pomerium/pull/3947) (@dependabot[bot]) -- chore\(deps\): bump github.com/docker/docker from 20.10.22+incompatible to 20.10.23+incompatible [\#3911](https://github.com/pomerium/pomerium/pull/3911) (@dependabot[bot]) -- chore\(deps\): bump github.com/docker/docker from 20.10.23+incompatible to 23.0.1+incompatible [\#3967](https://github.com/pomerium/pomerium/pull/3967) (@dependabot[bot]) -- chore\(deps\): bump github.com/docker/docker from 23.0.1+incompatible to 23.0.3+incompatible [\#4101](https://github.com/pomerium/pomerium/pull/4101) (@dependabot[bot]) -- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 0.10.0 to 0.10.1 [\#4083](https://github.com/pomerium/pomerium/pull/4083) (@dependabot[bot]) -- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 0.9.1 to 0.10.0 [\#4074](https://github.com/pomerium/pomerium/pull/4074) (@dependabot[bot]) -- chore\(deps\): bump github.com/golangci/golangci-lint from 1.50.1 to 1.51.2 [\#4020](https://github.com/pomerium/pomerium/pull/4020) (@dependabot[bot]) -- chore\(deps\): bump github.com/google/go-jsonnet from 0.19.1 to 0.20.0 [\#4140](https://github.com/pomerium/pomerium/pull/4140) (@dependabot[bot]) -- chore\(deps\): bump github.com/hashicorp/golang-lru/v2 from 2.0.1 to 2.0.2 [\#4073](https://github.com/pomerium/pomerium/pull/4073) (@dependabot[bot]) -- chore\(deps\): bump github.com/jackc/pgx/v5 from 5.2.0 to 5.3.0 [\#3964](https://github.com/pomerium/pomerium/pull/3964) (@dependabot[bot]) -- chore\(deps\): bump github.com/jackc/pgx/v5 from 5.3.0 to 5.3.1 [\#4039](https://github.com/pomerium/pomerium/pull/4039) (@dependabot[bot]) -- chore\(deps\): bump github.com/mholt/acmez from 1.0.4 to 1.1.0 [\#4000](https://github.com/pomerium/pomerium/pull/4000) (@dependabot[bot]) -- chore\(deps\): bump github.com/minio/minio-go/v7 from 7.0.47 to 7.0.50 [\#4081](https://github.com/pomerium/pomerium/pull/4081) (@dependabot[bot]) -- chore\(deps\): bump github.com/minio/minio-go/v7 from 7.0.50 to 7.0.52 [\#4128](https://github.com/pomerium/pomerium/pull/4128) (@dependabot[bot]) -- chore\(deps\): bump github.com/natefinch/atomic from 0.0.0-20200526193002-18c0533a5b09 to 1.0.1 [\#4021](https://github.com/pomerium/pomerium/pull/4021) (@dependabot[bot]) -- chore\(deps\): bump github.com/open-policy-agent/opa from 0.48.0 to 0.49.2 [\#4023](https://github.com/pomerium/pomerium/pull/4023) (@dependabot[bot]) -- chore\(deps\): bump github.com/open-policy-agent/opa from 0.49.2 to 0.50.0 [\#4056](https://github.com/pomerium/pomerium/pull/4056) (@dependabot[bot]) -- chore\(deps\): bump github.com/open-policy-agent/opa from 0.49.2 to 0.51.0 [\#4130](https://github.com/pomerium/pomerium/pull/4130) (@dependabot[bot]) -- chore\(deps\): bump github.com/open-policy-agent/opa from 0.50.0 to 0.50.1 [\#4072](https://github.com/pomerium/pomerium/pull/4072) (@dependabot[bot]) -- chore\(deps\): bump github.com/open-policy-agent/opa from 0.50.1 to 0.51.0 [\#4093](https://github.com/pomerium/pomerium/pull/4093) (@dependabot[bot]) -- chore\(deps\): bump github.com/opencontainers/runc from 1.1.2 to 1.1.5 [\#4088](https://github.com/pomerium/pomerium/pull/4088) (@dependabot[bot]) -- chore\(deps\): bump github.com/ory/dockertest/v3 from 3.9.1 to 3.10.0 [\#4111](https://github.com/pomerium/pomerium/pull/4111) (@dependabot[bot]) -- chore\(deps\): bump github.com/prometheus/client_golang from 1.14.0 to 1.15.0 [\#4110](https://github.com/pomerium/pomerium/pull/4110) (@dependabot[bot]) -- chore\(deps\): bump github.com/prometheus/common from 0.39.0 to 0.41.0 [\#4035](https://github.com/pomerium/pomerium/pull/4035) (@dependabot[bot]) -- chore\(deps\): bump github.com/rs/zerolog from 1.28.0 to 1.29.0 [\#3920](https://github.com/pomerium/pomerium/pull/3920) (@dependabot[bot]) -- chore\(deps\): bump github.com/rs/zerolog from 1.29.0 to 1.29.1 [\#4127](https://github.com/pomerium/pomerium/pull/4127) (@dependabot[bot]) -- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.23.1 to 3.23.2 [\#4037](https://github.com/pomerium/pomerium/pull/4037) (@dependabot[bot]) -- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.23.2 to 3.23.3 [\#4129](https://github.com/pomerium/pomerium/pull/4129) (@dependabot[bot]) -- chore\(deps\): bump github.com/spf13/viper from 1.14.0 to 1.15.0 [\#3910](https://github.com/pomerium/pomerium/pull/3910) (@dependabot[bot]) -- chore\(deps\): bump github.com/VictoriaMetrics/fastcache from 1.12.0 to 1.12.1 [\#4057](https://github.com/pomerium/pomerium/pull/4057) (@dependabot[bot]) -- chore\(deps\): bump github.com/yuin/gopher-lua from 0.0.0-20200816102855-ee81675732da to 1.1.0 [\#4022](https://github.com/pomerium/pomerium/pull/4022) (@dependabot[bot]) -- chore\(deps\): bump golang from `413cd9e` to `73c225b` [\#4114](https://github.com/pomerium/pomerium/pull/4114) (@dependabot[bot]) -- chore\(deps\): bump golang from `4447a7f` to `f8fbd74` [\#3969](https://github.com/pomerium/pomerium/pull/3969) (@dependabot[bot]) -- chore\(deps\): bump golang from `57dbdd5` to `97c3e1d` [\#4084](https://github.com/pomerium/pomerium/pull/4084) (@dependabot[bot]) -- chore\(deps\): bump golang from `d99d361` to `9628a1a` [\#4043](https://github.com/pomerium/pomerium/pull/4043) (@dependabot[bot]) -- chore\(deps\): bump golang from 1.19.5-buster to 1.20.0-buster [\#3949](https://github.com/pomerium/pomerium/pull/3949) (@dependabot[bot]) -- chore\(deps\): bump golang from 1.20.0-buster to 1.20.1-buster [\#3997](https://github.com/pomerium/pomerium/pull/3997) (@dependabot[bot]) -- chore\(deps\): bump golang from 1.20.1-buster to 1.20.2-buster [\#4060](https://github.com/pomerium/pomerium/pull/4060) (@dependabot[bot]) -- chore\(deps\): bump golang from 1.20.2-buster to 1.20.3-buster [\#4103](https://github.com/pomerium/pomerium/pull/4103) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/crypto from 0.6.0 to 0.7.0 [\#4038](https://github.com/pomerium/pomerium/pull/4038) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/crypto from 0.7.0 to 0.8.0 [\#4105](https://github.com/pomerium/pomerium/pull/4105) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/net from 0.6.0 to 0.7.0 [\#3993](https://github.com/pomerium/pomerium/pull/3993) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/oauth2 from 0.4.0 to 0.5.0 [\#3963](https://github.com/pomerium/pomerium/pull/3963) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/oauth2 from 0.5.0 to 0.6.0 [\#4036](https://github.com/pomerium/pomerium/pull/4036) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/oauth2 from 0.6.0 to 0.7.0 [\#4113](https://github.com/pomerium/pomerium/pull/4113) (@dependabot[bot]) -- chore\(deps\): bump google-github-actions/auth from 1.0.0 to 1.1.0 [\#4121](https://github.com/pomerium/pomerium/pull/4121) (@dependabot[bot]) -- chore\(deps\): bump google-github-actions/setup-gcloud from 1.0.1 to 1.1.0 [\#3943](https://github.com/pomerium/pomerium/pull/3943) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.107.0 to 0.108.0 [\#3913](https://github.com/pomerium/pomerium/pull/3913) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.108.0 to 0.109.0 [\#3940](https://github.com/pomerium/pomerium/pull/3940) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.109.0 to 0.110.0 [\#3999](https://github.com/pomerium/pomerium/pull/3999) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.112.0 to 0.114.0 [\#4096](https://github.com/pomerium/pomerium/pull/4096) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.114.0 to 0.116.0 [\#4104](https://github.com/pomerium/pomerium/pull/4104) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.116.0 to 0.118.0 [\#4112](https://github.com/pomerium/pomerium/pull/4112) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/grpc from 1.52.0 to 1.52.3 [\#3926](https://github.com/pomerium/pomerium/pull/3926) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/grpc from 1.52.3 to 1.53.0 [\#3965](https://github.com/pomerium/pomerium/pull/3965) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/grpc from 1.53.0 to 1.54.0 [\#4082](https://github.com/pomerium/pomerium/pull/4082) (@dependabot[bot]) -- chore\(deps\): bump goreleaser/goreleaser-action from 4.1.1 to 4.2.0 [\#3921](https://github.com/pomerium/pomerium/pull/3921) (@dependabot[bot]) -- chore\(deps\): bump mikefarah/yq from 4.30.8 to 4.31.1 [\#3994](https://github.com/pomerium/pomerium/pull/3994) (@dependabot[bot]) -- chore\(deps\): bump mikefarah/yq from 4.31.1 to 4.31.2 [\#4040](https://github.com/pomerium/pomerium/pull/4040) (@dependabot[bot]) -- chore\(deps\): bump mikefarah/yq from 4.31.2 to 4.32.2 [\#4066](https://github.com/pomerium/pomerium/pull/4066) (@dependabot[bot]) -- chore\(deps\): bump mikefarah/yq from 4.32.2 to 4.33.1 [\#4079](https://github.com/pomerium/pomerium/pull/4079) (@dependabot[bot]) -- chore\(deps\): bump mikefarah/yq from 4.33.1 to 4.33.3 [\#4109](https://github.com/pomerium/pomerium/pull/4109) (@dependabot[bot]) -- chore\(deps\): bump tibdex/github-app-token from 1.7.0 to 1.8.0 [\#3922](https://github.com/pomerium/pomerium/pull/3922) (@dependabot[bot]) -- dependencies: upgrade go and envoy [\#4116](https://github.com/pomerium/pomerium/pull/4116) (@calebdoxsey) - -## [v0.21.4](https://github.com/pomerium/pomerium/tree/v0.21.4) (2023-05-26) - -### Security - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.21.3...v0.21.4) - -- This release fixes a bug whereby specially crafted requests could result in incorrect authorization decisions made by Pomerium. [CVE-2023-33189](https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p). - -### Changed - -- authorize: fix IsInternal check by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4199 -- autocert: fix certmagic cache logging by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4135 - -## [v0.21.3](https://github.com/pomerium/pomerium/tree/v0.21.3) (2023-03-23) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.21.2...v0.21.3) - -### Changed - -- authorize: move sign out and jwks urls to route, update issuer for JWT [\#4049](https://github.com/pomerium/pomerium/pull/4049) (@backport-actions-token[bot]) -- ci: build version branch images [\#4062](https://github.com/pomerium/pomerium/pull/4062) (@backport-actions-token[bot]) -- hpke: move published public keys to a new endpoint [\#4048](https://github.com/pomerium/pomerium/pull/4048) (@backport-actions-token[bot]) - -## [v0.21.2](https://github.com/pomerium/pomerium/tree/v0.21.2) (2023-02-23) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.21.1...v0.21.2) - -### Changed - -- authenticate: fix identity provider id in encrypted query string [\#4011](https://github.com/pomerium/pomerium/pull/4011) (@backport-actions-token[bot]) -- authenticate: fix callback handler for split mode [\#4010](https://github.com/pomerium/pomerium/pull/4010) (@backport-actions-token[bot]) -- authenticate: don't require a session for sign_out [\#4009](https://github.com/pomerium/pomerium/pull/4009) (@backport-actions-token[bot]) -- authenticate: fix authenticate_internal_service_url for all in one [\#4005](https://github.com/pomerium/pomerium/pull/4005) (@backport-actions-token[bot]) -- derivecert: fix ecdsa code to be deterministic [\#3991](https://github.com/pomerium/pomerium/pull/3991) (@backport-actions-token[bot]) -- fix webauthn url [\#3988](https://github.com/pomerium/pomerium/pull/3988) (@backport-actions-token[bot]) -- webauthn: only return known device credentials that match the given type [\#3987](https://github.com/pomerium/pomerium/pull/3987) (@backport-actions-token[bot]) - -## [v0.21.1](https://github.com/pomerium/pomerium/releases/tag/v0.21.1) (2023-02-16) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.21.0...v0.21.1) - -### Changed - -- authenticate: save the session cookie with a different name by @calebdoxsey in https://github.com/pomerium/pomerium/pull/3984 -- lua: fix rewrite response headers to handle dashes in URLs by @calebdoxsey in https://github.com/pomerium/pomerium/pull/3986 - -## [v0.21.0](https://github.com/pomerium/pomerium/tree/v0.21.0) (2023-02-09) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.21.0-rc2...v0.21.0) - -### Changed - -- add google cloud creds to ignore [\#3907](https://github.com/pomerium/pomerium/pull/3907) (@backport-actions-token[bot]) -- authenticate: always trust the passed in idp [\#3931](https://github.com/pomerium/pomerium/pull/3931) (@backport-actions-token[bot]) -- controlplane: remove gorilla handlers dependency [\#3813](https://github.com/pomerium/pomerium/pull/3813) (@calebdoxsey) -- docker: switch to debian [\#3939](https://github.com/pomerium/pomerium/pull/3939) (@backport-actions-token[bot]) -- envoyconfig: clean up filter chain construction [\#3844](https://github.com/pomerium/pomerium/pull/3844) (@calebdoxsey) -- events: remove xds configuraton update [\#3792](https://github.com/pomerium/pomerium/pull/3792) (@wasaga) -- identity: fix nil reference error when there is no authenticator [\#3933](https://github.com/pomerium/pomerium/pull/3933) (@backport-actions-token[bot]) -- tls_derive: rename for consistency [\#3905](https://github.com/pomerium/pomerium/pull/3905) (@wasaga) -- use tlsClientConfig instead of custom dialer [\#3830](https://github.com/pomerium/pomerium/pull/3830) (@wasaga) - -### Breaking - -- proxy: add userinfo and webauthn endpoints [\#3755](https://github.com/pomerium/pomerium/pull/3755) (@calebdoxsey) -- remove forward auth [\#3628](https://github.com/pomerium/pomerium/pull/3628) (@calebdoxsey) - -### New - -- authenticate: add additional error details for hmac errors [\#3878](https://github.com/pomerium/pomerium/pull/3878) (@calebdoxsey) -- authenticate: implement hpke-based login flow [\#3779](https://github.com/pomerium/pomerium/pull/3779) (@calebdoxsey) -- authorize: log check\(\) error [\#3846](https://github.com/pomerium/pomerium/pull/3846) (@wasaga) -- auto tls [\#3856](https://github.com/pomerium/pomerium/pull/3856) (@wasaga) -- config: add option for tls renegotiation [\#3773](https://github.com/pomerium/pomerium/pull/3773) (@calebdoxsey) -- config: add support for extended TCP route URLs [\#3845](https://github.com/pomerium/pomerium/pull/3845) (@calebdoxsey) -- derive CA from pre-shared key [\#3815](https://github.com/pomerium/pomerium/pull/3815) (@wasaga) -- explicitly list gRPC services accessible via the gRPC listener [\#3879](https://github.com/pomerium/pomerium/pull/3879) (@wasaga) -- hpke: add HPKE key to JWKS endpoint [\#3762](https://github.com/pomerium/pomerium/pull/3762) (@calebdoxsey) -- hpke: add hpke package [\#3761](https://github.com/pomerium/pomerium/pull/3761) (@calebdoxsey) -- httputil: add cookie chunker [\#3775](https://github.com/pomerium/pomerium/pull/3775) (@calebdoxsey) -- httputil: ignore errors \< 400 [\#3781](https://github.com/pomerium/pomerium/pull/3781) (@calebdoxsey) -- identity: add identity profile [\#3777](https://github.com/pomerium/pomerium/pull/3777) (@calebdoxsey) -- mTLS: allow gRPC TLS for all in one [\#3854](https://github.com/pomerium/pomerium/pull/3854) (@wasaga) -- scripts: update get-envoy script to download all binaries [\#3886](https://github.com/pomerium/pomerium/pull/3886) (@calebdoxsey) -- urlutil: add time validation functions [\#3776](https://github.com/pomerium/pomerium/pull/3776) (@calebdoxsey) - -### Fixed - -- autocert: use atomic pointer to allow nil [\#3816](https://github.com/pomerium/pomerium/pull/3816) (@calebdoxsey) -- config: add missing options [\#3882](https://github.com/pomerium/pomerium/pull/3882) (@calebdoxsey) -- config: generate derived certificates instead of self-signed certificates [\#3860](https://github.com/pomerium/pomerium/pull/3860) (@calebdoxsey) -- config: use insecure skip verify if derived certificates are not used [\#3861](https://github.com/pomerium/pomerium/pull/3861) (@calebdoxsey) -- dashboard: fix missing avatar and logout menu [\#3819](https://github.com/pomerium/pomerium/pull/3819) (@calebdoxsey) -- identity: fix expired session deletion [\#3855](https://github.com/pomerium/pomerium/pull/3855) (@calebdoxsey) -- jwt: require logged in user to return .pomerium/jwt [\#3807](https://github.com/pomerium/pomerium/pull/3807) (@calebdoxsey) -- oidc: fix token revocation [\#3810](https://github.com/pomerium/pomerium/pull/3810) (@calebdoxsey) -- postgres: return unknown records instead of skipping them [\#3876](https://github.com/pomerium/pomerium/pull/3876) (@calebdoxsey) -- proxy: fix sign out redirect [\#3827](https://github.com/pomerium/pomerium/pull/3827) (@calebdoxsey) -- storage: ignore removed fields when deserializing the data [\#3768](https://github.com/pomerium/pomerium/pull/3768) (@wasaga) -- webauthn: require session when accessing /.pomerium/webauthn [\#3814](https://github.com/pomerium/pomerium/pull/3814) (@calebdoxsey) - -### Dependency - -- bump goreleaser to v4.1.1 [\#3919](https://github.com/pomerium/pomerium/pull/3919) (@backport-actions-token[bot]) -- chore\(deps\): bump actions/cache from 3.0.11 to 3.2.2 [\#3851](https://github.com/pomerium/pomerium/pull/3851) (@dependabot[bot]) -- chore\(deps\): bump actions/cache from 3.2.2 to 3.2.3 [\#3870](https://github.com/pomerium/pomerium/pull/3870) (@dependabot[bot]) -- chore\(deps\): bump actions/checkout from 3.1.0 to 3.2.0 [\#3833](https://github.com/pomerium/pomerium/pull/3833) (@dependabot[bot]) -- chore\(deps\): bump actions/checkout from 3.2.0 to 3.3.0 [\#3867](https://github.com/pomerium/pomerium/pull/3867) (@dependabot[bot]) -- chore\(deps\): bump actions/download-artifact from 3.0.1 to 3.0.2 [\#3872](https://github.com/pomerium/pomerium/pull/3872) (@dependabot[bot]) -- chore\(deps\): bump actions/setup-go from 3.3.1 to 3.4.0 [\#3788](https://github.com/pomerium/pomerium/pull/3788) (@dependabot[bot]) -- chore\(deps\): bump actions/setup-go from 3.4.0 to 3.5.0 [\#3836](https://github.com/pomerium/pomerium/pull/3836) (@dependabot[bot]) -- chore\(deps\): bump actions/setup-node from 3.5.1 to 3.6.0 [\#3869](https://github.com/pomerium/pomerium/pull/3869) (@dependabot[bot]) -- chore\(deps\): bump actions/setup-python from 4.3.0 to 4.3.1 [\#3800](https://github.com/pomerium/pomerium/pull/3800) (@dependabot[bot]) -- chore\(deps\): bump actions/setup-python from 4.3.1 to 4.4.0 [\#3834](https://github.com/pomerium/pomerium/pull/3834) (@dependabot[bot]) -- chore\(deps\): bump actions/setup-python from 4.4.0 to 4.5.0 [\#3896](https://github.com/pomerium/pomerium/pull/3896) (@dependabot[bot]) -- chore\(deps\): bump actions/stale from 5.1.1 to 6.0.1 [\#3790](https://github.com/pomerium/pomerium/pull/3790) (@dependabot[bot]) -- chore\(deps\): bump actions/stale from 6.0.1 to 7.0.0 [\#3852](https://github.com/pomerium/pomerium/pull/3852) (@dependabot[bot]) -- chore\(deps\): bump actions/upload-artifact from 3.1.1 to 3.1.2 [\#3871](https://github.com/pomerium/pomerium/pull/3871) (@dependabot[bot]) -- chore\(deps\): bump alpine from `8914eb5` to `f271e74` [\#3901](https://github.com/pomerium/pomerium/pull/3901) (@dependabot[bot]) -- chore\(deps\): bump alpine from `b95359c` to `8914eb5` [\#3802](https://github.com/pomerium/pomerium/pull/3802) (@dependabot[bot]) -- chore\(deps\): bump alpine from `bc41182` to `b95359c` [\#3751](https://github.com/pomerium/pomerium/pull/3751) (@dependabot[bot]) -- chore\(deps\): bump azure/docker-login from 81744f9799e7eaa418697cb168452a2882ae844a to 1.0.1 [\#3770](https://github.com/pomerium/pomerium/pull/3770) (@dependabot[bot]) -- chore\(deps\): bump debian from `7ca0fec` to `12931ad` [\#3904](https://github.com/pomerium/pomerium/pull/3904) (@dependabot[bot]) -- chore\(deps\): bump debian from `880aa5f` to `7ca0fec` [\#3841](https://github.com/pomerium/pomerium/pull/3841) (@dependabot[bot]) -- chore\(deps\): bump debian from `9583740` to `880aa5f` [\#3803](https://github.com/pomerium/pomerium/pull/3803) (@dependabot[bot]) -- chore\(deps\): bump distroless/base from `8848703` to `8ee3d86` [\#3874](https://github.com/pomerium/pomerium/pull/3874) (@dependabot[bot]) -- chore\(deps\): bump distroless/base from `8ee3d86` to `9eeffdc` [\#3903](https://github.com/pomerium/pomerium/pull/3903) (@dependabot[bot]) -- chore\(deps\): bump distroless/base from `9283685` to `8848703` [\#3842](https://github.com/pomerium/pomerium/pull/3842) (@dependabot[bot]) -- chore\(deps\): bump distroless/base from `cd1bf87` to `9283685` [\#3804](https://github.com/pomerium/pomerium/pull/3804) (@dependabot[bot]) -- chore\(deps\): bump docker/build-push-action from 3.2.0 to 3.3.0 [\#3894](https://github.com/pomerium/pomerium/pull/3894) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.4 to 1.18.5 [\#3825](https://github.com/pomerium/pomerium/pull/3825) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.5 to 1.18.7 [\#3838](https://github.com/pomerium/pomerium/pull/3838) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.7 to 1.18.8 [\#3900](https://github.com/pomerium/pomerium/pull/3900) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.29.5 to 1.29.6 [\#3847](https://github.com/pomerium/pomerium/pull/3847) (@dependabot[bot]) -- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.29.6 to 1.30.0 [\#3866](https://github.com/pomerium/pomerium/pull/3866) (@dependabot[bot]) -- chore\(deps\): bump github.com/cenkalti/backoff/v4 from 4.1.3 to 4.2.0 [\#3756](https://github.com/pomerium/pomerium/pull/3756) (@dependabot[bot]) -- chore\(deps\): bump github.com/cespare/xxhash/v2 from 2.1.2 to 2.2.0 [\#3786](https://github.com/pomerium/pomerium/pull/3786) (@dependabot[bot]) -- chore\(deps\): bump github.com/cloudflare/circl from 1.3.0 to 1.3.1 [\#3831](https://github.com/pomerium/pomerium/pull/3831) (@dependabot[bot]) -- chore\(deps\): bump github.com/coreos/go-oidc/v3 from 3.4.0 to 3.5.0 [\#3868](https://github.com/pomerium/pomerium/pull/3868) (@dependabot[bot]) -- chore\(deps\): bump github.com/docker/docker from 20.10.21+incompatible to 20.10.22+incompatible [\#3839](https://github.com/pomerium/pomerium/pull/3839) (@dependabot[bot]) -- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 0.8.0 to 0.9.0 [\#3744](https://github.com/pomerium/pomerium/pull/3744) (@dependabot[bot]) -- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 0.9.0 to 0.9.1 [\#3798](https://github.com/pomerium/pomerium/pull/3798) (@dependabot[bot]) -- chore\(deps\): bump github.com/go-chi/chi/v5 from 5.0.7 to 5.0.8 [\#3795](https://github.com/pomerium/pomerium/pull/3795) (@dependabot[bot]) -- chore\(deps\): bump github.com/jackc/pgtype from 1.12.0 to 1.13.0 [\#3784](https://github.com/pomerium/pomerium/pull/3784) (@dependabot[bot]) -- chore\(deps\): bump github.com/minio/minio-go/v7 from 7.0.39 to 7.0.45 [\#3796](https://github.com/pomerium/pomerium/pull/3796) (@dependabot[bot]) -- chore\(deps\): bump github.com/minio/minio-go/v7 from 7.0.45 to 7.0.46 [\#3864](https://github.com/pomerium/pomerium/pull/3864) (@dependabot[bot]) -- chore\(deps\): bump github.com/minio/minio-go/v7 from 7.0.46 to 7.0.47 [\#3899](https://github.com/pomerium/pomerium/pull/3899) (@dependabot[bot]) -- chore\(deps\): bump github.com/open-policy-agent/opa from 0.46.1 to 0.47.0 [\#3782](https://github.com/pomerium/pomerium/pull/3782) (@dependabot[bot]) -- chore\(deps\): bump github.com/open-policy-agent/opa from 0.47.0 to 0.47.3 [\#3824](https://github.com/pomerium/pomerium/pull/3824) (@dependabot[bot]) -- chore\(deps\): bump github.com/open-policy-agent/opa from 0.47.3 to 0.47.4 [\#3832](https://github.com/pomerium/pomerium/pull/3832) (@dependabot[bot]) -- chore\(deps\): bump github.com/open-policy-agent/opa from 0.47.4 to 0.48.0 [\#3898](https://github.com/pomerium/pomerium/pull/3898) (@dependabot[bot]) -- chore\(deps\): bump github.com/prometheus/client_golang from 1.13.1 to 1.14.0 [\#3745](https://github.com/pomerium/pomerium/pull/3745) (@dependabot[bot]) -- chore\(deps\): bump github.com/prometheus/common from 0.37.0 to 0.39.0 [\#3823](https://github.com/pomerium/pomerium/pull/3823) (@dependabot[bot]) -- chore\(deps\): bump github.com/prometheus/procfs from 0.8.0 to 0.9.0 [\#3850](https://github.com/pomerium/pomerium/pull/3850) (@dependabot[bot]) -- chore\(deps\): bump github.com/rs/cors from 1.8.2 to 1.8.3 [\#3848](https://github.com/pomerium/pomerium/pull/3848) (@dependabot[bot]) -- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.22.10 to 3.22.11 [\#3783](https://github.com/pomerium/pomerium/pull/3783) (@dependabot[bot]) -- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.22.11 to 3.22.12 [\#3849](https://github.com/pomerium/pomerium/pull/3849) (@dependabot[bot]) -- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.22.9 to 3.22.10 [\#3747](https://github.com/pomerium/pomerium/pull/3747) (@dependabot[bot]) -- chore\(deps\): bump go.uber.org/zap from 1.23.0 to 1.24.0 [\#3785](https://github.com/pomerium/pomerium/pull/3785) (@dependabot[bot]) -- chore\(deps\): bump golang from `e464bb0` to `7c97bae` [\#3843](https://github.com/pomerium/pomerium/pull/3843) (@dependabot[bot]) -- chore\(deps\): bump golang from 1.19.3-buster to 1.19.4-buster [\#3801](https://github.com/pomerium/pomerium/pull/3801) (@dependabot[bot]) -- chore\(deps\): bump golang from 1.19.4-buster to 1.19.5-buster [\#3902](https://github.com/pomerium/pomerium/pull/3902) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/crypto from 0.1.0 to 0.2.0 [\#3746](https://github.com/pomerium/pomerium/pull/3746) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/crypto from 0.2.0 to 0.3.0 [\#3757](https://github.com/pomerium/pomerium/pull/3757) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/crypto from 0.3.0 to 0.4.0 [\#3822](https://github.com/pomerium/pomerium/pull/3822) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/crypto from 0.4.0 to 0.5.0 [\#3873](https://github.com/pomerium/pomerium/pull/3873) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/net from 0.1.0 to 0.2.0 [\#3748](https://github.com/pomerium/pomerium/pull/3748) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/net from 0.2.0 to 0.4.0 [\#3799](https://github.com/pomerium/pomerium/pull/3799) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/net from 0.4.0 to 0.5.0 [\#3863](https://github.com/pomerium/pomerium/pull/3863) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/oauth2 from 0.3.0 to 0.4.0 [\#3865](https://github.com/pomerium/pomerium/pull/3865) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.102.0 to 0.103.0 [\#3758](https://github.com/pomerium/pomerium/pull/3758) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.103.0 to 0.104.0 [\#3797](https://github.com/pomerium/pomerium/pull/3797) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.104.0 to 0.105.0 [\#3840](https://github.com/pomerium/pomerium/pull/3840) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.105.0 to 0.107.0 [\#3897](https://github.com/pomerium/pomerium/pull/3897) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/grpc from 1.50.1 to 1.51.0 [\#3759](https://github.com/pomerium/pomerium/pull/3759) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/grpc from 1.51.0 to 1.52.0 [\#3893](https://github.com/pomerium/pomerium/pull/3893) (@dependabot[bot]) -- chore\(deps\): bump json5 from 2.2.0 to 2.2.3 in /ui [\#3853](https://github.com/pomerium/pomerium/pull/3853) (@dependabot[bot]) -- chore\(deps\): bump luxon from 2.3.0 to 2.5.2 in /ui [\#3862](https://github.com/pomerium/pomerium/pull/3862) (@dependabot[bot]) -- chore\(deps\): bump mikefarah/yq from 4.29.2 to 4.30.2 [\#3749](https://github.com/pomerium/pomerium/pull/3749) (@dependabot[bot]) -- chore\(deps\): bump mikefarah/yq from 4.30.2 to 4.30.5 [\#3787](https://github.com/pomerium/pomerium/pull/3787) (@dependabot[bot]) -- chore\(deps\): bump mikefarah/yq from 4.30.5 to 4.30.6 [\#3837](https://github.com/pomerium/pomerium/pull/3837) (@dependabot[bot]) -- chore\(deps\): bump mikefarah/yq from 4.30.6 to 4.30.8 [\#3895](https://github.com/pomerium/pomerium/pull/3895) (@dependabot[bot]) -- chore\(deps\): bump minimatch from 3.0.4 to 3.1.2 in /ui [\#3760](https://github.com/pomerium/pomerium/pull/3760) (@dependabot[bot]) -- chore\(deps\): bump stefanzweifel/git-auto-commit-action from 4.15.4 to 4.16.0 [\#3791](https://github.com/pomerium/pomerium/pull/3791) (@dependabot[bot]) -- chore\(deps\): bump tibdex/github-app-token from 1.6.0 to 1.7.0 [\#3789](https://github.com/pomerium/pomerium/pull/3789) (@dependabot[bot]) -- postgres: upgrade to pgx v5 [\#3826](https://github.com/pomerium/pomerium/pull/3826) (@calebdoxsey) -- upgrade to golang-lru v2 [\#3771](https://github.com/pomerium/pomerium/pull/3771) (@calebdoxsey) - -## [v0.20.1](https://github.com/pomerium/pomerium/tree/v0.20.1) (2023-05-26) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.20.0...v0.20.1) - -### Security - -- This release fixes a bug whereby specially crafted requests could result in incorrect authorization decisions made by Pomerium. [CVE-2023-33189](https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p). - -### Changed - -- autocert: use atomic pointer to allow nil by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3817 -- identity: fix expired session deletion by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3857 -- identity: fix nil reference error when there is no authenticator by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3932 -- jwt: require logged in user to return .pomerium/jwt by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3809 -- oidc: fix token revocation by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3818 -- postgres: return unknown records instead of skipping them (#3876) by @calebdoxsey in https://github.com/pomerium/pomerium/pull/3877 -- storage: ignore removed fields when deserializing the data by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3772 - -## [v0.20.0](https://github.com/pomerium/pomerium/tree/v0.20.0) (2022-11-14) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.19.1...v0.20.0) - -### Breaking - -- envoyconfig: add all routes to all filter chains [\#3596](https://github.com/pomerium/pomerium/pull/3596) (@calebdoxsey) -- groups via directory sync are no longer supported [\#3633](https://github.com/pomerium/pomerium/pull/3633) (@calebdoxsey) - -### Security - -- httputil: remove error details [\#3703](https://github.com/pomerium/pomerium/pull/3703) (@calebdoxsey) - -### New - -- authorize: fix user caching [\#3734](https://github.com/pomerium/pomerium/pull/3734) (@calebdoxsey) -- authorize: performance improvements [\#3723](https://github.com/pomerium/pomerium/pull/3723) (@calebdoxsey) -- config: disable Strict-Transport-Security when using a self-signed certificate [\#3743](https://github.com/pomerium/pomerium/pull/3743) (@calebdoxsey) -- config: generate cookie secret if not set in all-in-one mode [\#3742](https://github.com/pomerium/pomerium/pull/3742) (@calebdoxsey) -- config: default to http2 [\#3660](https://github.com/pomerium/pomerium/pull/3660) (@calebdoxsey) -- controlplane: move jwks.json endpoint to control plane [\#3691](https://github.com/pomerium/pomerium/pull/3691) (@calebdoxsey) -- postgres: increase record batch size [\#3708](https://github.com/pomerium/pomerium/pull/3708) (@calebdoxsey) -- sessions: check idp id to detect provider changes to force session invalidation [\#3707](https://github.com/pomerium/pomerium/pull/3707) (@calebdoxsey) - -### Fixed - -- authenticate: get/set identity provider id for all sessions [\#3597](https://github.com/pomerium/pomerium/pull/3597) (@calebdoxsey) -- authorize: enforce service account expiration [\#3661](https://github.com/pomerium/pomerium/pull/3661) (@calebdoxsey) -- config: allow blank identity providers when loading sessions for service account support [\#3709](https://github.com/pomerium/pomerium/pull/3709) (@calebdoxsey) -- config: disable envoy admin by default, expose stats via envoy route [\#3677](https://github.com/pomerium/pomerium/pull/3677) (@calebdoxsey) -- controlplane: fix /.well-known/pomerium missing CORS headers [\#3738](https://github.com/pomerium/pomerium/pull/3738) (@calebdoxsey) -- fileutil: update watcher to use fsnotify and polling [\#3663](https://github.com/pomerium/pomerium/pull/3663) (@calebdoxsey) -- postgres: return an empty list of addresses on dns errors [\#3637](https://github.com/pomerium/pomerium/pull/3637) (@calebdoxsey) -- ppl: support special characters in claim keys [\#3639](https://github.com/pomerium/pomerium/pull/3639) (@calebdoxsey) - -### Changed - -- add config option check logging [\#3722](https://github.com/pomerium/pomerium/pull/3722) (@wasaga) -- authenticate: remove ecjson [\#3688](https://github.com/pomerium/pomerium/pull/3688) (@calebdoxsey) -- authenticate: update user info dashboard to show group info for enterprise [\#3736](https://github.com/pomerium/pomerium/pull/3736) (@calebdoxsey) -- device: add generic methods for working with user+session devices [\#3710](https://github.com/pomerium/pomerium/pull/3710) (@calebdoxsey) -- envoyconfig: fix databroker health checks [\#3706](https://github.com/pomerium/pomerium/pull/3706) (@calebdoxsey) -- fix unused key warnings in routes [\#3711](https://github.com/pomerium/pomerium/pull/3711) (@wasaga) -- keep trace span context [\#3724](https://github.com/pomerium/pomerium/pull/3724) (@wasaga) -- postgres: handle unknown types [\#3632](https://github.com/pomerium/pomerium/pull/3632) (@calebdoxsey) -- test: use `T.TempDir` to create temporary test directory [\#3725](https://github.com/pomerium/pomerium/pull/3725) (@Juneezee) -- upgrade envoy to v1.23.1 [\#3599](https://github.com/pomerium/pomerium/pull/3599) (@calebdoxsey) - -### Dependency - -- bump Envoy to 1.23.2 [\#3739](https://github.com/pomerium/pomerium/pull/3739) (@wasaga) -- bump protoc to 3.21.7 [\#3646](https://github.com/pomerium/pomerium/pull/3646) (@wasaga) -- chore\(deps\): bump actions/cache from 3.0.10 to 3.0.11 [\#3671](https://github.com/pomerium/pomerium/pull/3671) (@dependabot[bot]) -- chore\(deps\): bump actions/cache from 3.0.8 to 3.0.10 [\#3642](https://github.com/pomerium/pomerium/pull/3642) (@dependabot[bot]) -- chore\(deps\): bump actions/checkout from 3.0.2 to 3.1.0 [\#3652](https://github.com/pomerium/pomerium/pull/3652) (@dependabot[bot]) -- chore\(deps\): bump actions/download-artifact from 3.0.0 to 3.0.1 [\#3700](https://github.com/pomerium/pomerium/pull/3700) (@dependabot[bot]) -- chore\(deps\): bump actions/setup-go from 3.3.0 to 3.3.1 [\#3681](https://github.com/pomerium/pomerium/pull/3681) (@dependabot[bot]) -- chore\(deps\): bump actions/setup-node from 3.4.1 to 3.5.0 [\#3641](https://github.com/pomerium/pomerium/pull/3641) (@dependabot[bot]) -- chore\(deps\): bump actions/setup-node from 3.5.0 to 3.5.1 [\#3672](https://github.com/pomerium/pomerium/pull/3672) (@dependabot[bot]) -- chore\(deps\): bump actions/setup-python from 4.2.0 to 4.3.0 [\#3651](https://github.com/pomerium/pomerium/pull/3651) (@dependabot[bot]) -- chore\(deps\): bump actions/upload-artifact from 3.1.0 to 3.1.1 [\#3698](https://github.com/pomerium/pomerium/pull/3698) (@dependabot[bot]) -- chore\(deps\): bump alpine from `bc41182` to `b95359c` [\#3751](https://github.com/pomerium/pomerium/pull/3751) (@dependabot[bot]) -- chore\(deps\): bump debian from `1b1d158` to `9583740` [\#3719](https://github.com/pomerium/pomerium/pull/3719) (@dependabot[bot]) -- chore\(deps\): bump debian from `3d2aa50` to `6005bd9` [\#3625](https://github.com/pomerium/pomerium/pull/3625) (@dependabot[bot]) -- chore\(deps\): bump debian from `6005bd9` to `1b1d158` [\#3656](https://github.com/pomerium/pomerium/pull/3656) (@dependabot[bot]) -- chore\(deps\): bump distroless/base from `4689543` to `6ef742b` [\#3654](https://github.com/pomerium/pomerium/pull/3654) (@dependabot[bot]) -- chore\(deps\): bump distroless/base from `59fe963` to `8a7afd5` [\#3627](https://github.com/pomerium/pomerium/pull/3627) (@dependabot[bot]) -- chore\(deps\): bump distroless/base from `65afaf8` to `59fe963` [\#3616](https://github.com/pomerium/pomerium/pull/3616) (@dependabot[bot]) -- chore\(deps\): bump distroless/base from `6ef742b` to `9681f07` [\#3676](https://github.com/pomerium/pomerium/pull/3676) (@dependabot[bot]) -- chore\(deps\): bump distroless/base from `856944e` to `cd1bf87` [\#3732](https://github.com/pomerium/pomerium/pull/3732) (@dependabot[bot]) -- chore\(deps\): bump distroless/base from `8a7afd5` to `4689543` [\#3647](https://github.com/pomerium/pomerium/pull/3647) (@dependabot[bot]) -- chore\(deps\): bump distroless/base from `9681f07` to `856944e` [\#3702](https://github.com/pomerium/pomerium/pull/3702) (@dependabot[bot]) -- chore\(deps\): bump docker/build-push-action from 3.1.1 to 3.2.0 [\#3673](https://github.com/pomerium/pomerium/pull/3673) (@dependabot[bot]) -- chore\(deps\): bump docker/login-action from 2.0.0 to 2.1.0 [\#3682](https://github.com/pomerium/pomerium/pull/3682) (@dependabot[bot]) -- chore\(deps\): bump docker/setup-buildx-action from 2.0.0 to 2.2.1 [\#3679](https://github.com/pomerium/pomerium/pull/3679) (@dependabot[bot]) -- chore\(deps\): bump docker/setup-qemu-action from 2.0.0 to 2.1.0 [\#3675](https://github.com/pomerium/pomerium/pull/3675) (@dependabot[bot]) -- chore\(deps\): bump github.com/caddyserver/certmagic from 0.16.3 to 0.17.0 [\#3604](https://github.com/pomerium/pomerium/pull/3604) (@dependabot[bot]) -- chore\(deps\): bump github.com/caddyserver/certmagic from 0.17.0 to 0.17.1 [\#3619](https://github.com/pomerium/pomerium/pull/3619) (@dependabot[bot]) -- chore\(deps\): bump github.com/caddyserver/certmagic from 0.17.1 to 0.17.2 [\#3644](https://github.com/pomerium/pomerium/pull/3644) (@dependabot[bot]) -- chore\(deps\): bump github.com/coreos/go-oidc/v3 from 3.2.0 to 3.3.0 [\#3605](https://github.com/pomerium/pomerium/pull/3605) (@dependabot[bot]) -- chore\(deps\): bump github.com/coreos/go-oidc/v3 from 3.3.0 to 3.4.0 [\#3612](https://github.com/pomerium/pomerium/pull/3612) (@dependabot[bot]) -- chore\(deps\): bump github.com/docker/docker from 20.10.17+incompatible to 20.10.18+incompatible [\#3614](https://github.com/pomerium/pomerium/pull/3614) (@dependabot[bot]) -- chore\(deps\): bump github.com/docker/docker from 20.10.18+incompatible to 20.10.19+incompatible [\#3666](https://github.com/pomerium/pomerium/pull/3666) (@dependabot[bot]) -- chore\(deps\): bump github.com/docker/docker from 20.10.19+incompatible to 20.10.20+incompatible [\#3694](https://github.com/pomerium/pomerium/pull/3694) (@dependabot[bot]) -- chore\(deps\): bump github.com/docker/docker from 20.10.20+incompatible to 20.10.21+incompatible [\#3712](https://github.com/pomerium/pomerium/pull/3712) (@dependabot[bot]) -- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 0.6.10 to 0.6.13 [\#3648](https://github.com/pomerium/pomerium/pull/3648) (@dependabot[bot]) -- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 0.6.13 to 0.8.0 [\#3731](https://github.com/pomerium/pomerium/pull/3731) (@dependabot[bot]) -- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 0.6.7 to 0.6.8 [\#3624](https://github.com/pomerium/pomerium/pull/3624) (@dependabot[bot]) -- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 0.6.8 to 0.6.10 [\#3630](https://github.com/pomerium/pomerium/pull/3630) (@dependabot[bot]) -- chore\(deps\): bump github.com/fsnotify/fsnotify from 1.5.4 to 1.6.0 [\#3713](https://github.com/pomerium/pomerium/pull/3713) (@dependabot[bot]) -- chore\(deps\): bump github.com/golangci/golangci-lint from 1.48.0 to 1.50.0 [\#3667](https://github.com/pomerium/pomerium/pull/3667) (@dependabot[bot]) -- chore\(deps\): bump github.com/golangci/golangci-lint from 1.50.0 to 1.50.1 [\#3697](https://github.com/pomerium/pomerium/pull/3697) (@dependabot[bot]) -- chore\(deps\): bump github.com/google/go-cmp from 0.5.8 to 0.5.9 [\#3611](https://github.com/pomerium/pomerium/pull/3611) (@dependabot[bot]) -- chore\(deps\): bump github.com/google/go-jsonnet from 0.18.0 to 0.19.1 [\#3715](https://github.com/pomerium/pomerium/pull/3715) (@dependabot[bot]) -- chore\(deps\): bump github.com/jackc/pgx/v4 from 4.17.1 to 4.17.2 [\#3603](https://github.com/pomerium/pomerium/pull/3603) (@dependabot[bot]) -- chore\(deps\): bump github.com/open-policy-agent/opa from 0.43.0 to 0.44.0 [\#3620](https://github.com/pomerium/pomerium/pull/3620) (@dependabot[bot]) -- chore\(deps\): bump github.com/open-policy-agent/opa from 0.44.0 to 0.45.0 [\#3650](https://github.com/pomerium/pomerium/pull/3650) (@dependabot[bot]) -- chore\(deps\): bump github.com/open-policy-agent/opa from 0.45.0 to 0.46.1 [\#3729](https://github.com/pomerium/pomerium/pull/3729) (@dependabot[bot]) -- chore\(deps\): bump github.com/openzipkin/zipkin-go from 0.4.0 to 0.4.1 [\#3668](https://github.com/pomerium/pomerium/pull/3668) (@dependabot[bot]) -- chore\(deps\): bump github.com/prometheus/client_model from 0.2.0 to 0.3.0 [\#3696](https://github.com/pomerium/pomerium/pull/3696) (@dependabot[bot]) -- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.22.7 to 3.22.8 [\#3606](https://github.com/pomerium/pomerium/pull/3606) (@dependabot[bot]) -- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.22.8 to 3.22.9 [\#3643](https://github.com/pomerium/pomerium/pull/3643) (@dependabot[bot]) -- chore\(deps\): bump github.com/spf13/viper from 1.12.0 to 1.13.0 [\#3613](https://github.com/pomerium/pomerium/pull/3613) (@dependabot[bot]) -- chore\(deps\): bump github.com/spf13/viper from 1.13.0 to 1.14.0 [\#3728](https://github.com/pomerium/pomerium/pull/3728) (@dependabot[bot]) -- chore\(deps\): bump github.com/stretchr/testify from 1.8.0 to 1.8.1 [\#3695](https://github.com/pomerium/pomerium/pull/3695) (@dependabot[bot]) -- chore\(deps\): bump github.com/VictoriaMetrics/fastcache from 1.10.0 to 1.12.0 [\#3623](https://github.com/pomerium/pomerium/pull/3623) (@dependabot[bot]) -- chore\(deps\): bump go.opencensus.io from 0.23.0 to 0.24.0 [\#3727](https://github.com/pomerium/pomerium/pull/3727) (@dependabot[bot]) -- chore\(deps\): bump golang from `403f389` to `b448089` [\#3718](https://github.com/pomerium/pomerium/pull/3718) (@dependabot[bot]) -- chore\(deps\): bump golang from `d71125b` to `4b2498d` [\#3626](https://github.com/pomerium/pomerium/pull/3626) (@dependabot[bot]) -- chore\(deps\): bump golang from 1.19.0-buster to 1.19.1-buster [\#3617](https://github.com/pomerium/pomerium/pull/3617) (@dependabot[bot]) -- chore\(deps\): bump golang from 1.19.1-buster to 1.19.2-buster [\#3655](https://github.com/pomerium/pomerium/pull/3655) (@dependabot[bot]) -- chore\(deps\): bump golang from 1.19.2-buster to 1.19.3-buster [\#3733](https://github.com/pomerium/pomerium/pull/3733) (@dependabot[bot]) -- chore\(deps\): bump golang.org/x/net from 0.1.0 to 0.2.0 [\#3748](https://github.com/pomerium/pomerium/pull/3748) (@dependabot[bot]) -- chore\(deps\): bump google-github-actions/setup-gcloud from 0.6.0 to 0.6.2 [\#3674](https://github.com/pomerium/pomerium/pull/3674) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.100.0 to 0.101.0 [\#3714](https://github.com/pomerium/pomerium/pull/3714) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.94.0 to 0.95.0 [\#3618](https://github.com/pomerium/pomerium/pull/3618) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.95.0 to 0.96.0 [\#3622](https://github.com/pomerium/pomerium/pull/3622) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.96.0 to 0.97.0 [\#3629](https://github.com/pomerium/pomerium/pull/3629) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.97.0 to 0.98.0 [\#3645](https://github.com/pomerium/pomerium/pull/3645) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.98.0 to 0.99.0 [\#3670](https://github.com/pomerium/pomerium/pull/3670) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/api from 0.99.0 to 0.100.0 [\#3693](https://github.com/pomerium/pomerium/pull/3693) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/grpc from 1.49.0 to 1.50.0 [\#3649](https://github.com/pomerium/pomerium/pull/3649) (@dependabot[bot]) -- chore\(deps\): bump google.golang.org/grpc from 1.50.0 to 1.50.1 [\#3669](https://github.com/pomerium/pomerium/pull/3669) (@dependabot[bot]) -- chore\(deps\): bump goreleaser/goreleaser-action from 3.1.0 to 3.2.0 [\#3680](https://github.com/pomerium/pomerium/pull/3680) (@dependabot[bot]) -- chore\(deps\): bump mikefarah/yq from 4.27.3 to 4.27.5 [\#3615](https://github.com/pomerium/pomerium/pull/3615) (@dependabot[bot]) -- chore\(deps\): bump mikefarah/yq from 4.27.5 to 4.28.1 [\#3653](https://github.com/pomerium/pomerium/pull/3653) (@dependabot[bot]) -- chore\(deps\): bump mikefarah/yq from 4.28.1 to 4.28.2 [\#3690](https://github.com/pomerium/pomerium/pull/3690) (@dependabot[bot]) -- chore\(deps\): bump mikefarah/yq from 4.28.2 to 4.29.2 [\#3717](https://github.com/pomerium/pomerium/pull/3717) (@dependabot[bot]) -- chore\(deps\): bump stefanzweifel/git-auto-commit-action from 4.14.1 to 4.15.0 [\#3631](https://github.com/pomerium/pomerium/pull/3631) (@dependabot[bot]) -- chore\(deps\): bump stefanzweifel/git-auto-commit-action from 4.15.0 to 4.15.1 [\#3658](https://github.com/pomerium/pomerium/pull/3658) (@dependabot[bot]) -- chore\(deps\): bump stefanzweifel/git-auto-commit-action from 4.15.1 to 4.15.2 [\#3699](https://github.com/pomerium/pomerium/pull/3699) (@dependabot[bot]) -- chore\(deps\): bump stefanzweifel/git-auto-commit-action from 4.15.2 to 4.15.3 [\#3716](https://github.com/pomerium/pomerium/pull/3716) (@dependabot[bot]) -- chore\(deps\): bump stefanzweifel/git-auto-commit-action from 4.15.3 to 4.15.4 [\#3726](https://github.com/pomerium/pomerium/pull/3726) (@dependabot[bot]) - -## [v0.19.2](https://github.com/pomerium/pomerium/tree/v0.19.2) (2023-05-26) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.19.1...v0.19.2) - -### Security - -- This release fixes a bug whereby specially crafted requests could result in incorrect authorization decisions made by Pomerium. [CVE-2023-33189](https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p). - -### Changed - -- authorize: enforce service account expiration by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3662 -- config: disable envoy admin by default, expose stats via envoy route by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3684 -- fileutil: update watcher to use fsnotify and polling (#3663) by @calebdoxsey in https://github.com/pomerium/pomerium/pull/3685 -- httputil: remove error details by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3705 -- postgres: return an empty list of addresses on dns errors by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3638 -- ppl: support special characters in claim keys by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3640 - -## [v0.19.1](https://github.com/pomerium/pomerium/tree/v0.19.1) (2022-09-08) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.19.0...v0.19.1) - -### Changed - -- [`c0a88707`](https://github.com/pomerium/pomerium/commit/c0a8870717ffc02f3083cdb191faa43c74077288) authenticate: get/set identity provider id for all sessions (#3608) -- [`c3ef43cd`](https://github.com/pomerium/pomerium/commit/c3ef43cdeda9a3dda88b82d69fc6c69059a71c5f) upgrade envoy to v1.23.1 (#3600) - -### Docker images - -- `docker pull pomerium/pomerium:v0.19.1` -- `docker pull pomerium/pomerium:nonroot-v0.19.1` -- `docker pull pomerium/pomerium:debug-v0.19.1` -- `docker pull pomerium/pomerium:debug-nonroot-v0.19.1` - -## [v0.19.0](https://github.com/pomerium/pomerium/tree/v0.19.0) (2022-09-01) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.18.0...v0.19.0) - -### New - -- add the traces error details [#3557](https://github.com/pomerium/pomerium/pull/3557) (@nhayfield) -- authorize: add policy error details for custom error messages [#3542](https://github.com/pomerium/pomerium/pull/3542) (@calebdoxsey) -- autocert: add support for ACME TLS-ALPN [#3590](https://github.com/pomerium/pomerium/pull/3590) (@calebdoxsey) -- config: add branding settings [#3558](https://github.com/pomerium/pomerium/pull/3558) (@calebdoxsey) -- controlplane: add well-known endpoint to the controlplane http handler [#3555](https://github.com/pomerium/pomerium/pull/3555) (@calebdoxsey) -- Dynamic style changes [#3544](https://github.com/pomerium/pomerium/pull/3544) (@nhayfield) -- envoy: upgrade to 1.23.0 [#3560](https://github.com/pomerium/pomerium/pull/3560) (@calebdoxsey) -- envoyconfig: add virtual host domains for certificates in addition to routes [#3593](https://github.com/pomerium/pomerium/pull/3593) (@calebdoxsey) - -### Fixed - -- add front end support for optional first paragraph of markdown on err... [#3546](https://github.com/pomerium/pomerium/pull/3546) (@nhayfield) -- atomicutil: use atomicutil.Value wherever possible [#3517](https://github.com/pomerium/pomerium/pull/3517) (@calebdoxsey) -- authenticate: add CORS headers to jwks endpoint [#3574](https://github.com/pomerium/pomerium/pull/3574) (@calebdoxsey) -- authenticate: fix branding for webauthn device registration page [#3572](https://github.com/pomerium/pomerium/pull/3572) (@calebdoxsey) -- authorize: handle user-unauthenticated response for deny blocks [#3559](https://github.com/pomerium/pomerium/pull/3559) (@calebdoxsey) -- envoyconfig: add authority header to outbound gRPC requests [#3545](https://github.com/pomerium/pomerium/pull/3545) (@calebdoxsey) -- Fix typos [#3575](https://github.com/pomerium/pomerium/pull/3575) (@alexrudd2) -- postgres: remove not null constraint on data column of record changes table [#3594](https://github.com/pomerium/pomerium/pull/3594) (@calebdoxsey) -- publish to any-distro [#3570](https://github.com/pomerium/pomerium/pull/3570) (@calebdoxsey) -- sets: convert set types to generics [#3519](https://github.com/pomerium/pomerium/pull/3519) (@calebdoxsey) -- Update README.md [#3569](https://github.com/pomerium/pomerium/pull/3569) (@cmo-pomerium) - -### Dependency - -- chore(deps): bump actions/cache from 3.0.5 to 3.0.6 [#3537](https://github.com/pomerium/pomerium/pull/3537) (@dependabot[bot]) -- chore(deps): bump actions/cache from 3.0.6 to 3.0.7 [#3552](https://github.com/pomerium/pomerium/pull/3552) (@dependabot[bot]) -- chore(deps): bump actions/cache from 3.0.7 to 3.0.8 [#3565](https://github.com/pomerium/pomerium/pull/3565) (@dependabot[bot]) -- chore(deps): bump actions/setup-go from 3.2.1 to 3.3.0 [#3583](https://github.com/pomerium/pomerium/pull/3583) (@dependabot[bot]) -- chore(deps): bump actions/setup-python from 4.1.0 to 4.2.0 [#3535](https://github.com/pomerium/pomerium/pull/3535) (@dependabot[bot]) -- chore(deps): bump actions/stale from 5.1.0 to 5.1.1 [#3513](https://github.com/pomerium/pomerium/pull/3513) (@dependabot[bot]) -- chore(deps): bump alpine from `6af1b11` to `7580ece` [#3512](https://github.com/pomerium/pomerium/pull/3512) (@dependabot[bot]) -- chore(deps): bump alpine from `7580ece` to `bc41182` [#3553](https://github.com/pomerium/pomerium/pull/3553) (@dependabot[bot]) -- chore(deps): bump contrib.go.opencensus.io/exporter/prometheus from 0.4.1 to 0.4.2 [#3586](https://github.com/pomerium/pomerium/pull/3586) (@dependabot[bot]) -- chore(deps): bump debian from `1c34464` to `4567e1e` [#3508](https://github.com/pomerium/pomerium/pull/3508) (@dependabot[bot]) -- chore(deps): bump debian from `4567e1e` to `b9b1f4a` [#3538](https://github.com/pomerium/pomerium/pull/3538) (@dependabot[bot]) -- chore(deps): bump debian from `b9b1f4a` to `3d2aa50` [#3588](https://github.com/pomerium/pomerium/pull/3588) (@dependabot[bot]) -- chore(deps): bump distroless/base from `3a62194` to `ec73486` [#3554](https://github.com/pomerium/pomerium/pull/3554) (@dependabot[bot]) -- chore(deps): bump distroless/base from `d6db599` to `3a62194` [#3511](https://github.com/pomerium/pomerium/pull/3511) (@dependabot[bot]) -- chore(deps): bump distroless/base from `ec73486` to `65afaf8` [#3568](https://github.com/pomerium/pomerium/pull/3568) (@dependabot[bot]) -- chore(deps): bump docker/build-push-action from 3.1.0 to 3.1.1 [#3536](https://github.com/pomerium/pomerium/pull/3536) (@dependabot[bot]) -- chore(deps): bump github.com/caddyserver/certmagic from 0.16.0 to 0.16.2 [#3532](https://github.com/pomerium/pomerium/pull/3532) (@dependabot[bot]) -- chore(deps): bump github.com/caddyserver/certmagic from 0.16.2 to 0.16.3 [#3563](https://github.com/pomerium/pomerium/pull/3563) (@dependabot[bot]) -- chore(deps): bump github.com/golangci/golangci-lint from 1.46.2 to 1.47.2 [#3499](https://github.com/pomerium/pomerium/pull/3499) (@dependabot[bot]) -- chore(deps): bump github.com/golangci/golangci-lint from 1.47.2 to 1.47.3 [#3522](https://github.com/pomerium/pomerium/pull/3522) (@dependabot[bot]) -- chore(deps): bump github.com/golangci/golangci-lint from 1.47.3 to 1.48.0 [#3541](https://github.com/pomerium/pomerium/pull/3541) (@dependabot[bot]) -- chore(deps): bump github.com/jackc/pgx/v4 from 4.16.1 to 4.17.0 [#3533](https://github.com/pomerium/pomerium/pull/3533) (@dependabot[bot]) -- chore(deps): bump github.com/jackc/pgx/v4 from 4.17.0 to 4.17.1 [#3582](https://github.com/pomerium/pomerium/pull/3582) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.42.2 to 0.43.0 [#3523](https://github.com/pomerium/pomerium/pull/3523) (@dependabot[bot]) -- chore(deps): bump github.com/peterbourgon/ff/v3 from 3.1.2 to 3.3.0 [#3540](https://github.com/pomerium/pomerium/pull/3540) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/client_golang from 1.12.2 to 1.13.0 [#3530](https://github.com/pomerium/pomerium/pull/3530) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/procfs from 0.7.3 to 0.8.0 [#3516](https://github.com/pomerium/pomerium/pull/3516) (@dependabot[bot]) -- chore(deps): bump github.com/rs/zerolog from 1.27.0 to 1.28.0 [#3587](https://github.com/pomerium/pomerium/pull/3587) (@dependabot[bot]) -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.22.6 to 3.22.7 [#3524](https://github.com/pomerium/pomerium/pull/3524) (@dependabot[bot]) -- chore(deps): bump go.uber.org/zap from 1.21.0 to 1.22.0 [#3551](https://github.com/pomerium/pomerium/pull/3551) (@dependabot[bot]) -- chore(deps): bump go.uber.org/zap from 1.22.0 to 1.23.0 [#3581](https://github.com/pomerium/pomerium/pull/3581) (@dependabot[bot]) -- chore(deps): bump golang from `6960d62` to `477b10a` [#3527](https://github.com/pomerium/pomerium/pull/3527) (@dependabot[bot]) -- chore(deps): bump golang from `a7a23f1` to `d84495e` [#3589](https://github.com/pomerium/pomerium/pull/3589) (@dependabot[bot]) -- chore(deps): bump golang from 1.18-buster to 1.18.4-buster [#3509](https://github.com/pomerium/pomerium/pull/3509) (@dependabot[bot]) -- chore(deps): bump golang from 1.18.4-buster to 1.19.0-buster [#3539](https://github.com/pomerium/pomerium/pull/3539) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.88.0 to 0.89.0 [#3514](https://github.com/pomerium/pomerium/pull/3514) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.89.0 to 0.90.0 [#3525](https://github.com/pomerium/pomerium/pull/3525) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.90.0 to 0.91.0 [#3531](https://github.com/pomerium/pomerium/pull/3531) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.91.0 to 0.92.0 [#3550](https://github.com/pomerium/pomerium/pull/3550) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.92.0 to 0.93.0 [#3562](https://github.com/pomerium/pomerium/pull/3562) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.93.0 to 0.94.0 [#3580](https://github.com/pomerium/pomerium/pull/3580) (@dependabot[bot]) -- chore(deps): bump google.golang.org/grpc from 1.48.0 to 1.49.0 [#3579](https://github.com/pomerium/pomerium/pull/3579) (@dependabot[bot]) -- chore(deps): bump google.golang.org/protobuf from 1.28.0 to 1.28.1 [#3515](https://github.com/pomerium/pomerium/pull/3515) (@dependabot[bot]) -- chore(deps): bump goreleaser/goreleaser-action from 3.0.0 to 3.1.0 [#3585](https://github.com/pomerium/pomerium/pull/3585) (@dependabot[bot]) -- chore(deps): bump mikefarah/yq from 4.26.1 to 4.27.2 [#3526](https://github.com/pomerium/pomerium/pull/3526) (@dependabot[bot]) -- chore(deps): bump mikefarah/yq from 4.27.2 to 4.27.3 [#3584](https://github.com/pomerium/pomerium/pull/3584) (@dependabot[bot]) -- chore(deps): bump pomerium/backport from a2e620de9fc4166f774ee2a389e170046cfad426 to 1.1.1 [#3564](https://github.com/pomerium/pomerium/pull/3564) (@dependabot[bot]) -- chore(deps): bump pre-commit/action from 876132a3c26aa072b09eab6c5395b4749eeb2435 to 3.0.0 [#3567](https://github.com/pomerium/pomerium/pull/3567) (@dependabot[bot]) -- chore(deps): bump tibdex/github-app-token from 1.5.1 to 1.6 [#3566](https://github.com/pomerium/pomerium/pull/3566) (@dependabot[bot]) -- deployment: update RELEASING.md [#3503](https://github.com/pomerium/pomerium/pull/3503) (@desimone) - -## [v0.18.1](https://github.com/pomerium/pomerium/tree/v0.18.1) (2023-05-26) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.18.0...v0.18.1) - -### Security - -- This release fixes a bug whereby specially crafted requests could result in incorrect authorization decisions made by Pomerium. [CVE-2023-33189](https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p). - -### Changed - -- publish to any-distro (#3570) by @calebdoxsey in https://github.com/pomerium/pomerium/pull/3571 -- postgres: remove not null constraint on data column of record changes table by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3595 - -## [v0.18.0](https://github.com/pomerium/pomerium/tree/v0.18.0) (2022-07-27) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.17.3...v0.18.0) - -### New - -- add databroker multi lease handlers [#3255](https://github.com/pomerium/pomerium/pull/3255) (@wasaga) -- add lease name to the log [#3498](https://github.com/pomerium/pomerium/pull/3498) (@wasaga) -- add metrics aggregation [#3452](https://github.com/pomerium/pomerium/pull/3452) (@wasaga) -- add x-request-id in responses [#3366](https://github.com/pomerium/pomerium/pull/3366) (@wasaga) -- allow pomerium to be embedded as a library [#3415](https://github.com/pomerium/pomerium/pull/3415) (@wasaga) -- authenticate: allow changing the authenticate service URL at runtime [#3378](https://github.com/pomerium/pomerium/pull/3378) (@calebdoxsey) -- authenticate: show the device enrolled page as the user info page [#3151](https://github.com/pomerium/pomerium/pull/3151) (@calebdoxsey) -- authorize: add name claim [#3238](https://github.com/pomerium/pomerium/pull/3238) (@calebdoxsey) -- authorize: track session and service account access date [#3220](https://github.com/pomerium/pomerium/pull/3220) (@calebdoxsey) -- authorize: use query instead of sync for databroker data [#3377](https://github.com/pomerium/pomerium/pull/3377) (@calebdoxsey) -- databroker: add support for field masks on Put [#3210](https://github.com/pomerium/pomerium/pull/3210) (@calebdoxsey) -- databroker: add support for putting multiple records [#3291](https://github.com/pomerium/pomerium/pull/3291) (@calebdoxsey) -- databroker: add support for query filtering [#3369](https://github.com/pomerium/pomerium/pull/3369) (@calebdoxsey) -- databroker: add support for syncing by type [#3412](https://github.com/pomerium/pomerium/pull/3412) (@calebdoxsey) -- directory: support non-base64 encoded service accounts [#3150](https://github.com/pomerium/pomerium/pull/3150) (@calebdoxsey) -- do not require idp set in the bootstrap config, as it may be later configured via the databroker [#3386](https://github.com/pomerium/pomerium/pull/3386) (@wasaga) -- eliminate global events manager [#3422](https://github.com/pomerium/pomerium/pull/3422) (@wasaga) -- envoy: upgrade to 1.21.1 [#3186](https://github.com/pomerium/pomerium/pull/3186) (@calebdoxsey) -- envoy: use typed extension protocol options for static bootstrap cluster [#3268](https://github.com/pomerium/pomerium/pull/3268) (@calebdoxsey) -- Expand PR template [#3403](https://github.com/pomerium/pomerium/pull/3403) (@alexfornuto) -- github: pin github actions [#3183](https://github.com/pomerium/pomerium/pull/3183) (@calebdoxsey) -- grpc: regenerate protobuf code [#3208](https://github.com/pomerium/pomerium/pull/3208) (@calebdoxsey) -- grpc: wait for connect to be ready before making calls [#3253](https://github.com/pomerium/pomerium/pull/3253) (@calebdoxsey) -- identity: batch directory updates [#3411](https://github.com/pomerium/pomerium/pull/3411) (@calebdoxsey) -- integration: add test for query string params [#3302](https://github.com/pomerium/pomerium/pull/3302) (@calebdoxsey) -- postgres: databroker storage backend [#3370](https://github.com/pomerium/pomerium/pull/3370) (@calebdoxsey) -- postgres: registry support [#3454](https://github.com/pomerium/pomerium/pull/3454) (@calebdoxsey) -- storage: add filter expressions, upgrade go to 1.18.1 [#3365](https://github.com/pomerium/pomerium/pull/3365) (@calebdoxsey) -- storage: add filtering to SyncLatest [#3368](https://github.com/pomerium/pomerium/pull/3368) (@calebdoxsey) -- try pinning docker dependency [#3185](https://github.com/pomerium/pomerium/pull/3185) (@calebdoxsey) -- ui: remove version [#3184](https://github.com/pomerium/pomerium/pull/3184) (@calebdoxsey) - -### Fixed - -- authenticate: fix debug and metrics endpoints [#3212](https://github.com/pomerium/pomerium/pull/3212) (@calebdoxsey) -- authenticate: fix internal service URL CORS check [#3279](https://github.com/pomerium/pomerium/pull/3279) (@calebdoxsey) -- authenticate: fix internal service URL dashboard redirect [#3305](https://github.com/pomerium/pomerium/pull/3305) (@calebdoxsey) -- authenticate: fix internal url with webauthn [#3194](https://github.com/pomerium/pomerium/pull/3194) (@calebdoxsey) -- authenticate: save session for bare webauthn redirects, consider external service URL to be a pomerium url [#3280](https://github.com/pomerium/pomerium/pull/3280) (@calebdoxsey) -- authorize: add request id to context [#3497](https://github.com/pomerium/pomerium/pull/3497) (@calebdoxsey) -- authorize: allow missing user for authorization [#3421](https://github.com/pomerium/pomerium/pull/3421) (@calebdoxsey) -- authorize: fix device synchronization [#3482](https://github.com/pomerium/pomerium/pull/3482) (@calebdoxsey) -- authorize: fix not found check [#3410](https://github.com/pomerium/pomerium/pull/3410) (@calebdoxsey) -- authorize: fix x-forwarded-uri [#3479](https://github.com/pomerium/pomerium/pull/3479) (@calebdoxsey) -- authorize: pass idp id for webauthn url, allow unauthenticated access to static files [#3282](https://github.com/pomerium/pomerium/pull/3282) (@calebdoxsey) -- authorize: show plain text error page for traefik and nginx [#3477](https://github.com/pomerium/pomerium/pull/3477) (@calebdoxsey) -- autocert: continue on error [#3476](https://github.com/pomerium/pomerium/pull/3476) (@calebdoxsey) -- config: fix DefaultTransport so it is still a \*http.Transport [#3257](https://github.com/pomerium/pomerium/pull/3257) (@calebdoxsey) -- databroker: fix in-memory backend deadlock [#3300](https://github.com/pomerium/pomerium/pull/3300) (@calebdoxsey) -- deployment: update syntax installing `dlv` in debug image [#3179](https://github.com/pomerium/pomerium/pull/3179) (@travisgroth) -- device enrollment: fix ip address [#3430](https://github.com/pomerium/pomerium/pull/3430) (@calebdoxsey) -- envoyconfig: prevent nil reproxy handler [#3345](https://github.com/pomerium/pomerium/pull/3345) (@wasaga) -- fix: close the ticker after opened [#3318](https://github.com/pomerium/pomerium/pull/3318) (@clwluvw) -- fix: The built binary file is missing "ui/dist/index.js" and "ui/dist... [#3391](https://github.com/pomerium/pomerium/pull/3391) (@cfanbo) -- github: fix missing groups [#3171](https://github.com/pomerium/pomerium/pull/3171) (@calebdoxsey) -- httputil/reproxy: fix policy transport [#3322](https://github.com/pomerium/pomerium/pull/3322) (@calebdoxsey) -- options: fix overlapping certificate test [#3492](https://github.com/pomerium/pomerium/pull/3492) (@calebdoxsey) -- postgres: fix CIDR query [#3389](https://github.com/pomerium/pomerium/pull/3389) (@calebdoxsey) -- postgres: fix record deletion [#3446](https://github.com/pomerium/pomerium/pull/3446) (@calebdoxsey) -- userinfo: embed assets as data URLs for forward auth [#3460](https://github.com/pomerium/pomerium/pull/3460) (@calebdoxsey) -- userinfo: fix missing profile picture [#3154](https://github.com/pomerium/pomerium/pull/3154) (@calebdoxsey) - -### Dependency - -- bump envoy to 1.21.3 [#3413](https://github.com/pomerium/pomerium/pull/3413) (@wasaga) -- chore(deps): bump actions/cache from 2 to 3 [#3167](https://github.com/pomerium/pomerium/pull/3167) (@dependabot[bot]) -- chore(deps): bump actions/cache from 3.0.0 to 3.0.1 [#3235](https://github.com/pomerium/pomerium/pull/3235) (@dependabot[bot]) -- chore(deps): bump actions/cache from 3.0.1 to 3.0.2 [#3265](https://github.com/pomerium/pomerium/pull/3265) (@dependabot[bot]) -- chore(deps): bump actions/cache from 3.0.2 to 3.0.3 [#3399](https://github.com/pomerium/pomerium/pull/3399) (@dependabot[bot]) -- chore(deps): bump actions/cache from 3.0.3 to 3.0.4 [#3440](https://github.com/pomerium/pomerium/pull/3440) (@dependabot[bot]) -- chore(deps): bump actions/cache from 3.0.4 to 3.0.5 [#3489](https://github.com/pomerium/pomerium/pull/3489) (@dependabot[bot]) -- chore(deps): bump actions/checkout from 3.0.0 to 3.0.1 [#3275](https://github.com/pomerium/pomerium/pull/3275) (@dependabot[bot]) -- chore(deps): bump actions/checkout from 3.0.1 to 3.0.2 [#3297](https://github.com/pomerium/pomerium/pull/3297) (@dependabot[bot]) -- chore(deps): bump actions/download-artifact from 2.1.0 to 3 [#3202](https://github.com/pomerium/pomerium/pull/3202) (@dependabot[bot]) -- chore(deps): bump actions/setup-go from 2.2.0 to 3 [#3204](https://github.com/pomerium/pomerium/pull/3204) (@dependabot[bot]) -- chore(deps): bump actions/setup-go from 3.0.0 to 3.1.0 [#3362](https://github.com/pomerium/pomerium/pull/3362) (@dependabot[bot]) -- chore(deps): bump actions/setup-go from 3.1.0 to 3.2.0 [#3384](https://github.com/pomerium/pomerium/pull/3384) (@dependabot[bot]) -- chore(deps): bump actions/setup-go from 3.2.0 to 3.2.1 [#3470](https://github.com/pomerium/pomerium/pull/3470) (@dependabot[bot]) -- chore(deps): bump actions/setup-node from 3.0.0 to 3.1.0 [#3236](https://github.com/pomerium/pomerium/pull/3236) (@dependabot[bot]) -- chore(deps): bump actions/setup-node from 3.1.0 to 3.1.1 [#3267](https://github.com/pomerium/pomerium/pull/3267) (@dependabot[bot]) -- chore(deps): bump actions/setup-node from 3.1.1 to 3.2.0 [#3363](https://github.com/pomerium/pomerium/pull/3363) (@dependabot[bot]) -- chore(deps): bump actions/setup-node from 3.2.0 to 3.3.0 [#3400](https://github.com/pomerium/pomerium/pull/3400) (@dependabot[bot]) -- chore(deps): bump actions/setup-node from 3.3.0 to 3.4.0 [#3471](https://github.com/pomerium/pomerium/pull/3471) (@dependabot[bot]) -- chore(deps): bump actions/setup-node from 3.4.0 to 3.4.1 [#3490](https://github.com/pomerium/pomerium/pull/3490) (@dependabot[bot]) -- chore(deps): bump actions/setup-python from 3.0.0 to 3.1.0 [#3234](https://github.com/pomerium/pomerium/pull/3234) (@dependabot[bot]) -- chore(deps): bump actions/setup-python from 3.1.0 to 3.1.2 [#3266](https://github.com/pomerium/pomerium/pull/3266) (@dependabot[bot]) -- chore(deps): bump actions/setup-python from 3.1.2 to 4 [#3439](https://github.com/pomerium/pomerium/pull/3439) (@dependabot[bot]) -- chore(deps): bump actions/setup-python from 4.0.0 to 4.1.0 [#3472](https://github.com/pomerium/pomerium/pull/3472) (@dependabot[bot]) -- chore(deps): bump actions/stale from 5.0.0 to 5.1.0 [#3488](https://github.com/pomerium/pomerium/pull/3488) (@dependabot[bot]) -- chore(deps): bump actions/upload-artifact from 2.3.1 to 3 [#3203](https://github.com/pomerium/pomerium/pull/3203) (@dependabot[bot]) -- chore(deps): bump actions/upload-artifact from 3.0.0 to 3.1.0 [#3374](https://github.com/pomerium/pomerium/pull/3374) (@dependabot[bot]) -- chore(deps): bump async from 2.6.3 to 2.6.4 [#3278](https://github.com/pomerium/pomerium/pull/3278) (@dependabot[bot]) -- chore(deps): bump contrib.go.opencensus.io/exporter/prometheus from 0.4.0 to 0.4.1 [#3164](https://github.com/pomerium/pomerium/pull/3164) (@dependabot[bot]) -- chore(deps): bump docker/build-push-action from 2.10.0 to 3 [#3336](https://github.com/pomerium/pomerium/pull/3336) (@dependabot[bot]) -- chore(deps): bump docker/build-push-action from 3.0.0 to 3.1.0 [#3501](https://github.com/pomerium/pomerium/pull/3501) (@dependabot[bot]) -- chore(deps): bump docker/login-action from 1.14.1 to 2 [#3338](https://github.com/pomerium/pomerium/pull/3338) (@dependabot[bot]) -- chore(deps): bump docker/setup-buildx-action from 1.6.0 to 1.7.0 [#3317](https://github.com/pomerium/pomerium/pull/3317) (@dependabot[bot]) -- chore(deps): bump docker/setup-buildx-action from 1.7.0 to 2 [#3337](https://github.com/pomerium/pomerium/pull/3337) (@dependabot[bot]) -- chore(deps): bump docker/setup-qemu-action from 1.2.0 to 2 [#3339](https://github.com/pomerium/pomerium/pull/3339) (@dependabot[bot]) -- chore(deps): bump eventsource from 1.1.0 to 1.1.1 [#3388](https://github.com/pomerium/pomerium/pull/3388) (@dependabot[bot]) -- chore(deps): bump github.com/caddyserver/certmagic from 0.15.3 to 0.15.4 [#3143](https://github.com/pomerium/pomerium/pull/3143) (@dependabot[bot]) -- chore(deps): bump github.com/caddyserver/certmagic from 0.15.4 to 0.16.0 [#3198](https://github.com/pomerium/pomerium/pull/3198) (@dependabot[bot]) -- chore(deps): bump github.com/cenkalti/backoff/v4 from 4.1.2 to 4.1.3 [#3264](https://github.com/pomerium/pomerium/pull/3264) (@dependabot[bot]) -- chore(deps): bump github.com/coreos/go-oidc/v3 from 3.1.0 to 3.2.0 [#3360](https://github.com/pomerium/pomerium/pull/3360) (@dependabot[bot]) -- chore(deps): bump github.com/docker/docker from 20.10.12+incompatible to 20.10.13+incompatible [#3142](https://github.com/pomerium/pomerium/pull/3142) (@dependabot[bot]) -- chore(deps): bump github.com/docker/docker from 20.10.13+incompatible to 20.10.14+incompatible [#3199](https://github.com/pomerium/pomerium/pull/3199) (@dependabot[bot]) -- chore(deps): bump github.com/docker/docker from 20.10.14+incompatible to 20.10.15+incompatible [#3335](https://github.com/pomerium/pomerium/pull/3335) (@dependabot[bot]) -- chore(deps): bump github.com/docker/docker from 20.10.15+incompatible to 20.10.16+incompatible [#3359](https://github.com/pomerium/pomerium/pull/3359) (@dependabot[bot]) -- chore(deps): bump github.com/docker/docker from 20.10.16+incompatible to 20.10.17+incompatible [#3417](https://github.com/pomerium/pomerium/pull/3417) (@dependabot[bot]) -- chore(deps): bump github.com/fsnotify/fsnotify from 1.5.1 to 1.5.4 [#3312](https://github.com/pomerium/pomerium/pull/3312) (@dependabot[bot]) -- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.4 to 8.11.5 [#3166](https://github.com/pomerium/pomerium/pull/3166) (@dependabot[bot]) -- chore(deps): bump github.com/golangci/golangci-lint from 1.44.2 to 1.45.0 [#3162](https://github.com/pomerium/pomerium/pull/3162) (@dependabot[bot]) -- chore(deps): bump github.com/golangci/golangci-lint from 1.45.0 to 1.45.2 [#3200](https://github.com/pomerium/pomerium/pull/3200) (@dependabot[bot]) -- chore(deps): bump github.com/golangci/golangci-lint from 1.45.2 to 1.46.0 [#3334](https://github.com/pomerium/pomerium/pull/3334) (@dependabot[bot]) -- chore(deps): bump github.com/golangci/golangci-lint from 1.46.0 to 1.46.1 [#3357](https://github.com/pomerium/pomerium/pull/3357) (@dependabot[bot]) -- chore(deps): bump github.com/golangci/golangci-lint from 1.46.1 to 1.46.2 [#3373](https://github.com/pomerium/pomerium/pull/3373) (@dependabot[bot]) -- chore(deps): bump github.com/google/btree from 1.0.1 to 1.1.1 [#3402](https://github.com/pomerium/pomerium/pull/3402) (@dependabot[bot]) -- chore(deps): bump github.com/google/btree from 1.1.1 to 1.1.2 [#3434](https://github.com/pomerium/pomerium/pull/3434) (@dependabot[bot]) -- chore(deps): bump github.com/google/go-cmp from 0.5.7 to 0.5.8 [#3315](https://github.com/pomerium/pomerium/pull/3315) (@dependabot[bot]) -- chore(deps): bump github.com/martinlindhe/base36 from 1.1.0 to 1.1.1 [#3437](https://github.com/pomerium/pomerium/pull/3437) (@dependabot[bot]) -- chore(deps): bump github.com/mholt/acmez from 1.0.2 to 1.0.3 [#3469](https://github.com/pomerium/pomerium/pull/3469) (@dependabot[bot]) -- chore(deps): bump github.com/mitchellh/mapstructure from 1.4.3 to 1.5.0 [#3292](https://github.com/pomerium/pomerium/pull/3292) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.38.0 to 0.38.1 [#3144](https://github.com/pomerium/pomerium/pull/3144) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.38.1 to 0.39.0 [#3232](https://github.com/pomerium/pomerium/pull/3232) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.39.0 to 0.40.0 [#3311](https://github.com/pomerium/pomerium/pull/3311) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.40.0 to 0.41.0 [#3395](https://github.com/pomerium/pomerium/pull/3395) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.41.0 to 0.42.1 [#3468](https://github.com/pomerium/pomerium/pull/3468) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.42.1 to 0.42.2 [#3483](https://github.com/pomerium/pomerium/pull/3483) (@dependabot[bot]) -- chore(deps): bump github.com/ory/dockertest/v3 from 3.8.1 to 3.9.1 [#3381](https://github.com/pomerium/pomerium/pull/3381) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/client_golang from 1.12.1 to 1.12.2 [#3358](https://github.com/pomerium/pomerium/pull/3358) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/common from 0.32.1 to 0.33.0 [#3230](https://github.com/pomerium/pomerium/pull/3230) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/common from 0.33.0 to 0.34.0 [#3298](https://github.com/pomerium/pomerium/pull/3298) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/common from 0.34.0 to 0.35.0 [#3438](https://github.com/pomerium/pomerium/pull/3438) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/common from 0.35.0 to 0.37.0 [#3486](https://github.com/pomerium/pomerium/pull/3486) (@dependabot[bot]) -- chore(deps): bump github.com/rs/zerolog from 1.26.1 to 1.27.0 [#3418](https://github.com/pomerium/pomerium/pull/3418) (@dependabot[bot]) -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.22.2 to 3.22.3 [#3231](https://github.com/pomerium/pomerium/pull/3231) (@dependabot[bot]) -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.22.3 to 3.22.4 [#3313](https://github.com/pomerium/pomerium/pull/3313) (@dependabot[bot]) -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.22.4 to 3.22.5 [#3396](https://github.com/pomerium/pomerium/pull/3396) (@dependabot[bot]) -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.22.5 to 3.22.6 [#3464](https://github.com/pomerium/pomerium/pull/3464) (@dependabot[bot]) -- chore(deps): bump github.com/spf13/viper from 1.10.1 to 1.11.0 [#3273](https://github.com/pomerium/pomerium/pull/3273) (@dependabot[bot]) -- chore(deps): bump github.com/spf13/viper from 1.11.0 to 1.12.0 [#3380](https://github.com/pomerium/pomerium/pull/3380) (@dependabot[bot]) -- chore(deps): bump github.com/stretchr/testify from 1.7.0 to 1.7.1 [#3165](https://github.com/pomerium/pomerium/pull/3165) (@dependabot[bot]) -- chore(deps): bump github.com/stretchr/testify from 1.7.1 to 1.7.2 [#3397](https://github.com/pomerium/pomerium/pull/3397) (@dependabot[bot]) -- chore(deps): bump github.com/stretchr/testify from 1.7.2 to 1.7.3 [#3435](https://github.com/pomerium/pomerium/pull/3435) (@dependabot[bot]) -- chore(deps): bump github.com/stretchr/testify from 1.7.3 to 1.7.5 [#3448](https://github.com/pomerium/pomerium/pull/3448) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.70.0 to 0.72.0 [#3152](https://github.com/pomerium/pomerium/pull/3152) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.72.0 to 0.73.0 [#3163](https://github.com/pomerium/pomerium/pull/3163) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.73.0 to 0.74.0 [#3233](https://github.com/pomerium/pomerium/pull/3233) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.74.0 to 0.75.0 [#3296](https://github.com/pomerium/pomerium/pull/3296) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.75.0 to 0.77.0 [#3314](https://github.com/pomerium/pomerium/pull/3314) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.77.0 to 0.79.0 [#3347](https://github.com/pomerium/pomerium/pull/3347) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.79.0 to 0.80.0 [#3372](https://github.com/pomerium/pomerium/pull/3372) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.80.0 to 0.81.0 [#3382](https://github.com/pomerium/pomerium/pull/3382) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.81.0 to 0.82.0 [#3401](https://github.com/pomerium/pomerium/pull/3401) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.82.0 to 0.83.0 [#3416](https://github.com/pomerium/pomerium/pull/3416) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.83.0 to 0.84.0 [#3436](https://github.com/pomerium/pomerium/pull/3436) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.84.0 to 0.85.0 [#3447](https://github.com/pomerium/pomerium/pull/3447) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.85.0 to 0.86.0 [#3463](https://github.com/pomerium/pomerium/pull/3463) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.86.0 to 0.87.0 [#3484](https://github.com/pomerium/pomerium/pull/3484) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.87.0 to 0.88.0 [#3500](https://github.com/pomerium/pomerium/pull/3500) (@dependabot[bot]) -- chore(deps): bump google.golang.org/grpc from 1.44.0 to 1.45.0 [#3141](https://github.com/pomerium/pomerium/pull/3141) (@dependabot[bot]) -- chore(deps): bump google.golang.org/grpc from 1.45.0 to 1.46.0 [#3294](https://github.com/pomerium/pomerium/pull/3294) (@dependabot[bot]) -- chore(deps): bump google.golang.org/grpc from 1.46.0 to 1.46.2 [#3361](https://github.com/pomerium/pomerium/pull/3361) (@dependabot[bot]) -- chore(deps): bump google.golang.org/grpc from 1.46.2 to 1.47.0 [#3393](https://github.com/pomerium/pomerium/pull/3393) (@dependabot[bot]) -- chore(deps): bump google.golang.org/grpc from 1.47.0 to 1.48.0 [#3487](https://github.com/pomerium/pomerium/pull/3487) (@dependabot[bot]) -- chore(deps): bump google.golang.org/protobuf from 1.27.1 to 1.28.0 [#3197](https://github.com/pomerium/pomerium/pull/3197) (@dependabot[bot]) -- chore(deps): bump gopkg.in/yaml.v3 from 3.0.0 to 3.0.1 [#3394](https://github.com/pomerium/pomerium/pull/3394) (@dependabot[bot]) -- chore(deps): bump goreleaser/goreleaser-action from 2.9.1 to 3 [#3375](https://github.com/pomerium/pomerium/pull/3375) (@dependabot[bot]) -- chore(deps): bump jandelgado/gcov2lcov-action from 1.0.8 to 1.0.9 [#3376](https://github.com/pomerium/pomerium/pull/3376) (@dependabot[bot]) -- chore(deps): bump jandelgado/gcov2lcov-action from fc567b789b78d676959759edfb9b7a30e884fc1d to 1.0.9 [#3385](https://github.com/pomerium/pomerium/pull/3385) (@dependabot[bot]) -- chore(deps): bump mikefarah/yq from 4.21.1 to 4.22.1 [#3145](https://github.com/pomerium/pomerium/pull/3145) (@dependabot[bot]) -- chore(deps): bump mikefarah/yq from 4.22.1 to 4.23.1 [#3168](https://github.com/pomerium/pomerium/pull/3168) (@dependabot[bot]) -- chore(deps): bump mikefarah/yq from 4.23.1 to 4.24.2 [#3201](https://github.com/pomerium/pomerium/pull/3201) (@dependabot[bot]) -- chore(deps): bump mikefarah/yq from 4.24.2 to 4.24.5 [#3276](https://github.com/pomerium/pomerium/pull/3276) (@dependabot[bot]) -- chore(deps): bump mikefarah/yq from 4.24.5 to 4.25.1 [#3316](https://github.com/pomerium/pomerium/pull/3316) (@dependabot[bot]) -- chore(deps): bump mikefarah/yq from 4.25.1 to 4.25.2 [#3383](https://github.com/pomerium/pomerium/pull/3383) (@dependabot[bot]) -- chore(deps): bump mikefarah/yq from 4.25.2 to 4.25.3 [#3449](https://github.com/pomerium/pomerium/pull/3449) (@dependabot[bot]) -- chore(deps): bump mikefarah/yq from 4.25.3 to 4.26.1 [#3491](https://github.com/pomerium/pomerium/pull/3491) (@dependabot[bot]) -- chore(deps): bump minimist from 1.2.5 to 1.2.6 [#3189](https://github.com/pomerium/pomerium/pull/3189) (@dependabot[bot]) -- chore(deps): bump minimist from 1.2.5 to 1.2.6 in /ui [#3188](https://github.com/pomerium/pomerium/pull/3188) (@dependabot[bot]) -- chore(deps): bump stefanzweifel/git-auto-commit-action from 4.14.0 to 4.14.1 [#3274](https://github.com/pomerium/pomerium/pull/3274) (@dependabot[bot]) -- deps: bump backport action version [#3224](https://github.com/pomerium/pomerium/pull/3224) (@travisgroth) -- use generic version of btree [#3404](https://github.com/pomerium/pomerium/pull/3404) (@wasaga) - -### Changes - -- Allow docs changes without review [#3242](https://github.com/pomerium/pomerium/pull/3242) (@alexfornuto) -- ci: use forked backport to copy original PR labels [#3223](https://github.com/pomerium/pomerium/pull/3223) (@travisgroth) -- databroker: support rotating shared secret [#3502](https://github.com/pomerium/pomerium/pull/3502) (@calebdoxsey) -- deployment: remove vals based entrypoint [#3254](https://github.com/pomerium/pomerium/pull/3254) (@travisgroth) -- deployment: remove vals based entrypoint [#3254](https://github.com/pomerium/pomerium/pull/3254) (@travisgroth) -- docs: fix a typo in auth0 config example [#3332](https://github.com/pomerium/pomerium/pull/3332) (@imlonghao) -- docs: update changelog and upgrade notes for enterprise v0.17 [#3105](https://github.com/pomerium/pomerium/pull/3105) (@travisgroth) -- github-actions: build docker platforms together [#3426](https://github.com/pomerium/pomerium/pull/3426) (@calebdoxsey) -- replace fmt.Sprintf with net.JoinHostPort [#3407](https://github.com/pomerium/pomerium/pull/3407) (@cfanbo) -- Revert "databroker: add support for field masks on Put" [#3217](https://github.com/pomerium/pomerium/pull/3217) (@calebdoxsey) -- Revert "userinfo: embed assets as data URLs for forward auth" [#3474](https://github.com/pomerium/pomerium/pull/3474) (@calebdoxsey) - -## [v0.17.4](https://github.com/pomerium/pomerium/tree/v0.17.4) (2023-05-26) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.17.3...v0.17.4) - -### Security - -- This release fixes a bug whereby specially crafted requests could result in incorrect authorization decisions made by Pomerium. [CVE-2023-33189](https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p). - -## [v0.17.3](https://github.com/pomerium/pomerium/tree/v0.17.3) (2023-05-05) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.17.2...v0.17.3) - -### Changes - -- authenticate: fix internal service URL CORS check by @calebdoxsey in [https://github.com/pomerium/pomerium/pull/3328](https://github.com/pomerium/pomerium/pull/3328) -- authenticate: fix internal service URL dashboard redirect by @calebdoxsey in [https://github.com/pomerium/pomerium/pull/3306](https://github.com/pomerium/pomerium/pull/3306) -- DOCS: Add device identity video [https://github.com/pomerium/pomerium/pull/3307](https://github.com/pomerium/pomerium/pull/3307) -- DOCS: Update changelog [https://github.com/pomerium/pomerium/pull/3308](https://github.com/pomerium/pomerium/pull/3308) -- DOCS: update helm values file [https://github.com/pomerium/pomerium/pull/3287](https://github.com/pomerium/pomerium/pull/3287) -- fix: close the ticker after opened by @clwluvw [https://github.com/pomerium/pomerium/pull/3323](https://github.com/pomerium/pomerium/pull/3323) -- httputil/reproxy: fix policy transport by @calebdoxsey [https://github.com/pomerium/pomerium/pull/3324](https://github.com/pomerium/pomerium/pull/3324) -- Update docs for supported Ingress annotations [https://github.com/pomerium/pomerium/pull/3325](https://github.com/pomerium/pomerium/pull/3325) - -**Full Changelog**: `https://github.com/pomerium/pomerium/compare/v0.17.2...v0.17.3` - -## [v0.17.2](https://github.com/pomerium/pomerium/tree/v0.17.2) (2022-04-22) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.17.1...v0.17.2) - -### Fixed - -- Add UUID to docs yaml blocks (#3251) [#3259] (@alexfornuto) -- authorize: pass idp id for webauthn url, allow unauthenticated access to static files [#3284] (@calebdoxsey) -- config: fix DefaultTransport so it is still a \*http.Transport [#3260] (@calebdoxsey) - -### Dependency - -- chore(deps): bump actions/setup-python from 3.1.0 to 3.1.2 [#3266] - -## [v0.17.1](https://github.com/pomerium/pomerium/tree/v0.17.1) (2022-03-30) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.17.0...v0.17.1) - -### Security Notice - -This release includes a fix to a medium severity [security issue](https://github.com/pomerium/pomerium/security/advisories/GHSA-q98f-2x4p-prjr). - -We recommend that all users upgrade. - -### Security - -- authenticate: fix debug and metrics endpoints [#3215](https://github.com/pomerium/pomerium/pull/3215) (@backport-actions-token[bot]) - -### Fixed - -- authenticate: fix internal url with webauthn [#3195](https://github.com/pomerium/pomerium/pull/3195) (@backport-actions-token[bot]) -- github: fix missing groups [#3176](https://github.com/pomerium/pomerium/pull/3176) (@backport-actions-token[bot]) - -## [v0.17.0](https://github.com/pomerium/pomerium/tree/v0.17.0) (2022-03-04) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.16.4...v0.17.0) - -### New - -- adds pomerium version to the user info endpoint [#3093](https://github.com/pomerium/pomerium/pull/3093) (@nhayfield) -- authenticate: add device-enrolled page [#2892](https://github.com/pomerium/pomerium/pull/2892) (@calebdoxsey) -- authenticate: fix expiring user info endpoint [#2976](https://github.com/pomerium/pomerium/pull/2976) (@calebdoxsey) -- controlplane: add compression middleware [#3000](https://github.com/pomerium/pomerium/pull/3000) (@calebdoxsey) -- directory: save IDP errors to databroker, put event handling in dedicated package [#2957](https://github.com/pomerium/pomerium/pull/2957) (@calebdoxsey) -- frontend: react+mui [#3004](https://github.com/pomerium/pomerium/pull/3004) (@calebdoxsey) -- google: support groups for users outside of the organization [#2950](https://github.com/pomerium/pomerium/pull/2950) (@calebdoxsey) -- grpc: remove ptypes references [#3078](https://github.com/pomerium/pomerium/pull/3078) (@calebdoxsey) -- last known metric error [#2974](https://github.com/pomerium/pomerium/pull/2974) (@wasaga) -- remove deprecated ioutil usages [#2877](https://github.com/pomerium/pomerium/pull/2877) (@cfanbo) -- return explicit error when directory sync is disabled [#2949](https://github.com/pomerium/pomerium/pull/2949) (@wasaga) -- session: remove unused session state properties [#3022](https://github.com/pomerium/pomerium/pull/3022) (@calebdoxsey) -- Style update for User Info Endpoint [#3055](https://github.com/pomerium/pomerium/pull/3055) (@nhayfield) -- userinfo: add webauthn buttons to user info page [#3075](https://github.com/pomerium/pomerium/pull/3075) (@calebdoxsey) - -### Fixed - -- auth0: support explicit domains in the service account [#2980](https://github.com/pomerium/pomerium/pull/2980) (@calebdoxsey) -- auth0: support explicit domains in the service account [#2996](https://github.com/pomerium/pomerium/pull/2996) (@backport-actions-token[bot]) -- authenticate: add callback endpoint [#2931](https://github.com/pomerium/pomerium/pull/2931) (@calebdoxsey) -- authenticate: support webauthn redirects to non-pomerium domains [#2936](https://github.com/pomerium/pomerium/pull/2936) (@calebdoxsey) -- config: fix httptest local certificate [#3056](https://github.com/pomerium/pomerium/pull/3056) (@calebdoxsey) -- config: fix policy matching for regular expressions [#2966](https://github.com/pomerium/pomerium/pull/2966) (@calebdoxsey) -- config: fix TLS config when address and grpc_address are the same [#2975](https://github.com/pomerium/pomerium/pull/2975) (@calebdoxsey) -- databroker: use contextual logging for errors, use original record type for encryption [#3096](https://github.com/pomerium/pomerium/pull/3096) (@calebdoxsey) -- deployment: enable goreleaser buildx [#2968](https://github.com/pomerium/pomerium/pull/2968) (@travisgroth) -- deployment: fix distroless base arch [#2925](https://github.com/pomerium/pomerium/pull/2925) (@travisgroth) -- deployment: only include pomerium binary [#3007](https://github.com/pomerium/pomerium/pull/3007) (@travisgroth) -- devices: shrink credentials by removing unnecessary data [#2951](https://github.com/pomerium/pomerium/pull/2951) (@calebdoxsey) -- devices: treat undefined device types as any [#2927](https://github.com/pomerium/pomerium/pull/2927) (@calebdoxsey) -- envoy: check certificates for must-staple flag and drop them if they are missing the response [#2909](https://github.com/pomerium/pomerium/pull/2909) (@calebdoxsey) -- fix link for picture in avatar [#3066](https://github.com/pomerium/pomerium/pull/3066) (@nhayfield) -- fix: frontend html tag mismatch [#2954](https://github.com/pomerium/pomerium/pull/2954) (@cfanbo) -- handle device states in deny block, fix default device type [#2919](https://github.com/pomerium/pomerium/pull/2919) (@calebdoxsey) -- integration: fix default port for verify service [#2895](https://github.com/pomerium/pomerium/pull/2895) (@calebdoxsey) -- proxy: fix error page [#3020](https://github.com/pomerium/pomerium/pull/3020) (@calebdoxsey) -- Remove spurious \ tags [#2946](https://github.com/pomerium/pomerium/pull/2946) (@sylr) -- userinfo: fix logout button, add sign out confirm page [#3058](https://github.com/pomerium/pomerium/pull/3058) (@calebdoxsey) -- webauthn: use absolute URL for delete redirect [#2935](https://github.com/pomerium/pomerium/pull/2935) (@calebdoxsey) - -### Dependency - -- chore(deps): bump actions/setup-node from 2 to 3 [#3089](https://github.com/pomerium/pomerium/pull/3089) (@dependabot[bot]) -- chore(deps): bump actions/setup-python from 2 to 3 [#3088](https://github.com/pomerium/pomerium/pull/3088) (@dependabot[bot]) -- chore(deps): bump mikefarah/yq from 4.20.2 to 4.21.1 [#3087](https://github.com/pomerium/pomerium/pull/3087) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.69.0 to 0.70.0 [#3086](https://github.com/pomerium/pomerium/pull/3086) (@dependabot[bot]) -- chore(deps): bump url-parse from 1.5.7 to 1.5.10 [#3085](https://github.com/pomerium/pomerium/pull/3085) (@dependabot[bot]) -- chore(deps): bump prismjs from 1.26.0 to 1.27.0 [#3084](https://github.com/pomerium/pomerium/pull/3084) (@dependabot[bot]) -- deps: bump envoy to v1.20.2 [#3082](https://github.com/pomerium/pomerium/pull/3082) (@travisgroth) -- chore(deps): bump mikefarah/yq from 4.20.1 to 4.20.2 [#3072](https://github.com/pomerium/pomerium/pull/3072) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.68.0 to 0.69.0 [#3071](https://github.com/pomerium/pomerium/pull/3071) (@dependabot[bot]) -- chore(deps): bump github.com/golangci/golangci-lint from 1.44.0 to 1.44.2 [#3070](https://github.com/pomerium/pomerium/pull/3070) (@dependabot[bot]) -- chore(deps): bump url-parse from 1.5.1 to 1.5.7 [#3068](https://github.com/pomerium/pomerium/pull/3068) (@dependabot[bot]) -- chore(deps): bump github.com/gorilla/websocket from 1.4.2 to 1.5.0 [#3052](https://github.com/pomerium/pomerium/pull/3052) (@dependabot[bot]) -- chore(deps): bump mikefarah/yq from 4.18.1 to 4.20.1 [#3051](https://github.com/pomerium/pomerium/pull/3051) (@dependabot[bot]) -- chore(deps): bump follow-redirects from 1.14.7 to 1.14.8 [#3043](https://github.com/pomerium/pomerium/pull/3043) (@dependabot[bot]) -- chore(deps): bump go.uber.org/zap from 1.20.0 to 1.21.0 [#3041](https://github.com/pomerium/pomerium/pull/3041) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.37.1 to 0.37.2 [#3040](https://github.com/pomerium/pomerium/pull/3040) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.66.0 to 0.68.0 [#3033](https://github.com/pomerium/pomerium/pull/3033) (@dependabot[bot]) -- deps: increase yarn network timeout [#3018](https://github.com/pomerium/pomerium/pull/3018) (@travisgroth) -- chore(deps): bump github.com/caddyserver/certmagic from 0.15.2 to 0.15.3 [#3014](https://github.com/pomerium/pomerium/pull/3014) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.36.1 to 0.37.1 [#3013](https://github.com/pomerium/pomerium/pull/3013) (@dependabot[bot]) -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.12 to 3.22.1 [#3012](https://github.com/pomerium/pomerium/pull/3012) (@dependabot[bot]) -- chore(deps): bump github.com/mholt/acmez from 1.0.1 to 1.0.2 [#3011](https://github.com/pomerium/pomerium/pull/3011) (@dependabot[bot]) -- chore(deps): bump mermaid from 8.12.1 to 8.13.10 [#3010](https://github.com/pomerium/pomerium/pull/3010) (@dependabot[bot]) -- chore(deps): bump follow-redirects from 1.14.1 to 1.14.7 [#3009](https://github.com/pomerium/pomerium/pull/3009) (@dependabot[bot]) -- chore(deps): bump prismjs from 1.24.1 to 1.26.0 [#3008](https://github.com/pomerium/pomerium/pull/3008) (@dependabot[bot]) -- chore(deps): bump mikefarah/yq from 4.17.2 to 4.18.1 [#2989](https://github.com/pomerium/pomerium/pull/2989) (@dependabot[bot]) -- chore(deps): bump google.golang.org/grpc from 1.43.0 to 1.44.0 [#2988](https://github.com/pomerium/pomerium/pull/2988) (@dependabot[bot]) -- chore(deps): bump github.com/golangci/golangci-lint from 1.43.0 to 1.44.0 [#2987](https://github.com/pomerium/pomerium/pull/2987) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.65.0 to 0.66.0 [#2986](https://github.com/pomerium/pomerium/pull/2986) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/client_golang from 1.12.0 to 1.12.1 [#2985](https://github.com/pomerium/pomerium/pull/2985) (@dependabot[bot]) -- chore(deps): bump mikefarah/yq from 4.16.2 to 4.17.2 [#2963](https://github.com/pomerium/pomerium/pull/2963) (@dependabot[bot]) -- chore(deps): bump github.com/google/go-cmp from 0.5.6 to 0.5.7 [#2962](https://github.com/pomerium/pomerium/pull/2962) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/client_golang from 1.11.0 to 1.12.0 [#2961](https://github.com/pomerium/pomerium/pull/2961) (@dependabot[bot]) -- chore(deps): bump github.com/openzipkin/zipkin-go from 0.3.0 to 0.4.0 [#2942](https://github.com/pomerium/pomerium/pull/2942) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.64.0 to 0.65.0 [#2941](https://github.com/pomerium/pomerium/pull/2941) (@dependabot[bot]) -- chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 0.6.2 to 0.6.3 [#2940](https://github.com/pomerium/pomerium/pull/2940) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.36.0 to 0.36.1 [#2939](https://github.com/pomerium/pomerium/pull/2939) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.63.0 to 0.64.0 [#2913](https://github.com/pomerium/pomerium/pull/2913) (@dependabot[bot]) -- chore(deps): bump go.uber.org/zap from 1.19.1 to 1.20.0 [#2912](https://github.com/pomerium/pomerium/pull/2912) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.35.0 to 0.36.0 [#2911](https://github.com/pomerium/pomerium/pull/2911) (@dependabot[bot]) -- chore(deps): bump github.com/go-chi/chi from 1.5.4 to 4.1.2+incompatible [#2910](https://github.com/pomerium/pomerium/pull/2910) (@dependabot[bot]) -- envoy: upgrade to 1.20.1 [#2902](https://github.com/pomerium/pomerium/pull/2902) (@calebdoxsey) -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.11 to 3.21.12 [#2886](https://github.com/pomerium/pomerium/pull/2886) (@dependabot[bot]) -- chore(deps): bump github.com/rs/cors from 1.8.0 to 1.8.2 [#2855](https://github.com/pomerium/pomerium/pull/2855) (@dependabot[bot]) -- chore(deps): bump github.com/google/go-jsonnet from 0.17.0 to 0.18.0 [#2854](https://github.com/pomerium/pomerium/pull/2854) (@dependabot[bot]) -- chore(deps): bump mikefarah/yq from 4.16.1 to 4.16.2 [#2853](https://github.com/pomerium/pomerium/pull/2853) (@dependabot[bot]) - -#### Deployment - -- deployment: remove DST cert workaround from debug image [#2958](https://github.com/pomerium/pomerium/pull/2958) (@travisgroth) -- deployment: multi-arch master images [#2896](https://github.com/pomerium/pomerium/pull/2896) (@travisgroth) - -### Changed - -- config: add idp_client_id and idp_client_secret to protobuf [#3060](https://github.com/pomerium/pomerium/pull/3060) (@calebdoxsey) -- Extract email for active directory users that don't have access to exchange [#3053](https://github.com/pomerium/pomerium/pull/3053) (@JBodkin-Amphora) -- disable blank github issues [#2898](https://github.com/pomerium/pomerium/pull/2898) (@travisgroth) - -## [v0.16.4](https://github.com/pomerium/pomerium/tree/v0.16.4) (2022-02-25) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.16.3...v0.16.4) - -### Dependency - -- deps: update envoy to v1.19.3 [#3083](https://github.com/pomerium/pomerium/pull/3083) (@travisgroth) - -## [v0.16.3](https://github.com/pomerium/pomerium/tree/v0.16.3) (2022-02-11) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.16.2...v0.16.3) - -### Fixed - -- deployment: only include pomerium binary [#3007](https://github.com/pomerium/pomerium/pull/3007) (@travisgroth) -- auth0: support explicit domains in the service account [#2996](https://github.com/pomerium/pomerium/pull/2996) (@backport-actions-token[bot]) - -## [v0.16.2](https://github.com/pomerium/pomerium/tree/v0.16.2) (2022-01-25) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.16.1...v0.16.2) - -### Fixed - -- config: fix policy matching for regular expressions [#2969](https://github.com/pomerium/pomerium/pull/2969) (@backport-actions-token[bot]) - -## [v0.16.1](https://github.com/pomerium/pomerium/tree/v0.16.1) (2022-01-19) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.16.0...v0.16.1) - -### Fixed - -- webauthn: use absolute URL for delete redirect [#2937](https://github.com/pomerium/pomerium/pull/2937) (@backport-actions-token[bot]) -- handle device states in deny block, fix default device type [#2924](https://github.com/pomerium/pomerium/pull/2924) (@backport-actions-token[bot]) -- integration: fix default port for verify service [#2908](https://github.com/pomerium/pomerium/pull/2908) (@backport-actions-token[bot]) - -## [v0.16.0](https://github.com/pomerium/pomerium/tree/v0.16.0) (2021-12-22) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.15.8...v0.16.0) - -### Breaking - -- identity: only assign `access\_type` uri params to google. [#2782](https://github.com/pomerium/pomerium/pull/2782) (@desimone) -- tls: fallback to self-signed certificate [#2760](https://github.com/pomerium/pomerium/pull/2760) (@calebdoxsey) -- github: use GraphQL API to reduce number of API calls for directory sync [#2715](https://github.com/pomerium/pomerium/pull/2715) (@calebdoxsey) - -### New - -- more idp metrics [#2842](https://github.com/pomerium/pomerium/pull/2842) (@wasaga) -- devices: add experimental icon [#2836](https://github.com/pomerium/pomerium/pull/2836) (@calebdoxsey) -- devices: switch "default" device type to two built-in default device types [#2835](https://github.com/pomerium/pomerium/pull/2835) (@calebdoxsey) -- dashboard: improve display of device credentials, allow deletion [#2829](https://github.com/pomerium/pomerium/pull/2829) (@calebdoxsey) -- ppl: add support for http_path and http_method [#2813](https://github.com/pomerium/pomerium/pull/2813) (@calebdoxsey) -- config: add internal service URLs [#2801](https://github.com/pomerium/pomerium/pull/2801) (@calebdoxsey) -- envoy: add hash policy and routing key for hash-based load balancers [#2791](https://github.com/pomerium/pomerium/pull/2791) (@calebdoxsey) -- authorize: support X-Pomerium-Authorization in addition to Authorization [#2780](https://github.com/pomerium/pomerium/pull/2780) (@calebdoxsey) -- envoy: treat configuration errors as fatal [#2777](https://github.com/pomerium/pomerium/pull/2777) (@calebdoxsey) -- envoy: add support for bind_config bootstrap options [#2772](https://github.com/pomerium/pomerium/pull/2772) (@calebdoxsey) -- authenticate: redirect / to /.pomerium/ [#2770](https://github.com/pomerium/pomerium/pull/2770) (@calebdoxsey) -- device: add type id and credential id to enrollment for easier referencing [#2749](https://github.com/pomerium/pomerium/pull/2749) (@calebdoxsey) -- databroker: add additional log for config source [#2718](https://github.com/pomerium/pomerium/pull/2718) (@calebdoxsey) -- grpc: remove peer field from logs [#2712](https://github.com/pomerium/pomerium/pull/2712) (@calebdoxsey) -- desktop client api [#2711](https://github.com/pomerium/pomerium/pull/2711) (@wasaga) -- telemetry: improve zipkin error logs [#2710](https://github.com/pomerium/pomerium/pull/2710) (@calebdoxsey) -- authorize: add support for webauthn device policy enforcement [#2700](https://github.com/pomerium/pomerium/pull/2700) (@calebdoxsey) -- webauthn: update session to support device credentials per type [#2699](https://github.com/pomerium/pomerium/pull/2699) (@calebdoxsey) -- ppl: add support for additional data [#2696](https://github.com/pomerium/pomerium/pull/2696) (@calebdoxsey) -- Add additional ACME CA (autocert) options [#2695](https://github.com/pomerium/pomerium/pull/2695) (@hslatman) -- skip configuration updates to the most recent one [#2690](https://github.com/pomerium/pomerium/pull/2690) (@wasaga) -- authenticate: add support for webauthn [#2688](https://github.com/pomerium/pomerium/pull/2688) (@calebdoxsey) -- webauthnutil: add helpers for webauthn [#2686](https://github.com/pomerium/pomerium/pull/2686) (@calebdoxsey) -- devices: add device protobuf types [#2682](https://github.com/pomerium/pomerium/pull/2682) (@calebdoxsey) -- cryptutil: add SecureToken [#2681](https://github.com/pomerium/pomerium/pull/2681) (@calebdoxsey) -- config/envoyconfig: better duplicate message [#2661](https://github.com/pomerium/pomerium/pull/2661) (@desimone) -- pomerium-cli: add support for a custom browser command [#2617](https://github.com/pomerium/pomerium/pull/2617) (@calebdoxsey) -- ppl: pass contextual information through policy [#2612](https://github.com/pomerium/pomerium/pull/2612) (@calebdoxsey) -- add description to service accounts [#2611](https://github.com/pomerium/pomerium/pull/2611) (@nhayfield) -- DOCS: Add copy button to code snippets [#2597](https://github.com/pomerium/pomerium/pull/2597) (@alexfornuto) -- pomerium-cli: use cache dir instead of config dir [#2588](https://github.com/pomerium/pomerium/pull/2588) (@calebdoxsey) -- cli: update tcp log output format [#2586](https://github.com/pomerium/pomerium/pull/2586) (@travisgroth) -- directory: implement exponential backoff for refresh [#2570](https://github.com/pomerium/pomerium/pull/2570) (@calebdoxsey) -- google: support provider URL [#2567](https://github.com/pomerium/pomerium/pull/2567) (@calebdoxsey) -- config: remove signature_key_algorithm [#2557](https://github.com/pomerium/pomerium/pull/2557) (@calebdoxsey) -- allow pomerium to start without certs [#2555](https://github.com/pomerium/pomerium/pull/2555) (@wasaga) -- integration: kubernetes support [#2536](https://github.com/pomerium/pomerium/pull/2536) (@calebdoxsey) -- integration: nginx [#2532](https://github.com/pomerium/pomerium/pull/2532) (@calebdoxsey) -- integration: add traefik tests [#2530](https://github.com/pomerium/pomerium/pull/2530) (@calebdoxsey) -- envoy: remove deprecated access_log_path [#2523](https://github.com/pomerium/pomerium/pull/2523) (@calebdoxsey) -- config: remove headers [#2522](https://github.com/pomerium/pomerium/pull/2522) (@calebdoxsey) -- integration: add multi test [#2519](https://github.com/pomerium/pomerium/pull/2519) (@calebdoxsey) -- Remove api from GitLab defaultScope [#2518](https://github.com/pomerium/pomerium/pull/2518) (@alexfornuto) -- integration: add single-cluster integration tests [#2516](https://github.com/pomerium/pomerium/pull/2516) (@calebdoxsey) -- integration: remove tests [#2514](https://github.com/pomerium/pomerium/pull/2514) (@calebdoxsey) -- github: support provider URL [#2490](https://github.com/pomerium/pomerium/pull/2490) (@calebdoxsey) -- protoutil: add NewAny method for deterministic serialization [#2462](https://github.com/pomerium/pomerium/pull/2462) (@calebdoxsey) -- fix go get, improve redis test [#2450](https://github.com/pomerium/pomerium/pull/2450) (@calebdoxsey) -- all: remove unused handler code [#2439](https://github.com/pomerium/pomerium/pull/2439) (@desimone) - -### Security - -- identity: fix user refresh [#2724](https://github.com/pomerium/pomerium/pull/2724) (@calebdoxsey) -- deps: update envoy to 1.19.1 [#2526](https://github.com/pomerium/pomerium/pull/2526) (@travisgroth) - -### Fixed - -- add docs for ingress regex path [#2822](https://github.com/pomerium/pomerium/pull/2822) (@wasaga) -- Add docs team as a code owner of packages.json [#2605](https://github.com/pomerium/pomerium/pull/2605) (@alexfornuto) -- Add redirect for installation [#2618](https://github.com/pomerium/pomerium/pull/2618) (@alexfornuto) -- add service account redirects [#2664](https://github.com/pomerium/pomerium/pull/2664) (@alexfornuto) -- adjust comment blocking [#2488](https://github.com/pomerium/pomerium/pull/2488) (@alexfornuto) -- adjust sidebarDepths and document Desktop Client releases [#2643](https://github.com/pomerium/pomerium/pull/2643) (@alexfornuto) -- adjust sidebarDepths and document Desktop Client releases [#2645](https://github.com/pomerium/pomerium/pull/2645) (@backport-actions-token[bot]) -- Auth0 Doc Refresh [#2494](https://github.com/pomerium/pomerium/pull/2494) (@alexfornuto) -- config: allow specifying auto codec type in all-in-one mode [#2846](https://github.com/pomerium/pomerium/pull/2846) (@calebdoxsey) -- config: detect changes to the kubernetes service account token file [#2767](https://github.com/pomerium/pomerium/pull/2767) (@calebdoxsey) -- Copy edit to changelog entry [#2786](https://github.com/pomerium/pomerium/pull/2786) (@alexfornuto) -- dashboard: add confirmation dialog, fix button in firefox [#2841](https://github.com/pomerium/pomerium/pull/2841) (@calebdoxsey) -- deps: update goreleaser [#2757](https://github.com/pomerium/pomerium/pull/2757) (@travisgroth) -- DOC: Copy edits to Okta IdP doc. [#2623](https://github.com/pomerium/pomerium/pull/2623) (@alexfornuto) -- Docs: Add Grafana Integration Guide [#2742](https://github.com/pomerium/pomerium/pull/2742) (@alexfornuto) -- DOCS: add Grafana to Guides index [#2808](https://github.com/pomerium/pomerium/pull/2808) (@alexfornuto) -- Docs: Add spdy annotation [#2747](https://github.com/pomerium/pomerium/pull/2747) (@alexfornuto) -- docs: add updated icon asset [#2580](https://github.com/pomerium/pomerium/pull/2580) (@travisgroth) -- Docs: Batch Updates [#2628](https://github.com/pomerium/pomerium/pull/2628) (@alexfornuto) -- docs: clarify custom request header limitations [#2471](https://github.com/pomerium/pomerium/pull/2471) (@desimone) -- DOCS: Collapse IDP Header [#2641](https://github.com/pomerium/pomerium/pull/2641) (@alexfornuto) -- Docs: Correct Claim Example [#2689](https://github.com/pomerium/pomerium/pull/2689) (@alexfornuto) -- DOCS: CORS preflight in console [#2642](https://github.com/pomerium/pomerium/pull/2642) (@alexfornuto) -- DOCS: Create Consolidated Troubleshooting Guide and Replace FAQ [#2797](https://github.com/pomerium/pomerium/pull/2797) (@alexfornuto) -- Docs: cross-reference links between concepts and reference [#2648](https://github.com/pomerium/pomerium/pull/2648) (@alexfornuto) -- docs: enterprise console v0.15.2 changelog [#2564](https://github.com/pomerium/pomerium/pull/2564) (@travisgroth) -- docs: enterprise v0.15.1 changelog [#2542](https://github.com/pomerium/pomerium/pull/2542) (@travisgroth) -- DOCS: Fix indentation in API doc [#2798](https://github.com/pomerium/pomerium/pull/2798) (@alexfornuto) -- Docs: Fix merged PR [#2546](https://github.com/pomerium/pomerium/pull/2546) (@alexfornuto) -- Docs: Reference gRPC API Docs [#2717](https://github.com/pomerium/pomerium/pull/2717) (@alexfornuto) -- docs: remove extra word / updated docs link [#2638](https://github.com/pomerium/pomerium/pull/2638) (@cmo-pomerium) -- docs: rename updated icon image [#2582](https://github.com/pomerium/pomerium/pull/2582) (@travisgroth) -- DOCS: Standardize Relative Links [#2651](https://github.com/pomerium/pomerium/pull/2651) (@alexfornuto) -- docs: update branding [#2435](https://github.com/pomerium/pomerium/pull/2435) (@desimone) -- docs: update branding, concepts [#2445](https://github.com/pomerium/pomerium/pull/2445) (@desimone) -- docs: update codeowners [#2451](https://github.com/pomerium/pomerium/pull/2451) (@travisgroth) -- Docs: Update Community Page [#2713](https://github.com/pomerium/pomerium/pull/2713) (@cmo-pomerium) -- docs: update default version to v0.15 [#2437](https://github.com/pomerium/pomerium/pull/2437) (@travisgroth) -- docs: update enterprise helm instructions to use main repo [#2463](https://github.com/pomerium/pomerium/pull/2463) (@travisgroth) -- DOCS: Update Enterprise Reference Docs [#2599](https://github.com/pomerium/pomerium/pull/2599) (@alexfornuto) -- Docs: Update JWT Verification Guide [#2746](https://github.com/pomerium/pomerium/pull/2746) (@alexfornuto) -- Docs: Update Kubernetes Dashboard Guide [#2759](https://github.com/pomerium/pomerium/pull/2759) (@alexfornuto) -- docs: update pomerium-cli location [#2790](https://github.com/pomerium/pomerium/pull/2790) (@travisgroth) -- Docs: Update Securing Kubernetes Guide [#2758](https://github.com/pomerium/pomerium/pull/2758) (@alexfornuto) -- Docs: Update Traefik Example Headers [#2732](https://github.com/pomerium/pomerium/pull/2732) (@alexfornuto) -- docs: use generic email [#2484](https://github.com/pomerium/pomerium/pull/2484) (@alexfornuto) -- Docs/batch link fixes [#2621](https://github.com/pomerium/pomerium/pull/2621) (@alexfornuto) -- document binding service to 443 [#2487](https://github.com/pomerium/pomerium/pull/2487) (@alexfornuto) -- Document Enterprise API [#2595](https://github.com/pomerium/pomerium/pull/2595) (@alexfornuto) -- Document moving routes [#2460](https://github.com/pomerium/pomerium/pull/2460) (@alexfornuto) -- Document Pomerium Policy Language [#2784](https://github.com/pomerium/pomerium/pull/2784) (@alexfornuto) -- Document Pomerium Policy Language [#2789](https://github.com/pomerium/pomerium/pull/2789) (@backport-actions-token[bot]) -- Document recovery token generation [#2579](https://github.com/pomerium/pomerium/pull/2579) (@alexfornuto) -- Document tracing sample rate in console [#2461](https://github.com/pomerium/pomerium/pull/2461) (@alexfornuto) -- Enterprise Upgrade & Changelog Pages [#2453](https://github.com/pomerium/pomerium/pull/2453) (@alexfornuto) -- envoyconfig: fix tls_downstream_client_ca for non-standard ports [#2802](https://github.com/pomerium/pomerium/pull/2802) (@calebdoxsey) -- Fix IdP client metrics [#2810](https://github.com/pomerium/pomerium/pull/2810) (@travisgroth) -- Fix typo in docs [#2683](https://github.com/pomerium/pomerium/pull/2683) (@nihaals) -- fix typo in docs [#2819](https://github.com/pomerium/pomerium/pull/2819) (@wasaga) -- fix: Fixed return description error [#2825](https://github.com/pomerium/pomerium/pull/2825) (@cfanbo) -- Fixed 'kubtctl' typo on releases page [#2673](https://github.com/pomerium/pomerium/pull/2673) (@ChaosInTheCRD) -- internal/telemetry: fix grpc server metrics [#2811](https://github.com/pomerium/pomerium/pull/2811) (@travisgroth) -- Minor fix in routes documentation [#2714](https://github.com/pomerium/pomerium/pull/2714) (@Kerwood) -- New Topic Page: Original Request Context [#2569](https://github.com/pomerium/pomerium/pull/2569) (@alexfornuto) -- Refresh and Update TCP documentation [#2627](https://github.com/pomerium/pomerium/pull/2627) (@alexfornuto) -- Remove forward_auth_url from Enterprise [#2779](https://github.com/pomerium/pomerium/pull/2779) (@alexfornuto) -- specify expected audience in Console config [#2442](https://github.com/pomerium/pomerium/pull/2442) (@alexfornuto) -- TCP Client Doc [#2561](https://github.com/pomerium/pomerium/pull/2561) (@alexfornuto) -- typo [#2644](https://github.com/pomerium/pomerium/pull/2644) (@alexfornuto) -- Update AWS cognito IdP doc [#2498](https://github.com/pomerium/pomerium/pull/2498) (@alexfornuto) -- Update Azure IdP Doc [#2497](https://github.com/pomerium/pomerium/pull/2497) (@alexfornuto) -- Update binary install doc [#2447](https://github.com/pomerium/pomerium/pull/2447) (@alexfornuto) -- Update CODEOWNERS [#2603](https://github.com/pomerium/pomerium/pull/2603) (@alexfornuto) -- Update create TLS command to quote strings. [#2694](https://github.com/pomerium/pomerium/pull/2694) (@FutureMatt) -- Update Docker Quickstart [#2482](https://github.com/pomerium/pomerium/pull/2482) (@alexfornuto) -- update GitHub IdP doc [#2503](https://github.com/pomerium/pomerium/pull/2503) (@alexfornuto) -- Update GitLab IdP doc [#2520](https://github.com/pomerium/pomerium/pull/2520) (@alexfornuto) -- Update Helm Instructions [#2467](https://github.com/pomerium/pomerium/pull/2467) (@alexfornuto) -- Update IdP Overview Page [#2493](https://github.com/pomerium/pomerium/pull/2493) (@alexfornuto) -- Update Okta IdP doc [#2491](https://github.com/pomerium/pomerium/pull/2491) (@alexfornuto) -- update OneLogin IdP doc [#2533](https://github.com/pomerium/pomerium/pull/2533) (@alexfornuto) -- Update overview/architecture.md [#2701](https://github.com/pomerium/pomerium/pull/2701) (@cmo-pomerium) -- Update Ping Identity IdP [#2537](https://github.com/pomerium/pomerium/pull/2537) (@alexfornuto) -- Updates to Enterprise Quickstart instructions [#2480](https://github.com/pomerium/pomerium/pull/2480) (@alexfornuto) -- wrap header example values as inline code. [#2474](https://github.com/pomerium/pomerium/pull/2474) (@alexfornuto) -- Wrap mkcert command in quotes [#2481](https://github.com/pomerium/pomerium/pull/2481) (@alexfornuto) - -### Dependency - -- chore(deps): bump google.golang.org/api from 0.62.0 to 0.63.0 [#2834](https://github.com/pomerium/pomerium/pull/2834) (@dependabot[bot]) -- chore(deps): bump github.com/rs/zerolog from 1.26.0 to 1.26.1 [#2833](https://github.com/pomerium/pomerium/pull/2833) (@dependabot[bot]) -- chore(deps): bump github.com/spf13/viper from 1.10.0 to 1.10.1 [#2832](https://github.com/pomerium/pomerium/pull/2832) (@dependabot[bot]) -- chore(deps): bump google.golang.org/grpc from 1.42.0 to 1.43.0 [#2831](https://github.com/pomerium/pomerium/pull/2831) (@dependabot[bot]) -- chore(deps): bump github.com/docker/docker from 20.10.11+incompatible to 20.10.12+incompatible [#2817](https://github.com/pomerium/pomerium/pull/2817) (@dependabot[bot]) -- chore(deps): bump github.com/spf13/viper from 1.9.0 to 1.10.0 [#2816](https://github.com/pomerium/pomerium/pull/2816) (@dependabot[bot]) -- dev build support for darwin-arm64 from envoy tip [#2815](https://github.com/pomerium/pomerium/pull/2815) (@wasaga) -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.10 to 3.21.11 [#2807](https://github.com/pomerium/pomerium/pull/2807) (@dependabot[bot]) -- chore(deps): bump github.com/mitchellh/mapstructure from 1.4.2 to 1.4.3 [#2806](https://github.com/pomerium/pomerium/pull/2806) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.60.0 to 0.61.0 [#2805](https://github.com/pomerium/pomerium/pull/2805) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.34.2 to 0.35.0 [#2804](https://github.com/pomerium/pomerium/pull/2804) (@dependabot[bot]) -- chore(deps): bump mikefarah/yq from 4.15.1 to 4.16.1 [#2803](https://github.com/pomerium/pomerium/pull/2803) (@dependabot[bot]) -- chore(deps): bump github.com/ory/dockertest/v3 from 3.8.0 to 3.8.1 [#2785](https://github.com/pomerium/pomerium/pull/2785) (@dependabot[bot]) -- chore(deps): bump mikefarah/yq from 4.14.2 to 4.15.1 [#2783](https://github.com/pomerium/pomerium/pull/2783) (@dependabot[bot]) -- chore(deps): bump github.com/docker/docker from 20.10.10+incompatible to 20.10.11+incompatible [#2776](https://github.com/pomerium/pomerium/pull/2776) (@dependabot[bot]) -- chore(deps): bump coverallsapp/github-action from 1.1.2 to 1.1.3 [#2775](https://github.com/pomerium/pomerium/pull/2775) (@dependabot[bot]) -- chore(deps): bump mikefarah/yq from 4.6.3 to 4.14.2 [#2774](https://github.com/pomerium/pomerium/pull/2774) (@dependabot[bot]) -- chore(deps): bump github.com/caddyserver/certmagic from 0.15.1 to 0.15.2 [#2769](https://github.com/pomerium/pomerium/pull/2769) (@dependabot[bot]) -- chore(deps): bump github.com/cenkalti/backoff/v4 from 4.1.1 to 4.1.2 [#2768](https://github.com/pomerium/pomerium/pull/2768) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.34.1 to 0.34.2 [#2765](https://github.com/pomerium/pomerium/pull/2765) (@dependabot[bot]) -- chore(deps): bump github.com/mholt/acmez from 1.0.0 to 1.0.1 [#2764](https://github.com/pomerium/pomerium/pull/2764) (@dependabot[bot]) -- chore(deps): bump gopkg.in/auth0.v5 from 5.21.0 to 5.21.1 [#2763](https://github.com/pomerium/pomerium/pull/2763) (@dependabot[bot]) -- chore(deps): bump github.com/golangci/golangci-lint from 1.42.1 to 1.43.0 [#2756](https://github.com/pomerium/pomerium/pull/2756) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.34.0 to 0.34.1 [#2755](https://github.com/pomerium/pomerium/pull/2755) (@dependabot[bot]) -- chore(deps): bump google.golang.org/grpc from 1.41.0 to 1.42.0 [#2754](https://github.com/pomerium/pomerium/pull/2754) (@dependabot[bot]) -- chore(deps): bump github.com/rs/zerolog from 1.25.0 to 1.26.0 [#2753](https://github.com/pomerium/pomerium/pull/2753) (@dependabot[bot]) -- chore(deps): bump gopkg.in/auth0.v5 from 5.20.0 to 5.21.0 [#2752](https://github.com/pomerium/pomerium/pull/2752) (@dependabot[bot]) -- dependencies: vendor base58, remove shortuuid [#2739](https://github.com/pomerium/pomerium/pull/2739) (@calebdoxsey) -- chore(deps): bump google.golang.org/api from 0.58.0 to 0.60.0 [#2737](https://github.com/pomerium/pomerium/pull/2737) (@dependabot[bot]) -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.9 to 3.21.10 [#2736](https://github.com/pomerium/pomerium/pull/2736) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.33.1 to 0.34.0 [#2735](https://github.com/pomerium/pomerium/pull/2735) (@dependabot[bot]) -- chore(deps): bump github.com/openzipkin/zipkin-go from 0.2.5 to 0.3.0 [#2734](https://github.com/pomerium/pomerium/pull/2734) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/common from 0.31.1 to 0.32.1 [#2706](https://github.com/pomerium/pomerium/pull/2706) (@dependabot[bot]) -- chore(deps): bump github.com/docker/docker from 20.10.9+incompatible to 20.10.10+incompatible [#2705](https://github.com/pomerium/pomerium/pull/2705) (@dependabot[bot]) -- chore(deps): bump gopkg.in/auth0.v5 from 5.19.2 to 5.20.0 [#2704](https://github.com/pomerium/pomerium/pull/2704) (@dependabot[bot]) -- chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 0.6.1 to 0.6.2 [#2703](https://github.com/pomerium/pomerium/pull/2703) (@dependabot[bot]) -- chore(deps): bump github.com/caddyserver/certmagic from 0.14.5 to 0.15.1 [#2685](https://github.com/pomerium/pomerium/pull/2685) (@dependabot[bot]) -- chore(deps): bump github.com/peterbourgon/ff/v3 from 3.1.0 to 3.1.2 [#2672](https://github.com/pomerium/pomerium/pull/2672) (@dependabot[bot]) -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.8 to 3.21.9 [#2671](https://github.com/pomerium/pomerium/pull/2671) (@dependabot[bot]) -- chore(deps): bump github.com/docker/docker from 20.10.8+incompatible to 20.10.9+incompatible [#2670](https://github.com/pomerium/pomerium/pull/2670) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.57.0 to 0.58.0 [#2660](https://github.com/pomerium/pomerium/pull/2660) (@dependabot[bot]) -- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.3 to 8.11.4 [#2659](https://github.com/pomerium/pomerium/pull/2659) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.32.1 to 0.33.1 [#2658](https://github.com/pomerium/pomerium/pull/2658) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/common from 0.31.0 to 0.31.1 [#2656](https://github.com/pomerium/pomerium/pull/2656) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.32.0 to 0.32.1 [#2633](https://github.com/pomerium/pomerium/pull/2633) (@dependabot[bot]) -- chore(deps): bump google.golang.org/grpc from 1.40.0 to 1.41.0 [#2632](https://github.com/pomerium/pomerium/pull/2632) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/common from 0.30.0 to 0.31.0 [#2631](https://github.com/pomerium/pomerium/pull/2631) (@dependabot[bot]) -- chore(deps): bump sigs.k8s.io/yaml from 1.2.0 to 1.3.0 [#2630](https://github.com/pomerium/pomerium/pull/2630) (@dependabot[bot]) -- chore(deps): bump github.com/ory/dockertest/v3 from 3.7.0 to 3.8.0 [#2629](https://github.com/pomerium/pomerium/pull/2629) (@dependabot[bot]) -- chore(deps): bump github.com/spf13/viper from 1.8.1 to 1.9.0 [#2616](https://github.com/pomerium/pomerium/pull/2616) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.56.0 to 0.57.0 [#2615](https://github.com/pomerium/pomerium/pull/2615) (@dependabot[bot]) -- chore(deps): bump github.com/coreos/go-oidc/v3 from 3.0.0 to 3.1.0 [#2614](https://github.com/pomerium/pomerium/pull/2614) (@dependabot[bot]) -- bump protoc-validate [#2606](https://github.com/pomerium/pomerium/pull/2606) (@wasaga) -- chore(deps): bump go.uber.org/zap from 1.19.0 to 1.19.1 [#2592](https://github.com/pomerium/pomerium/pull/2592) (@dependabot[bot]) -- chore(deps): bump github.com/rs/zerolog from 1.24.0 to 1.25.0 [#2591](https://github.com/pomerium/pomerium/pull/2591) (@dependabot[bot]) -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.7 to 3.21.8 [#2577](https://github.com/pomerium/pomerium/pull/2577) (@dependabot[bot]) -- chore(deps): bump github.com/golangci/golangci-lint from 1.42.0 to 1.42.1 [#2576](https://github.com/pomerium/pomerium/pull/2576) (@dependabot[bot]) -- chore(deps): bump github.com/caddyserver/certmagic from 0.14.4 to 0.14.5 [#2575](https://github.com/pomerium/pomerium/pull/2575) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.54.0 to 0.56.0 [#2574](https://github.com/pomerium/pomerium/pull/2574) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.31.0 to 0.32.0 [#2573](https://github.com/pomerium/pomerium/pull/2573) (@dependabot[bot]) -- chore(deps): bump github.com/fsnotify/fsnotify from 1.5.0 to 1.5.1 [#2554](https://github.com/pomerium/pomerium/pull/2554) (@dependabot[bot]) -- chore(deps): bump github.com/caddyserver/certmagic from 0.14.3 to 0.14.4 [#2553](https://github.com/pomerium/pomerium/pull/2553) (@dependabot[bot]) -- chore(deps): bump github.com/rs/zerolog from 1.23.0 to 1.24.0 [#2552](https://github.com/pomerium/pomerium/pull/2552) (@dependabot[bot]) -- chore(deps): bump github.com/docker/docker from 20.10.7+incompatible to 20.10.8+incompatible [#2551](https://github.com/pomerium/pomerium/pull/2551) (@dependabot[bot]) -- chore(deps): bump github.com/caddyserver/certmagic from 0.14.1 to 0.14.3 [#2550](https://github.com/pomerium/pomerium/pull/2550) (@dependabot[bot]) -- chore(deps): bump contrib.go.opencensus.io/exporter/prometheus from 0.3.0 to 0.4.0 [#2549](https://github.com/pomerium/pomerium/pull/2549) (@dependabot[bot]) -- chore(deps): bump github.com/cespare/xxhash/v2 from 2.1.1 to 2.1.2 [#2548](https://github.com/pomerium/pomerium/pull/2548) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/procfs from 0.7.2 to 0.7.3 [#2512](https://github.com/pomerium/pomerium/pull/2512) (@dependabot[bot]) -- chore(deps): bump github.com/golangci/golangci-lint from 1.41.1 to 1.42.0 [#2511](https://github.com/pomerium/pomerium/pull/2511) (@dependabot[bot]) -- chore(deps): bump github.com/fsnotify/fsnotify from 1.4.9 to 1.5.0 [#2510](https://github.com/pomerium/pomerium/pull/2510) (@dependabot[bot]) -- ci: use go 1.17.x [#2492](https://github.com/pomerium/pomerium/pull/2492) (@desimone) -- chore(deps): bump google.golang.org/grpc from 1.39.1 to 1.40.0 [#2478](https://github.com/pomerium/pomerium/pull/2478) (@dependabot[bot]) -- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.2 to 8.11.3 [#2477](https://github.com/pomerium/pomerium/pull/2477) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.52.0 to 0.54.0 [#2476](https://github.com/pomerium/pomerium/pull/2476) (@dependabot[bot]) -- chore(deps): bump go.uber.org/zap from 1.18.1 to 1.19.0 [#2475](https://github.com/pomerium/pomerium/pull/2475) (@dependabot[bot]) -- ci: support darwn/arm64 aka m1 for cli [#2473](https://github.com/pomerium/pomerium/pull/2473) (@desimone) -- chore(deps): bump google.golang.org/grpc from 1.39.0 to 1.39.1 [#2457](https://github.com/pomerium/pomerium/pull/2457) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/procfs from 0.7.1 to 0.7.2 [#2456](https://github.com/pomerium/pomerium/pull/2456) (@dependabot[bot]) -- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.1 to 8.11.2 [#2455](https://github.com/pomerium/pomerium/pull/2455) (@dependabot[bot]) -- Hadolint [#2363](https://github.com/pomerium/pomerium/pull/2363) (@stephengroat) - -### Deployment - -- deployment: migrate pomerium-cli automation to new repo [#2771](https://github.com/pomerium/pomerium/pull/2771) (@travisgroth) -- deployment: remove DST_Root_CA_X3 from docker images [#2677](https://github.com/pomerium/pomerium/pull/2677) (@travisgroth) -- deployment: update goreleaser syntax [#2524](https://github.com/pomerium/pomerium/pull/2524) (@travisgroth) - -### Changed - -- move NewGRPCClientConn to public package [#2826](https://github.com/pomerium/pomerium/pull/2826) (@wasaga) -- rm cli code [#2824](https://github.com/pomerium/pomerium/pull/2824) (@wasaga) -- ci: remove hadolint [#2726](https://github.com/pomerium/pomerium/pull/2726) (@travisgroth) -- ci: ignore multiple run commands [#2566](https://github.com/pomerium/pomerium/pull/2566) (@travisgroth) -- redirect logo to the marketing site [#2441](https://github.com/pomerium/pomerium/pull/2441) (@alexfornuto) -- ci: use github app for backport credentials [#2369](https://github.com/pomerium/pomerium/pull/2369) (@travisgroth) - -## [v0.15.8](https://github.com/pomerium/pomerium/tree/v0.15.8) (2021-12-17) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.15.7...v0.15.8) - -### Fixed - -- authorize: fix nginx infinite redirect [#2812](https://github.com/pomerium/pomerium/pull/2812) (@calebdoxsey) - -### Documentation - -- DOCS: add Grafana to Guides index [#2809](https://github.com/pomerium/pomerium/pull/2809) (@backport-actions-token[bot]) -- DOCS: Fix indentation in API doc [#2799](https://github.com/pomerium/pomerium/pull/2799) (@backport-actions-token[bot]) -- Docs: Update Kubernetes Dashboard Guide [#2795](https://github.com/pomerium/pomerium/pull/2795) (@backport-actions-token[bot]) -- Docs: Update Securing Kubernetes Guide [#2792](https://github.com/pomerium/pomerium/pull/2792) (@backport-actions-token[bot]) -- Docs: Update JWT Verification Guide [#2787](https://github.com/pomerium/pomerium/pull/2787) (@backport-actions-token[bot]) - -### Dependency - -- deps: pin release to latest go version [#2827](https://github.com/pomerium/pomerium/pull/2827) (@travisgroth) - -## [v0.15.7](https://github.com/pomerium/pomerium/tree/v0.15.7) (2021-11-15) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.15.6...v0.15.7) - -### Fixed - -- autocert: remove log [#2750](https://github.com/pomerium/pomerium/pull/2750) (@backport-actions-token[bot]) - -### Security - -- identity: fix user refresh [#2725](https://github.com/pomerium/pomerium/pull/2725) (@backport-actions-token[bot]) - -### Documentation - -- Docs: Add Grafana Integration Guide [#2762](https://github.com/pomerium/pomerium/pull/2762) (@backport-actions-token[bot]) -- Docs: Add spdy annotation [#2751](https://github.com/pomerium/pomerium/pull/2751) (@backport-actions-token[bot]) -- Docs: Ingress Controller [#2745](https://github.com/pomerium/pomerium/pull/2745) (@backport-actions-token[bot]) -- Docs: Update Traefik Example Headers [#2741](https://github.com/pomerium/pomerium/pull/2741) (@backport-actions-token[bot]) -- Docs: Update Community Page [#2731](https://github.com/pomerium/pomerium/pull/2731) (@backport-actions-token[bot]) -- Minor fix in routes documentation [#2721](https://github.com/pomerium/pomerium/pull/2721) (@backport-actions-token[bot]) -- Docs: Reference gRPC API Docs [#2720](https://github.com/pomerium/pomerium/pull/2720) (@backport-actions-token[bot]) -- Update overview/architecture.md [#2707](https://github.com/pomerium/pomerium/pull/2707) (@backport-actions-token[bot]) - -## [v0.15.6](https://github.com/pomerium/pomerium/tree/v0.15.6) (2021-11-04) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.15.5...v0.15.6) - -### Breaking - -- github: use GraphQL API to reduce number of API calls for directory sync [#2715](https://github.com/pomerium/pomerium/pull/2715) (@calebdoxsey) - -### New - -- Add additional ACME CA (autocert) options [#2695](https://github.com/pomerium/pomerium/pull/2695) (@hslatman) -- add description to service accounts [#2611](https://github.com/pomerium/pomerium/pull/2611) (@nhayfield) -- all: remove unused handler code [#2439](https://github.com/pomerium/pomerium/pull/2439) (@desimone) -- allow pomerium to start without certs [#2555](https://github.com/pomerium/pomerium/pull/2555) (@wasaga) -- authenticate: add support for webauthn [#2688](https://github.com/pomerium/pomerium/pull/2688) (@calebdoxsey) -- authorize: add support for webauthn device policy enforcement [#2700](https://github.com/pomerium/pomerium/pull/2700) (@calebdoxsey) -- cli: update tcp log output format [#2586](https://github.com/pomerium/pomerium/pull/2586) (@travisgroth) -- config: remove headers [#2522](https://github.com/pomerium/pomerium/pull/2522) (@calebdoxsey) -- config/envoyconfig: better duplicate message [#2661](https://github.com/pomerium/pomerium/pull/2661) (@desimone) -- cryptutil: add SecureToken [#2681](https://github.com/pomerium/pomerium/pull/2681) (@calebdoxsey) -- databroker: add additional log for config source [#2718](https://github.com/pomerium/pomerium/pull/2718) (@calebdoxsey) -- desktop client api [#2711](https://github.com/pomerium/pomerium/pull/2711) (@wasaga) -- devices: add device protobuf types [#2682](https://github.com/pomerium/pomerium/pull/2682) (@calebdoxsey) -- directory: implement exponential backoff for refresh [#2570](https://github.com/pomerium/pomerium/pull/2570) (@calebdoxsey) -- DOCS: Add copy button to code snippets [#2597](https://github.com/pomerium/pomerium/pull/2597) (@alexfornuto) -- envoy: remove deprecated access_log_path [#2523](https://github.com/pomerium/pomerium/pull/2523) (@calebdoxsey) -- fix go get, improve redis test [#2450](https://github.com/pomerium/pomerium/pull/2450) (@calebdoxsey) -- github: support provider URL [#2490](https://github.com/pomerium/pomerium/pull/2490) (@calebdoxsey) -- google: support provider URL [#2567](https://github.com/pomerium/pomerium/pull/2567) (@calebdoxsey) -- grpc: remove peer field from logs [#2712](https://github.com/pomerium/pomerium/pull/2712) (@calebdoxsey) -- integration: add multi test [#2519](https://github.com/pomerium/pomerium/pull/2519) (@calebdoxsey) -- integration: add single-cluster integration tests [#2516](https://github.com/pomerium/pomerium/pull/2516) (@calebdoxsey) -- integration: add traefik tests [#2530](https://github.com/pomerium/pomerium/pull/2530) (@calebdoxsey) -- integration: kubernetes support [#2536](https://github.com/pomerium/pomerium/pull/2536) (@calebdoxsey) -- integration: nginx [#2532](https://github.com/pomerium/pomerium/pull/2532) (@calebdoxsey) -- integration: remove tests [#2514](https://github.com/pomerium/pomerium/pull/2514) (@calebdoxsey) -- pomerium-cli: add support for a custom browser command [#2617](https://github.com/pomerium/pomerium/pull/2617) (@calebdoxsey) -- pomerium-cli: use cache dir instead of config dir [#2588](https://github.com/pomerium/pomerium/pull/2588) (@calebdoxsey) -- ppl: add support for additional data [#2696](https://github.com/pomerium/pomerium/pull/2696) (@calebdoxsey) -- ppl: pass contextual information through policy [#2612](https://github.com/pomerium/pomerium/pull/2612) (@calebdoxsey) -- protoutil: add NewAny method for deterministic serialization [#2462](https://github.com/pomerium/pomerium/pull/2462) (@calebdoxsey) -- Remove api from GitLab defaultScope [#2518](https://github.com/pomerium/pomerium/pull/2518) (@alexfornuto) -- skip configuration updates to the most recent one [#2690](https://github.com/pomerium/pomerium/pull/2690) (@wasaga) -- telemetry: improve zipkin error logs [#2710](https://github.com/pomerium/pomerium/pull/2710) (@calebdoxsey) -- webauthn: update session to support device credentials per type [#2699](https://github.com/pomerium/pomerium/pull/2699) (@calebdoxsey) -- webauthnutil: add helpers for webauthn [#2686](https://github.com/pomerium/pomerium/pull/2686) (@calebdoxsey) - -### Fixed - -- add host-rewrite options to config.proto [#2668](https://github.com/pomerium/pomerium/pull/2668) (@wasaga) -- authclient: clone TLS configuration to prevent overriding NextProtos [#2594](https://github.com/pomerium/pomerium/pull/2594) (@calebdoxsey) -- authenticate: add databroker versions to session cookie [#2709](https://github.com/pomerium/pomerium/pull/2709) (@calebdoxsey) -- authenticate: always update user record on login [#2719](https://github.com/pomerium/pomerium/pull/2719) (@calebdoxsey) -- authorize: fix google cloudrun header audience [#2558](https://github.com/pomerium/pomerium/pull/2558) (@calebdoxsey) -- authorize: fix X-Pomerium-Claim-Groups [#2539](https://github.com/pomerium/pomerium/pull/2539) (@calebdoxsey) -- authorize: use session.user_id in headers [#2571](https://github.com/pomerium/pomerium/pull/2571) (@calebdoxsey) -- autocert: remove log [#2584](https://github.com/pomerium/pomerium/pull/2584) (@calebdoxsey) -- deployment: relocate pomerium-cli to /usr/bin [#2727](https://github.com/pomerium/pomerium/pull/2727) (@travisgroth) -- fix forward-auth, logging [#2509](https://github.com/pomerium/pomerium/pull/2509) (@calebdoxsey) -- grpc: disable gRPC connection re-use across services [#2515](https://github.com/pomerium/pomerium/pull/2515) (@calebdoxsey) -- grpc: send client traffic through envoy [#2469](https://github.com/pomerium/pomerium/pull/2469) (@calebdoxsey) -- options: remove refresh_cooldown, add allow_spdy to proto [#2446](https://github.com/pomerium/pomerium/pull/2446) (@calebdoxsey) -- ppl: use session.user_id instead of user.id for user criterion [#2562](https://github.com/pomerium/pomerium/pull/2562) (@calebdoxsey) -- protoc: add xds repo [#2687](https://github.com/pomerium/pomerium/pull/2687) (@calebdoxsey) -- tcptunnel: force the use of HTTP/1.1 during ALPN [#2593](https://github.com/pomerium/pomerium/pull/2593) (@calebdoxsey) -- userinfo: format exp, iat and updated_at [#2585](https://github.com/pomerium/pomerium/pull/2585) (@calebdoxsey) - -### Security - -- identity: fix user refresh [#2724](https://github.com/pomerium/pomerium/pull/2724) (@calebdoxsey) -- deps: update envoy to 1.19.1 [#2526](https://github.com/pomerium/pomerium/pull/2526) (@travisgroth) - -### Documentation - -- Add docs team as a code owner of packages.json [#2605](https://github.com/pomerium/pomerium/pull/2605) (@alexfornuto) -- Add redirect for installation [#2618](https://github.com/pomerium/pomerium/pull/2618) (@alexfornuto) -- add service account redirects [#2664](https://github.com/pomerium/pomerium/pull/2664) (@alexfornuto) -- adjust comment blocking [#2488](https://github.com/pomerium/pomerium/pull/2488) (@alexfornuto) -- adjust sidebarDepths and document Desktop Client releases [#2643](https://github.com/pomerium/pomerium/pull/2643) (@alexfornuto) -- Auth0 Doc Refresh [#2494](https://github.com/pomerium/pomerium/pull/2494) (@alexfornuto) -- DOC: Copy edits to Okta IdP doc. [#2623](https://github.com/pomerium/pomerium/pull/2623) (@alexfornuto) -- docs: add updated icon asset [#2580](https://github.com/pomerium/pomerium/pull/2580) (@travisgroth) -- Docs: Batch Updates [#2628](https://github.com/pomerium/pomerium/pull/2628) (@alexfornuto) -- docs: clarify custom request header limitations [#2471](https://github.com/pomerium/pomerium/pull/2471) (@desimone) -- DOCS: Collapse IDP Header [#2641](https://github.com/pomerium/pomerium/pull/2641) (@alexfornuto) -- Docs: Correct Claim Example [#2689](https://github.com/pomerium/pomerium/pull/2689) (@alexfornuto) -- DOCS: CORS preflight in console [#2642](https://github.com/pomerium/pomerium/pull/2642) (@alexfornuto) -- Docs: cross-reference links between concepts and reference [#2648](https://github.com/pomerium/pomerium/pull/2648) (@alexfornuto) -- docs: enterprise console v0.15.2 changelog [#2564](https://github.com/pomerium/pomerium/pull/2564) (@travisgroth) -- docs: enterprise v0.15.1 changelog [#2542](https://github.com/pomerium/pomerium/pull/2542) (@travisgroth) -- Docs: Fix merged PR [#2546](https://github.com/pomerium/pomerium/pull/2546) (@alexfornuto) -- Docs: Ingress Controller [#2667](https://github.com/pomerium/pomerium/pull/2667) (@alexfornuto) -- Docs: Reference gRPC API Docs [#2717](https://github.com/pomerium/pomerium/pull/2717) (@alexfornuto) -- docs: remove extra word / updated docs link [#2638](https://github.com/pomerium/pomerium/pull/2638) (@cmo-pomerium) -- docs: rename updated icon image [#2582](https://github.com/pomerium/pomerium/pull/2582) (@travisgroth) -- DOCS: Standardize Relative Links [#2651](https://github.com/pomerium/pomerium/pull/2651) (@alexfornuto) -- docs: update branding [#2435](https://github.com/pomerium/pomerium/pull/2435) (@desimone) -- docs: update branding, concepts [#2445](https://github.com/pomerium/pomerium/pull/2445) (@desimone) -- docs: update codeowners [#2451](https://github.com/pomerium/pomerium/pull/2451) (@travisgroth) -- Docs: Update Community Page [#2713](https://github.com/pomerium/pomerium/pull/2713) (@cmo-pomerium) -- docs: update default version to v0.15 [#2437](https://github.com/pomerium/pomerium/pull/2437) (@travisgroth) -- docs: update enterprise helm instructions to use main repo [#2463](https://github.com/pomerium/pomerium/pull/2463) (@travisgroth) -- DOCS: Update Enterprise Reference Docs [#2599](https://github.com/pomerium/pomerium/pull/2599) (@alexfornuto) -- Docs: Update Traefik Example Headers [#2732](https://github.com/pomerium/pomerium/pull/2732) (@alexfornuto) -- docs: use generic email [#2484](https://github.com/pomerium/pomerium/pull/2484) (@alexfornuto) -- Docs/batch link fixes [#2621](https://github.com/pomerium/pomerium/pull/2621) (@alexfornuto) -- document binding service to 443 [#2487](https://github.com/pomerium/pomerium/pull/2487) (@alexfornuto) -- Document Enterprise API [#2595](https://github.com/pomerium/pomerium/pull/2595) (@alexfornuto) -- Document moving routes [#2460](https://github.com/pomerium/pomerium/pull/2460) (@alexfornuto) -- Document recovery token generation [#2579](https://github.com/pomerium/pomerium/pull/2579) (@alexfornuto) -- Document tracing sample rate in console [#2461](https://github.com/pomerium/pomerium/pull/2461) (@alexfornuto) -- Enterprise Upgrade & Changelog Pages [#2453](https://github.com/pomerium/pomerium/pull/2453) (@alexfornuto) -- Fix typo in docs [#2683](https://github.com/pomerium/pomerium/pull/2683) (@nihaals) -- Fixed 'kubtctl' typo on releases page [#2673](https://github.com/pomerium/pomerium/pull/2673) (@ChaosInTheCRD) -- Minor fix in routes documentation [#2714](https://github.com/pomerium/pomerium/pull/2714) (@Kerwood) -- New Topic Page: Original Request Context [#2569](https://github.com/pomerium/pomerium/pull/2569) (@alexfornuto) -- Refresh and Update TCP documentation [#2627](https://github.com/pomerium/pomerium/pull/2627) (@alexfornuto) -- specify expected audience in Console config [#2442](https://github.com/pomerium/pomerium/pull/2442) (@alexfornuto) -- TCP Client Doc [#2561](https://github.com/pomerium/pomerium/pull/2561) (@alexfornuto) -- typo [#2644](https://github.com/pomerium/pomerium/pull/2644) (@alexfornuto) -- Update AWS cognito IdP doc [#2498](https://github.com/pomerium/pomerium/pull/2498) (@alexfornuto) -- Update Azure IdP Doc [#2497](https://github.com/pomerium/pomerium/pull/2497) (@alexfornuto) -- Update binary install doc [#2447](https://github.com/pomerium/pomerium/pull/2447) (@alexfornuto) -- Update CODEOWNERS [#2603](https://github.com/pomerium/pomerium/pull/2603) (@alexfornuto) -- Update create TLS command to quote strings. [#2694](https://github.com/pomerium/pomerium/pull/2694) (@FutureMatt) -- Update Docker Quickstart [#2482](https://github.com/pomerium/pomerium/pull/2482) (@alexfornuto) -- update GitHub IdP doc [#2503](https://github.com/pomerium/pomerium/pull/2503) (@alexfornuto) -- Update GitLab IdP doc [#2520](https://github.com/pomerium/pomerium/pull/2520) (@alexfornuto) -- Update Helm Instructions [#2467](https://github.com/pomerium/pomerium/pull/2467) (@alexfornuto) -- Update IdP Overview Page [#2493](https://github.com/pomerium/pomerium/pull/2493) (@alexfornuto) -- Update Okta IdP doc [#2491](https://github.com/pomerium/pomerium/pull/2491) (@alexfornuto) -- update OneLogin IdP doc [#2533](https://github.com/pomerium/pomerium/pull/2533) (@alexfornuto) -- Update overview/architecture.md [#2701](https://github.com/pomerium/pomerium/pull/2701) (@cmo-pomerium) -- Update Ping Identity IdP [#2537](https://github.com/pomerium/pomerium/pull/2537) (@alexfornuto) -- Updates to Enterprise Quickstart instructions [#2480](https://github.com/pomerium/pomerium/pull/2480) (@alexfornuto) -- wrap header example values as inline code. [#2474](https://github.com/pomerium/pomerium/pull/2474) (@alexfornuto) -- Wrap mkcert command in quotes [#2481](https://github.com/pomerium/pomerium/pull/2481) (@alexfornuto) - -### Dependency - -- dependencies: vendor base58, remove shortuuid [#2739](https://github.com/pomerium/pomerium/pull/2739) (@calebdoxsey) -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.9 to 3.21.10 [#2736](https://github.com/pomerium/pomerium/pull/2736) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.33.1 to 0.34.0 [#2735](https://github.com/pomerium/pomerium/pull/2735) (@dependabot[bot]) -- chore(deps): bump github.com/openzipkin/zipkin-go from 0.2.5 to 0.3.0 [#2734](https://github.com/pomerium/pomerium/pull/2734) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/common from 0.31.1 to 0.32.1 [#2706](https://github.com/pomerium/pomerium/pull/2706) (@dependabot[bot]) -- chore(deps): bump github.com/docker/docker from 20.10.9+incompatible to 20.10.10+incompatible [#2705](https://github.com/pomerium/pomerium/pull/2705) (@dependabot[bot]) -- chore(deps): bump gopkg.in/auth0.v5 from 5.19.2 to 5.20.0 [#2704](https://github.com/pomerium/pomerium/pull/2704) (@dependabot[bot]) -- chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 0.6.1 to 0.6.2 [#2703](https://github.com/pomerium/pomerium/pull/2703) (@dependabot[bot]) -- chore(deps): bump github.com/caddyserver/certmagic from 0.14.5 to 0.15.1 [#2685](https://github.com/pomerium/pomerium/pull/2685) (@dependabot[bot]) -- chore(deps): bump github.com/peterbourgon/ff/v3 from 3.1.0 to 3.1.2 [#2672](https://github.com/pomerium/pomerium/pull/2672) (@dependabot[bot]) -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.8 to 3.21.9 [#2671](https://github.com/pomerium/pomerium/pull/2671) (@dependabot[bot]) -- chore(deps): bump github.com/docker/docker from 20.10.8+incompatible to 20.10.9+incompatible [#2670](https://github.com/pomerium/pomerium/pull/2670) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.57.0 to 0.58.0 [#2660](https://github.com/pomerium/pomerium/pull/2660) (@dependabot[bot]) -- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.3 to 8.11.4 [#2659](https://github.com/pomerium/pomerium/pull/2659) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.32.1 to 0.33.1 [#2658](https://github.com/pomerium/pomerium/pull/2658) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/common from 0.31.0 to 0.31.1 [#2656](https://github.com/pomerium/pomerium/pull/2656) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.32.0 to 0.32.1 [#2633](https://github.com/pomerium/pomerium/pull/2633) (@dependabot[bot]) -- chore(deps): bump google.golang.org/grpc from 1.40.0 to 1.41.0 [#2632](https://github.com/pomerium/pomerium/pull/2632) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/common from 0.30.0 to 0.31.0 [#2631](https://github.com/pomerium/pomerium/pull/2631) (@dependabot[bot]) -- chore(deps): bump sigs.k8s.io/yaml from 1.2.0 to 1.3.0 [#2630](https://github.com/pomerium/pomerium/pull/2630) (@dependabot[bot]) -- chore(deps): bump github.com/ory/dockertest/v3 from 3.7.0 to 3.8.0 [#2629](https://github.com/pomerium/pomerium/pull/2629) (@dependabot[bot]) -- chore(deps): bump github.com/spf13/viper from 1.8.1 to 1.9.0 [#2616](https://github.com/pomerium/pomerium/pull/2616) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.56.0 to 0.57.0 [#2615](https://github.com/pomerium/pomerium/pull/2615) (@dependabot[bot]) -- chore(deps): bump github.com/coreos/go-oidc/v3 from 3.0.0 to 3.1.0 [#2614](https://github.com/pomerium/pomerium/pull/2614) (@dependabot[bot]) -- bump protoc-validate [#2606](https://github.com/pomerium/pomerium/pull/2606) (@wasaga) -- chore(deps): bump go.uber.org/zap from 1.19.0 to 1.19.1 [#2592](https://github.com/pomerium/pomerium/pull/2592) (@dependabot[bot]) -- chore(deps): bump github.com/rs/zerolog from 1.24.0 to 1.25.0 [#2591](https://github.com/pomerium/pomerium/pull/2591) (@dependabot[bot]) -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.7 to 3.21.8 [#2577](https://github.com/pomerium/pomerium/pull/2577) (@dependabot[bot]) -- chore(deps): bump github.com/golangci/golangci-lint from 1.42.0 to 1.42.1 [#2576](https://github.com/pomerium/pomerium/pull/2576) (@dependabot[bot]) -- chore(deps): bump github.com/caddyserver/certmagic from 0.14.4 to 0.14.5 [#2575](https://github.com/pomerium/pomerium/pull/2575) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.54.0 to 0.56.0 [#2574](https://github.com/pomerium/pomerium/pull/2574) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.31.0 to 0.32.0 [#2573](https://github.com/pomerium/pomerium/pull/2573) (@dependabot[bot]) -- chore(deps): bump github.com/fsnotify/fsnotify from 1.5.0 to 1.5.1 [#2554](https://github.com/pomerium/pomerium/pull/2554) (@dependabot[bot]) -- chore(deps): bump github.com/caddyserver/certmagic from 0.14.3 to 0.14.4 [#2553](https://github.com/pomerium/pomerium/pull/2553) (@dependabot[bot]) -- chore(deps): bump github.com/rs/zerolog from 1.23.0 to 1.24.0 [#2552](https://github.com/pomerium/pomerium/pull/2552) (@dependabot[bot]) -- chore(deps): bump github.com/docker/docker from 20.10.7+incompatible to 20.10.8+incompatible [#2551](https://github.com/pomerium/pomerium/pull/2551) (@dependabot[bot]) -- chore(deps): bump github.com/caddyserver/certmagic from 0.14.1 to 0.14.3 [#2550](https://github.com/pomerium/pomerium/pull/2550) (@dependabot[bot]) -- chore(deps): bump contrib.go.opencensus.io/exporter/prometheus from 0.3.0 to 0.4.0 [#2549](https://github.com/pomerium/pomerium/pull/2549) (@dependabot[bot]) -- chore(deps): bump github.com/cespare/xxhash/v2 from 2.1.1 to 2.1.2 [#2548](https://github.com/pomerium/pomerium/pull/2548) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/procfs from 0.7.2 to 0.7.3 [#2512](https://github.com/pomerium/pomerium/pull/2512) (@dependabot[bot]) -- chore(deps): bump github.com/golangci/golangci-lint from 1.41.1 to 1.42.0 [#2511](https://github.com/pomerium/pomerium/pull/2511) (@dependabot[bot]) -- chore(deps): bump github.com/fsnotify/fsnotify from 1.4.9 to 1.5.0 [#2510](https://github.com/pomerium/pomerium/pull/2510) (@dependabot[bot]) -- ci: use go 1.17.x [#2492](https://github.com/pomerium/pomerium/pull/2492) (@desimone) -- chore(deps): bump google.golang.org/grpc from 1.39.1 to 1.40.0 [#2478](https://github.com/pomerium/pomerium/pull/2478) (@dependabot[bot]) -- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.2 to 8.11.3 [#2477](https://github.com/pomerium/pomerium/pull/2477) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.52.0 to 0.54.0 [#2476](https://github.com/pomerium/pomerium/pull/2476) (@dependabot[bot]) -- chore(deps): bump go.uber.org/zap from 1.18.1 to 1.19.0 [#2475](https://github.com/pomerium/pomerium/pull/2475) (@dependabot[bot]) -- ci: support darwn/arm64 aka m1 for cli [#2473](https://github.com/pomerium/pomerium/pull/2473) (@desimone) -- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.1 to 8.11.2 [#2459](https://github.com/pomerium/pomerium/pull/2459) (@backport-actions-token[bot]) -- chore(deps): bump google.golang.org/grpc from 1.39.0 to 1.39.1 [#2457](https://github.com/pomerium/pomerium/pull/2457) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/procfs from 0.7.1 to 0.7.2 [#2456](https://github.com/pomerium/pomerium/pull/2456) (@dependabot[bot]) -- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.1 to 8.11.2 [#2455](https://github.com/pomerium/pomerium/pull/2455) (@dependabot[bot]) -- Hadolint [#2363](https://github.com/pomerium/pomerium/pull/2363) (@stephengroat) - -### Changed - -- ci: remove hadolint [#2726](https://github.com/pomerium/pomerium/pull/2726) (@travisgroth) -- ci: ignore multiple run commands [#2566](https://github.com/pomerium/pomerium/pull/2566) (@travisgroth) -- redirect logo to the marketing site [#2441](https://github.com/pomerium/pomerium/pull/2441) (@alexfornuto) -- deployment: remove DST_Root_CA_X3 from docker images [#2677](https://github.com/pomerium/pomerium/pull/2677) (@travisgroth) -- deployment: update goreleaser syntax [#2524](https://github.com/pomerium/pomerium/pull/2524) (@travisgroth) - -## [v0.15.5](https://github.com/pomerium/pomerium/tree/v0.15.5) (2021-10-22) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.15.4...v0.15.5) - -### New - -- skip configuration updates to the most recent one [#2692](https://github.com/pomerium/pomerium/pull/2692) (@backport-actions-token[bot]) - -### Changed - -- Update create TLS command to quote strings. [#2697](https://github.com/pomerium/pomerium/pull/2697) (@backport-actions-token[bot]) -- DOCS: CORS preflight in console [#2693](https://github.com/pomerium/pomerium/pull/2693) (@backport-actions-token[bot]) -- Docs: Correct Claim Example [#2691](https://github.com/pomerium/pomerium/pull/2691) (@backport-actions-token[bot]) -- Fix typo in docs [#2684](https://github.com/pomerium/pomerium/pull/2684) (@backport-actions-token[bot]) -- deployment: remove DST_Root_CA_X3 from docker images [#2698](https://github.com/pomerium/pomerium/pull/2698) (@travisgroth) - -## [v0.15.4](https://github.com/pomerium/pomerium/tree/v0.15.4) (2021-10-14) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.15.3...v0.15.4) - -### New - -- protoutil: add NewAny method for deterministic serialization [#2662](https://github.com/pomerium/pomerium/pull/2662) (@backport-actions-token[bot]) - -### Fixed - -- backport: host rewrite [#2669](https://github.com/pomerium/pomerium/pull/2669) (@wasaga) - -### Documentation - -- Add redirect for installation [#2620](https://github.com/pomerium/pomerium/pull/2620) (@backport-actions-token[bot]) -- add service account redirects [#2665](https://github.com/pomerium/pomerium/pull/2665) (@backport-actions-token[bot]) -- DOC: Copy edits to Okta IdP doc. [#2625](https://github.com/pomerium/pomerium/pull/2625) (@backport-actions-token[bot]) -- Docs: Batch Updates [#2640](https://github.com/pomerium/pomerium/pull/2640) (@backport-actions-token[bot]) -- DOCS: Collapse IDP Header [#2649](https://github.com/pomerium/pomerium/pull/2649) (@backport-actions-token[bot]) -- Docs: cross-reference links between concepts and reference [#2650](https://github.com/pomerium/pomerium/pull/2650) (@backport-actions-token[bot]) -- Docs: Ingress Controller [#2667](https://github.com/pomerium/pomerium/pull/2667) (@alexfornuto) -- docs: remove extra word / updated docs link [#2639](https://github.com/pomerium/pomerium/pull/2639) (@backport-actions-token[bot]) -- DOCS: Standardize Relative Links (#2651) [#2654](https://github.com/pomerium/pomerium/pull/2654) (@alexfornuto) -- DOCS: Update Enterprise Reference Docs [#2624](https://github.com/pomerium/pomerium/pull/2624) (@backport-actions-token[bot]) -- Docs/batch link fixes [#2622](https://github.com/pomerium/pomerium/pull/2622) (@backport-actions-token[bot]) -- Document Enterprise API [#2619](https://github.com/pomerium/pomerium/pull/2619) (@backport-actions-token[bot]) -- Fixed 'kubtctl' typo on releases page [#2680](https://github.com/pomerium/pomerium/pull/2680) (@backport-actions-token[bot]) -- Refresh and Update TCP documentation [#2679](https://github.com/pomerium/pomerium/pull/2679) (@backport-actions-token[bot]) -- TCP Client Doc [#2626](https://github.com/pomerium/pomerium/pull/2626) (@backport-actions-token[bot]) -- typo [#2646](https://github.com/pomerium/pomerium/pull/2646) (@backport-actions-token[bot]) - -## [v0.15.3](https://github.com/pomerium/pomerium/tree/v0.15.3) (2021-09-17) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.15.2...v0.15.3) - -### New - -- cli: update tcp log output format [#2587](https://github.com/pomerium/pomerium/pull/2587) (@travisgroth) - -### Fixed - -- backport 2593 and 2594 to 0.15 [#2598](https://github.com/pomerium/pomerium/pull/2598) (@calebdoxsey) - -### Documentation - -- Add docs team as a code owner of packages.json [#2607](https://github.com/pomerium/pomerium/pull/2607) (@backport-actions-token[bot]) -- DOCS: Add copy button to code snippets [#2600](https://github.com/pomerium/pomerium/pull/2600) (@backport-actions-token[bot]) -- docs: add updated icon asset [#2581](https://github.com/pomerium/pomerium/pull/2581) (@backport-actions-token[bot]) -- docs: rename updated icon image [#2583](https://github.com/pomerium/pomerium/pull/2583) (@backport-actions-token[bot]) -- Document recovery token generation [#2601](https://github.com/pomerium/pomerium/pull/2601) (@backport-actions-token[bot]) -- New Topic Page: Original Request Context [#2602](https://github.com/pomerium/pomerium/pull/2602) (@backport-actions-token[bot]) - -### Changed - -- Update CODEOWNERS [#2604](https://github.com/pomerium/pomerium/pull/2604) (@backport-actions-token[bot]) - -## [v0.15.2](https://github.com/pomerium/pomerium/tree/v0.15.2) (2021-09-03) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.8...v0.15.2) - -### New - -- allow pomerium to start without certs [#2556](https://github.com/pomerium/pomerium/pull/2556) (@backport-actions-token[bot]) - -### Fixed - -- authorize: use session.user_id in headers [#2572](https://github.com/pomerium/pomerium/pull/2572) (@backport-actions-token[bot]) -- ppl: use session.user_id instead of user.id for user criterion [#2563](https://github.com/pomerium/pomerium/pull/2563) (@backport-actions-token[bot]) -- authorize: fix google cloudrun header audience [#2560](https://github.com/pomerium/pomerium/pull/2560) (@backport-actions-token[bot]) -- authorize: fix X-Pomerium-Claim-Groups [#2540](https://github.com/pomerium/pomerium/pull/2540) (@backport-actions-token[bot]) - -### Documentation - -- docs: enterprise console v0.15.2 changelog [#2565](https://github.com/pomerium/pomerium/pull/2565) (@backport-actions-token[bot]) -- Docs: Fix merged PR [#2547](https://github.com/pomerium/pomerium/pull/2547) (@backport-actions-token[bot]) -- Update Ping Identity IdP [#2545](https://github.com/pomerium/pomerium/pull/2545) (@backport-actions-token[bot]) -- update OneLogin IdP doc [#2544](https://github.com/pomerium/pomerium/pull/2544) (@backport-actions-token[bot]) -- docs: enterprise v0.15.1 changelog [#2543](https://github.com/pomerium/pomerium/pull/2543) (@backport-actions-token[bot]) -- Updates to Enterprise Quickstart instructions [#2531](https://github.com/pomerium/pomerium/pull/2531) (@backport-actions-token[bot]) - -## [v0.15.0](https://github.com/pomerium/pomerium/tree/v0.15.0) (2021-08-05) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.7...v0.15.0) - -### Breaking - -- config: remove support for ed25519 signing keys [#2430](https://github.com/pomerium/pomerium/pull/2430) (@calebdoxsey) - -### New - -- authorize: add additional tracing for rego evaluation [#2381](https://github.com/pomerium/pomerium/pull/2381) (@calebdoxsey) -- authorize: log additional session details [#2419](https://github.com/pomerium/pomerium/pull/2419) (@calebdoxsey) -- authorize: log service account and impersonation details [#2354](https://github.com/pomerium/pomerium/pull/2354) (@calebdoxsey) -- authorize: remove service account impersonate user id, email and groups [#2365](https://github.com/pomerium/pomerium/pull/2365) (@calebdoxsey) -- ci: use revive instead of golint [#2370](https://github.com/pomerium/pomerium/pull/2370) (@calebdoxsey) -- config: add support for embedded PPL policy [#2401](https://github.com/pomerium/pomerium/pull/2401) (@calebdoxsey) -- config: add warning about http URLs [#2358](https://github.com/pomerium/pomerium/pull/2358) (@calebdoxsey) -- directory: add logging http client to help with debugging outbound http requests [#2385](https://github.com/pomerium/pomerium/pull/2385) (@calebdoxsey) -- envoyconfig: add bootstrap layered runtime configuration [#2343](https://github.com/pomerium/pomerium/pull/2343) (@calebdoxsey) -- envoyconfig: default zipkin path to / when empty [#2359](https://github.com/pomerium/pomerium/pull/2359) (@calebdoxsey) -- envoyconfig: improvements [#2402](https://github.com/pomerium/pomerium/pull/2402) (@calebdoxsey) -- evaluator: use `cryptutil.Hash` for script spans [#2384](https://github.com/pomerium/pomerium/pull/2384) (@desimone) -- k8s: add flush-credentials command [#2379](https://github.com/pomerium/pomerium/pull/2379) (@calebdoxsey) -- ppl: remove support for aliases [#2400](https://github.com/pomerium/pomerium/pull/2400) (@calebdoxsey) -- registry/redis: call publish from within lua function [#2337](https://github.com/pomerium/pomerium/pull/2337) (@calebdoxsey) -- sessions: add impersonate_session_id, remove legacy impersonation [#2407](https://github.com/pomerium/pomerium/pull/2407) (@calebdoxsey) -- telemetry: add nonce and make explicit ack/nack [#2434](https://github.com/pomerium/pomerium/pull/2434) (@wasaga) -- telemetry: try guess hostname or external IP addr for metrics [#2412](https://github.com/pomerium/pomerium/pull/2412) (@wasaga) -- tools: add tools.go to pin go run apps [#2344](https://github.com/pomerium/pomerium/pull/2344) (@calebdoxsey) -- urlutil: improve error message for urls with port in path [#2377](https://github.com/pomerium/pomerium/pull/2377) (@calebdoxsey) - -### Fixed - -- authorize: add sid to JWT claims [#2420](https://github.com/pomerium/pomerium/pull/2420) (@calebdoxsey) -- authorize: allow redirects on deny [#2361](https://github.com/pomerium/pomerium/pull/2361) (@calebdoxsey) -- authorize: decode CheckRequest path for redirect [#2357](https://github.com/pomerium/pomerium/pull/2357) (@calebdoxsey) -- authorize: support boolean deny results [#2338](https://github.com/pomerium/pomerium/pull/2338) (@calebdoxsey) -- ci: update gcloud action [#2393](https://github.com/pomerium/pomerium/pull/2393) (@travisgroth) -- config: remove grpc server max connection age options [#2427](https://github.com/pomerium/pomerium/pull/2427) (@calebdoxsey) -- disable http/2 for websockets [#2399](https://github.com/pomerium/pomerium/pull/2399) (@calebdoxsey) -- envoy: only check for pid with monitor [#2355](https://github.com/pomerium/pomerium/pull/2355) (@calebdoxsey) -- envoyconfig: only delete cached files, ignore noisy error [#2356](https://github.com/pomerium/pomerium/pull/2356) (@calebdoxsey) -- fix: timeout in protobuf [#2341](https://github.com/pomerium/pomerium/pull/2341) (@wasaga) -- google: remove WithHTTPClient [#2391](https://github.com/pomerium/pomerium/pull/2391) (@calebdoxsey) -- telemetry: support b3 headers on gRPC server calls [#2376](https://github.com/pomerium/pomerium/pull/2376) (@calebdoxsey) - -### Security - -- envoy: only allow embedding [#2368](https://github.com/pomerium/pomerium/pull/2368) (@calebdoxsey) - -### Documentation - -- doc updates [#2433](https://github.com/pomerium/pomerium/pull/2433) (@calebdoxsey) -- Docs bug fixes [#2362](https://github.com/pomerium/pomerium/pull/2362) (@alexfornuto) -- Docs sorting [#2346](https://github.com/pomerium/pomerium/pull/2346) (@alexfornuto) -- docs: clarify device identity, not state via client certs [#2428](https://github.com/pomerium/pomerium/pull/2428) (@desimone) -- docs: only secure schemes are supported [#2408](https://github.com/pomerium/pomerium/pull/2408) (@desimone) -- docs/reference: Clarify use of idp_service_account [#2431](https://github.com/pomerium/pomerium/pull/2431) (@the-maldridge) -- Enterprise Docs [#2390](https://github.com/pomerium/pomerium/pull/2390) (@alexfornuto) -- Installation Docs Restructuring [#2406](https://github.com/pomerium/pomerium/pull/2406) (@alexfornuto) -- symlink security policy to root of project [#2396](https://github.com/pomerium/pomerium/pull/2396) (@desimone) -- Update Console installs to match signing_key [#2432](https://github.com/pomerium/pomerium/pull/2432) (@alexfornuto) -- Update installation source for mkcert [#2340](https://github.com/pomerium/pomerium/pull/2340) (@alexfornuto) -- update v0.15 changelog [#2436](https://github.com/pomerium/pomerium/pull/2436) (@travisgroth) -- v0.15 release notes [#2409](https://github.com/pomerium/pomerium/pull/2409) (@travisgroth) - -### Dependency - -- chore(deps): bump github.com/caddyserver/certmagic from 0.14.0 to 0.14.1 [#2352](https://github.com/pomerium/pomerium/pull/2352) (@dependabot[bot]) - -- chore(deps): bump github.com/go-jose/go-jose/v3 from 3.0.0-rc.1 to 3.0.0 [#2421](https://github.com/pomerium/pomerium/pull/2421) (@dependabot[bot]) - -- chore(deps): bump github.com/go-redis/redis/v8 from 8.10.0 to 8.11.0 [#2329](https://github.com/pomerium/pomerium/pull/2329) (@dependabot[bot]) -- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.0 to 8.11.1 [#2413](https://github.com/pomerium/pomerium/pull/2413) (@dependabot[bot]) -- chore(deps): bump github.com/golangci/golangci-lint from 1.40.1 to 1.41.1 [#2353](https://github.com/pomerium/pomerium/pull/2353) (@dependabot[bot]) -- chore(deps): bump github.com/google/uuid from 1.2.0 to 1.3.0 [#2374](https://github.com/pomerium/pomerium/pull/2374) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.29.4 to 0.30.1 [#2323](https://github.com/pomerium/pomerium/pull/2323) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.30.1 to 0.30.2 [#2373](https://github.com/pomerium/pomerium/pull/2373) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.30.2 to 0.31.0 [#2416](https://github.com/pomerium/pomerium/pull/2416) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/common from 0.29.0 to 0.30.0 [#2417](https://github.com/pomerium/pomerium/pull/2417) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/procfs from 0.6.0 to 0.7.0 [#2328](https://github.com/pomerium/pomerium/pull/2328) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/procfs from 0.7.0 to 0.7.1 [#2395](https://github.com/pomerium/pomerium/pull/2395) (@dependabot[bot]) -- chore(deps): bump github.com/rs/cors from 1.7.0 to 1.8.0 [#2334](https://github.com/pomerium/pomerium/pull/2334) (@dependabot[bot]) -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.5 to 3.21.6 [#2326](https://github.com/pomerium/pomerium/pull/2326) (@dependabot[bot]) -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.6 to 3.21.7 [#2414](https://github.com/pomerium/pomerium/pull/2414) (@dependabot[bot]) -- chore(deps): bump github.com/spf13/cobra from 1.1.3 to 1.2.1 [#2330](https://github.com/pomerium/pomerium/pull/2330) (@dependabot[bot]) -- chore(deps): bump go.uber.org/zap from 1.17.0 to 1.18.1 [#2325](https://github.com/pomerium/pomerium/pull/2325) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.49.0 to 0.50.0 [#2333](https://github.com/pomerium/pomerium/pull/2333) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.50.0 to 0.51.0 [#2394](https://github.com/pomerium/pomerium/pull/2394) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.51.0 to 0.52.0 [#2415](https://github.com/pomerium/pomerium/pull/2415) (@dependabot[bot]) -- chore(deps): bump google.golang.org/grpc from 1.38.0 to 1.39.0 [#2324](https://github.com/pomerium/pomerium/pull/2324) (@dependabot[bot]) -- chore(deps): bump gopkg.in/auth0.v5 from 5.19.1 to 5.19.2 [#2422](https://github.com/pomerium/pomerium/pull/2422) (@dependabot[bot]) -- chore(deps): upgrade kind action to v1.2.0 [#2331](https://github.com/pomerium/pomerium/pull/2331) (@travisgroth) -- ci: convert to FOSSA scan [#2371](https://github.com/pomerium/pomerium/pull/2371) (@travisgroth) - -### Changed - -- build: add envoy files to `make clean` [#2411](https://github.com/pomerium/pomerium/pull/2411) (@travisgroth) - -- ci: use github app for backport credentials [#2369](https://github.com/pomerium/pomerium/pull/2369) (@travisgroth) - -- databroker: tests [#2367](https://github.com/pomerium/pomerium/pull/2367) (@calebdoxsey) - -- envoy: bump to 1.19 [#2392](https://github.com/pomerium/pomerium/pull/2392) (@travisgroth) -- redis: increase timeout on test [#2425](https://github.com/pomerium/pomerium/pull/2425) (@calebdoxsey) -- redis: refactor change signal test to be more deterministic [#2335](https://github.com/pomerium/pomerium/pull/2335) (@calebdoxsey) -- storage/inmemory: add tests for close behavior [#2336](https://github.com/pomerium/pomerium/pull/2336) (@calebdoxsey) - -## [v0.14.8](https://github.com/pomerium/pomerium/tree/v0.14.8) (2021-08-26) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.15.1...v0.14.8) - -### Security - -- deps: bump envoy to v0.17.4 [#2535](https://github.com/pomerium/pomerium/pull/2535) (@travisgroth) - -### Documentation - -- Docs backporting [#2351](https://github.com/pomerium/pomerium/pull/2351) (@alexfornuto) -- Docs bug fixes [#2364](https://github.com/pomerium/pomerium/pull/2364) (@github-actions[bot]) -- docs: google gcp / workspace instructions [#2350](https://github.com/pomerium/pomerium/pull/2350) (@github-actions[bot]) -- docs: only secure schemes are supported [#2410](https://github.com/pomerium/pomerium/pull/2410) (@backport-actions-token[bot]) - -### Dependency - -- chore(deps): upgrade kind action to v1.2.0 (#2281) [#2366](https://github.com/pomerium/pomerium/pull/2366) (@travisgroth) - -### Changed - -- ci: update gcloud action [#2538](https://github.com/pomerium/pomerium/pull/2538) (@backport-actions-token[bot]) - -## [v0.15.1](https://github.com/pomerium/pomerium/tree/v0.15.1) (2021-08-25) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.15.0...v0.15.1) - -### Fixed - -- options: remove refresh_cooldown, add allow_spdy to proto [#2448](https://github.com/pomerium/pomerium/pull/2448) (@backport-actions-token[bot]) - -### Security - -- deps: update envoy to 1.19.1 [#2527](https://github.com/pomerium/pomerium/pull/2527) (@backport-actions-token[bot]) - -### Documentation - -- adjust comment blocking [#2489](https://github.com/pomerium/pomerium/pull/2489) (@backport-actions-token[bot]) -- Auth0 Doc Refresh [#2500](https://github.com/pomerium/pomerium/pull/2500) (@backport-actions-token[bot]) -- docs: clarify custom request header limitations [#2472](https://github.com/pomerium/pomerium/pull/2472) (@backport-actions-token[bot]) -- docs: update branding [#2440](https://github.com/pomerium/pomerium/pull/2440) (@backport-actions-token[bot]) -- docs: update branding, concepts [#2449](https://github.com/pomerium/pomerium/pull/2449) (@backport-actions-token[bot]) -- docs: update codeowners [#2506](https://github.com/pomerium/pomerium/pull/2506) (@backport-actions-token[bot]) -- docs: update default version to v0.15 [#2438](https://github.com/pomerium/pomerium/pull/2438) (@backport-actions-token[bot]) -- docs: update enterprise helm instructions to use main repo [#2464](https://github.com/pomerium/pomerium/pull/2464) (@backport-actions-token[bot]) -- docs: use generic email [#2485](https://github.com/pomerium/pomerium/pull/2485) (@backport-actions-token[bot]) -- document binding service to 443 [#2499](https://github.com/pomerium/pomerium/pull/2499) (@backport-actions-token[bot]) -- Document moving routes [#2466](https://github.com/pomerium/pomerium/pull/2466) (@backport-actions-token[bot]) -- Document tracing sample rate in console [#2465](https://github.com/pomerium/pomerium/pull/2465) (@backport-actions-token[bot]) -- Enterprise Upgrade & Changelog Pages [#2458](https://github.com/pomerium/pomerium/pull/2458) (@backport-actions-token[bot]) -- redirect logo to the marketing site [#2443](https://github.com/pomerium/pomerium/pull/2443) (@backport-actions-token[bot]) -- Remove api from GitLab defaultScope [#2528](https://github.com/pomerium/pomerium/pull/2528) (@backport-actions-token[bot]) -- specify expected audience in Console config [#2444](https://github.com/pomerium/pomerium/pull/2444) (@backport-actions-token[bot]) -- Update AWS cognito IdP doc [#2501](https://github.com/pomerium/pomerium/pull/2501) (@backport-actions-token[bot]) -- Update Azure IdP Doc [#2504](https://github.com/pomerium/pomerium/pull/2504) (@backport-actions-token[bot]) -- Update binary install doc [#2452](https://github.com/pomerium/pomerium/pull/2452) (@backport-actions-token[bot]) -- Update Docker Quickstart (#2482) [#2486](https://github.com/pomerium/pomerium/pull/2486) (@alexfornuto) -- update GitHub IdP doc [#2508](https://github.com/pomerium/pomerium/pull/2508) (@backport-actions-token[bot]) -- Update GitLab IdP doc [#2529](https://github.com/pomerium/pomerium/pull/2529) (@backport-actions-token[bot]) -- Update Helm Instructions [#2505](https://github.com/pomerium/pomerium/pull/2505) (@backport-actions-token[bot]) -- Update IdP Overview Page [#2502](https://github.com/pomerium/pomerium/pull/2502) (@backport-actions-token[bot]) -- Update Okta IdP doc [#2495](https://github.com/pomerium/pomerium/pull/2495) (@backport-actions-token[bot]) -- wrap header example values as inline code. [#2479](https://github.com/pomerium/pomerium/pull/2479) (@backport-actions-token[bot]) - -### Dependency - -- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.1 to 8.11.2 [#2459](https://github.com/pomerium/pomerium/pull/2459) (@backport-actions-token[bot]) - -### Deployment - -- deployment: update goreleaser syntax [#2525](https://github.com/pomerium/pomerium/pull/2525) (@backport-actions-token[bot]) -- ci: support darwn/arm64 aka m1 for cli [#2521](https://github.com/pomerium/pomerium/pull/2521) (@travisgroth) - -## [v0.15.0](https://github.com/pomerium/pomerium/tree/v0.15.0) (2021-08-05) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.7...v0.15.0) - -### Breaking - -- config: remove support for ed25519 signing keys [#2430](https://github.com/pomerium/pomerium/pull/2430) (@calebdoxsey) - -### New - -- authorize: add additional tracing for rego evaluation [#2381](https://github.com/pomerium/pomerium/pull/2381) (@calebdoxsey) -- authorize: do not send redirects to gRPC [#2314](https://github.com/pomerium/pomerium/pull/2314) (@wasaga) -- authorize: handle grpc-web content types like json [#2268](https://github.com/pomerium/pomerium/pull/2268) (@calebdoxsey) -- authorize: log additional session details [#2419](https://github.com/pomerium/pomerium/pull/2419) (@calebdoxsey) -- authorize: log service account and impersonation details [#2354](https://github.com/pomerium/pomerium/pull/2354) (@calebdoxsey) -- authorize: preserve original context [#2247](https://github.com/pomerium/pomerium/pull/2247) (@wasaga) -- authorize: remove service account impersonate user id, email and groups [#2365](https://github.com/pomerium/pomerium/pull/2365) (@calebdoxsey) -- certs: reject certs from databroker if they conflict with local [#2309](https://github.com/pomerium/pomerium/pull/2309) (@wasaga) -- ci: use revive instead of golint [#2370](https://github.com/pomerium/pomerium/pull/2370) (@calebdoxsey) -- cli: use proxy from environment [#2316](https://github.com/pomerium/pomerium/pull/2316) (@tskinn) -- config: add enable_google_cloud_serverless_authentication to config protobuf [#2306](https://github.com/pomerium/pomerium/pull/2306) (@calebdoxsey) -- config: add support for embedded PPL policy [#2401](https://github.com/pomerium/pomerium/pull/2401) (@calebdoxsey) -- config: add warning about http URLs [#2358](https://github.com/pomerium/pomerium/pull/2358) (@calebdoxsey) -- databroker: implement leases [#2172](https://github.com/pomerium/pomerium/pull/2172) (@calebdoxsey) -- directory: add logging http client to help with debugging outbound http requests [#2385](https://github.com/pomerium/pomerium/pull/2385) (@calebdoxsey) -- envoy: add full version [#2287](https://github.com/pomerium/pomerium/pull/2287) (@calebdoxsey) -- envoy: disable timeouts for kubernetes [#2189](https://github.com/pomerium/pomerium/pull/2189) (@calebdoxsey) -- envoy: refactor envoy embedding [#2296](https://github.com/pomerium/pomerium/pull/2296) (@calebdoxsey) -- envoyconfig: add bootstrap layered runtime configuration [#2343](https://github.com/pomerium/pomerium/pull/2343) (@calebdoxsey) -- envoyconfig: default zipkin path to / when empty [#2359](https://github.com/pomerium/pomerium/pull/2359) (@calebdoxsey) -- envoyconfig: improvements [#2402](https://github.com/pomerium/pomerium/pull/2402) (@calebdoxsey) -- envoyconfig: use zipkin tracer [#2265](https://github.com/pomerium/pomerium/pull/2265) (@calebdoxsey) -- evaluator: use `cryptutil.Hash` for script spans [#2384](https://github.com/pomerium/pomerium/pull/2384) (@desimone) -- k8s: add flush-credentials command [#2379](https://github.com/pomerium/pomerium/pull/2379) (@calebdoxsey) -- Pomerium Policy Language [#2202](https://github.com/pomerium/pomerium/pull/2202) (@calebdoxsey) -- ppl: add data type, implement string and list matchers [#2228](https://github.com/pomerium/pomerium/pull/2228) (@calebdoxsey) -- ppl: convert config policy to ppl [#2218](https://github.com/pomerium/pomerium/pull/2218) (@calebdoxsey) -- ppl: refactor authorize to evaluate PPL [#2224](https://github.com/pomerium/pomerium/pull/2224) (@calebdoxsey) -- ppl: remove support for aliases [#2400](https://github.com/pomerium/pomerium/pull/2400) (@calebdoxsey) -- proxy: add idle timeout [#2319](https://github.com/pomerium/pomerium/pull/2319) (@wasaga) -- registry: implement redis backend [#2179](https://github.com/pomerium/pomerium/pull/2179) (@calebdoxsey) -- registry/redis: call publish from within lua function [#2337](https://github.com/pomerium/pomerium/pull/2337) (@calebdoxsey) -- report instance hostname in xds events [#2175](https://github.com/pomerium/pomerium/pull/2175) (@wasaga) -- sessions: add impersonate_session_id, remove legacy impersonation [#2407](https://github.com/pomerium/pomerium/pull/2407) (@calebdoxsey) -- telemetry: add hostname tag to metrics [#2191](https://github.com/pomerium/pomerium/pull/2191) (@wasaga) -- telemetry: add nonce and make explicit ack/nack [#2434](https://github.com/pomerium/pomerium/pull/2434) (@wasaga) -- telemetry: try guess hostname or external IP addr for metrics [#2412](https://github.com/pomerium/pomerium/pull/2412) (@wasaga) -- tools: add tools.go to pin go run apps [#2344](https://github.com/pomerium/pomerium/pull/2344) (@calebdoxsey) -- urlutil: improve error message for urls with port in path [#2377](https://github.com/pomerium/pomerium/pull/2377) (@calebdoxsey) -- xds: retry storing configuration events [#2266](https://github.com/pomerium/pomerium/pull/2266) (@calebdoxsey) - -### Fixed - -- authorize: add sid to JWT claims [#2420](https://github.com/pomerium/pomerium/pull/2420) (@calebdoxsey) -- authorize: allow redirects on deny [#2361](https://github.com/pomerium/pomerium/pull/2361) (@calebdoxsey) -- authorize: decode CheckRequest path for redirect [#2357](https://github.com/pomerium/pomerium/pull/2357) (@calebdoxsey) -- authorize: grpc health check [#2200](https://github.com/pomerium/pomerium/pull/2200) (@wasaga) -- authorize: only redirect for HTML pages [#2264](https://github.com/pomerium/pomerium/pull/2264) (@calebdoxsey) -- authorize: round timestamp [#2258](https://github.com/pomerium/pomerium/pull/2258) (@wasaga) -- authorize: support boolean deny results [#2338](https://github.com/pomerium/pomerium/pull/2338) (@calebdoxsey) -- ci: update gcloud action [#2393](https://github.com/pomerium/pomerium/pull/2393) (@travisgroth) -- config: remove grpc server max connection age options [#2427](https://github.com/pomerium/pomerium/pull/2427) (@calebdoxsey) -- config: warn about unrecognized keys [#2256](https://github.com/pomerium/pomerium/pull/2256) (@wasaga) -- darwin: use gopsutil v3 to fix arm issue [#2245](https://github.com/pomerium/pomerium/pull/2245) (@calebdoxsey) -- databroker: only tag contexts used for UpdateRecords [#2269](https://github.com/pomerium/pomerium/pull/2269) (@wasaga) -- deployment: fix empty version on master builds [#2193](https://github.com/pomerium/pomerium/pull/2193) (@travisgroth) -- directory/azure: add paging support to user group members call [#2311](https://github.com/pomerium/pomerium/pull/2311) (@calebdoxsey) -- disable http/2 for websockets [#2399](https://github.com/pomerium/pomerium/pull/2399) (@calebdoxsey) -- envoy: add global response headers to local replies [#2217](https://github.com/pomerium/pomerium/pull/2217) (@calebdoxsey) -- envoy: always set jwt claim headers even if no value is available [#2261](https://github.com/pomerium/pomerium/pull/2261) (@calebdoxsey) -- envoy: disable hot-reload for macos [#2259](https://github.com/pomerium/pomerium/pull/2259) (@calebdoxsey) -- envoy: exit if envoy exits [#2240](https://github.com/pomerium/pomerium/pull/2240) (@calebdoxsey) -- envoy: fix usage of codec_type with alpn [#2277](https://github.com/pomerium/pomerium/pull/2277) (@calebdoxsey) -- envoy: only check for pid with monitor [#2355](https://github.com/pomerium/pomerium/pull/2355) (@calebdoxsey) -- envoyconfig: fallback to global custom ca when no policy ca is defined [#2235](https://github.com/pomerium/pomerium/pull/2235) (@calebdoxsey) -- envoyconfig: only delete cached files, ignore noisy error [#2356](https://github.com/pomerium/pomerium/pull/2356) (@calebdoxsey) -- fix: timeout in protobuf [#2341](https://github.com/pomerium/pomerium/pull/2341) (@wasaga) -- forward auth: don't strip query parameters [#2216](https://github.com/pomerium/pomerium/pull/2216) (@wasaga) -- google: remove WithHTTPClient [#2391](https://github.com/pomerium/pomerium/pull/2391) (@calebdoxsey) -- ocsp: reload on response changes [#2286](https://github.com/pomerium/pomerium/pull/2286) (@wasaga) -- options: s/shared-key/shared secret [#2257](https://github.com/pomerium/pomerium/pull/2257) (@desimone) -- policy: fix allowed idp claims PPL generation [#2243](https://github.com/pomerium/pomerium/pull/2243) (@calebdoxsey) -- PPL: bubble up values, bug fixes [#2213](https://github.com/pomerium/pomerium/pull/2213) (@calebdoxsey) -- ppl: fix not/nor rules [#2313](https://github.com/pomerium/pomerium/pull/2313) (@calebdoxsey) -- proxy / controplane: use old upstream cipher suite [#2196](https://github.com/pomerium/pomerium/pull/2196) (@desimone) -- redis: enforce capacity via ZREVRANGE to avoid race [#2267](https://github.com/pomerium/pomerium/pull/2267) (@calebdoxsey) -- Revert "authenticate,proxy: add same site lax to cookies" [#2203](https://github.com/pomerium/pomerium/pull/2203) (@desimone) -- telemetry: support b3 headers on gRPC server calls [#2376](https://github.com/pomerium/pomerium/pull/2376) (@calebdoxsey) -- tracing: support dynamic reloading, more aggressive envoy restart [#2262](https://github.com/pomerium/pomerium/pull/2262) (@calebdoxsey) - -### Security - -- envoy: only allow embedding [#2368](https://github.com/pomerium/pomerium/pull/2368) (@calebdoxsey) -- deps: bump envoy to v1.17.3 [#2198](https://github.com/pomerium/pomerium/pull/2198) (@travisgroth) - -### Documentation - -- add support for latest version of code-server [#2229](https://github.com/pomerium/pomerium/pull/2229) (@bpmct) -- doc updates [#2433](https://github.com/pomerium/pomerium/pull/2433) (@calebdoxsey) -- Docs bug fixes [#2362](https://github.com/pomerium/pomerium/pull/2362) (@alexfornuto) -- Docs sorting [#2346](https://github.com/pomerium/pomerium/pull/2346) (@alexfornuto) -- docs: add v0.14 feature highlights [#2183](https://github.com/pomerium/pomerium/pull/2183) (@travisgroth) -- docs: add v0.14 feature highlights [#2184](https://github.com/pomerium/pomerium/pull/2184) (@github-actions[bot]) -- docs: clarify device identity, not state via client certs [#2428](https://github.com/pomerium/pomerium/pull/2428) (@desimone) -- docs: google gcp / workspace instructions [#2272](https://github.com/pomerium/pomerium/pull/2272) (@desimone) -- docs: Match Tenses [#2214](https://github.com/pomerium/pomerium/pull/2214) (@alexfornuto) -- docs: only secure schemes are supported [#2408](https://github.com/pomerium/pomerium/pull/2408) (@desimone) -- docs: rm broken link [#2215](https://github.com/pomerium/pomerium/pull/2215) (@alexfornuto) -- docs: update \_redirects [#2237](https://github.com/pomerium/pomerium/pull/2237) (@desimone) -- docs: update helm values for chart v20.0.0 [#2242](https://github.com/pomerium/pomerium/pull/2242) (@travisgroth) -- docs: update slack link to vanity url [#2177](https://github.com/pomerium/pomerium/pull/2177) (@travisgroth) -- docs/reference: Clarify use of idp_service_account [#2431](https://github.com/pomerium/pomerium/pull/2431) (@the-maldridge) -- Enterprise Docs [#2390](https://github.com/pomerium/pomerium/pull/2390) (@alexfornuto) -- fix(docs): use correct name for code-server [#2223](https://github.com/pomerium/pomerium/pull/2223) (@jsjoeio) -- Helm Quickstart Update [#2380](https://github.com/pomerium/pomerium/pull/2380) (@alexfornuto) -- Installation Docs Restructuring [#2406](https://github.com/pomerium/pomerium/pull/2406) (@alexfornuto) -- symlink security policy to root of project [#2396](https://github.com/pomerium/pomerium/pull/2396) (@desimone) -- Transmission BitTorrent Client Guide [#2281](https://github.com/pomerium/pomerium/pull/2281) (@alexfornuto) -- Update Console installs to match signing_key [#2432](https://github.com/pomerium/pomerium/pull/2432) (@alexfornuto) -- Update installation source for mkcert [#2340](https://github.com/pomerium/pomerium/pull/2340) (@alexfornuto) -- Update kubernetes-dashboard.md [#2285](https://github.com/pomerium/pomerium/pull/2285) (@WeeHong) -- Update programmatic-access.md [#2190](https://github.com/pomerium/pomerium/pull/2190) (@yyolk) -- v0.15 release notes [#2409](https://github.com/pomerium/pomerium/pull/2409) (@travisgroth) - -### Dependency - -- chore(deps): bump github.com/caddyserver/certmagic from 0.13.0 to 0.13.1 [#2188](https://github.com/pomerium/pomerium/pull/2188) (@dependabot[bot]) -- chore(deps): bump github.com/caddyserver/certmagic from 0.13.1 to 0.14.0 [#2291](https://github.com/pomerium/pomerium/pull/2291) (@dependabot[bot]) -- chore(deps): bump github.com/caddyserver/certmagic from 0.14.0 to 0.14.1 [#2352](https://github.com/pomerium/pomerium/pull/2352) (@dependabot[bot]) -- chore(deps): bump github.com/cenkalti/backoff/v4 from 4.1.0 to 4.1.1 [#2252](https://github.com/pomerium/pomerium/pull/2252) (@dependabot[bot]) -- chore(deps): bump github.com/go-jose/go-jose/v3 from 3.0.0-rc.1 to 3.0.0 [#2421](https://github.com/pomerium/pomerium/pull/2421) (@dependabot[bot]) -- chore(deps): bump github.com/go-redis/redis/v8 from 8.10.0 to 8.11.0 [#2329](https://github.com/pomerium/pomerium/pull/2329) (@dependabot[bot]) -- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.0 to 8.11.1 [#2413](https://github.com/pomerium/pomerium/pull/2413) (@dependabot[bot]) -- chore(deps): bump github.com/go-redis/redis/v8 from 8.8.2 to 8.8.3 [#2232](https://github.com/pomerium/pomerium/pull/2232) (@dependabot[bot]) -- chore(deps): bump github.com/go-redis/redis/v8 from 8.8.3 to 8.9.0 [#2249](https://github.com/pomerium/pomerium/pull/2249) (@dependabot[bot]) -- chore(deps): bump github.com/go-redis/redis/v8 from 8.9.0 to 8.10.0 [#2276](https://github.com/pomerium/pomerium/pull/2276) (@dependabot[bot]) -- chore(deps): bump github.com/golang/mock from 1.5.0 to 1.6.0 [#2290](https://github.com/pomerium/pomerium/pull/2290) (@dependabot[bot]) -- chore(deps): bump github.com/golangci/golangci-lint from 1.40.1 to 1.41.1 [#2353](https://github.com/pomerium/pomerium/pull/2353) (@dependabot[bot]) -- chore(deps): bump github.com/google/go-cmp from 0.5.5 to 0.5.6 [#2253](https://github.com/pomerium/pomerium/pull/2253) (@dependabot[bot]) -- chore(deps): bump github.com/google/uuid from 1.2.0 to 1.3.0 [#2374](https://github.com/pomerium/pomerium/pull/2374) (@dependabot[bot]) -- chore(deps): bump github.com/lithammer/shortuuid/v3 from 3.0.6 to 3.0.7 [#2211](https://github.com/pomerium/pomerium/pull/2211) (@dependabot[bot]) -- chore(deps): bump github.com/mitchellh/hashstructure/v2 from 2.0.1 to 2.0.2 [#2251](https://github.com/pomerium/pomerium/pull/2251) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.28.0 to 0.29.4 [#2255](https://github.com/pomerium/pomerium/pull/2255) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.29.4 to 0.30.1 [#2323](https://github.com/pomerium/pomerium/pull/2323) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.30.1 to 0.30.2 [#2373](https://github.com/pomerium/pomerium/pull/2373) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.30.2 to 0.31.0 [#2416](https://github.com/pomerium/pomerium/pull/2416) (@dependabot[bot]) -- chore(deps): bump github.com/ory/dockertest/v3 from 3.6.5 to 3.7.0 [#2303](https://github.com/pomerium/pomerium/pull/2303) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/client_golang from 1.10.0 to 1.11.0 [#2294](https://github.com/pomerium/pomerium/pull/2294) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/common from 0.23.0 to 0.24.0 [#2210](https://github.com/pomerium/pomerium/pull/2210) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/common from 0.24.0 to 0.25.0 [#2234](https://github.com/pomerium/pomerium/pull/2234) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/common from 0.25.0 to 0.29.0 [#2289](https://github.com/pomerium/pomerium/pull/2289) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/common from 0.29.0 to 0.30.0 [#2417](https://github.com/pomerium/pomerium/pull/2417) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/procfs from 0.6.0 to 0.7.0 [#2328](https://github.com/pomerium/pomerium/pull/2328) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/procfs from 0.7.0 to 0.7.1 [#2395](https://github.com/pomerium/pomerium/pull/2395) (@dependabot[bot]) -- chore(deps): bump github.com/rs/cors from 1.7.0 to 1.8.0 [#2334](https://github.com/pomerium/pomerium/pull/2334) (@dependabot[bot]) -- chore(deps): bump github.com/rs/zerolog from 1.21.0 to 1.22.0 [#2209](https://github.com/pomerium/pomerium/pull/2209) (@dependabot[bot]) -- chore(deps): bump github.com/rs/zerolog from 1.22.0 to 1.23.0 [#2293](https://github.com/pomerium/pomerium/pull/2293) (@dependabot[bot]) -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.4 to 3.21.5 [#2274](https://github.com/pomerium/pomerium/pull/2274) (@dependabot[bot]) -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.5 to 3.21.6 [#2326](https://github.com/pomerium/pomerium/pull/2326) (@dependabot[bot]) -- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.6 to 3.21.7 [#2414](https://github.com/pomerium/pomerium/pull/2414) (@dependabot[bot]) -- chore(deps): bump github.com/spf13/cobra from 1.1.3 to 1.2.1 [#2330](https://github.com/pomerium/pomerium/pull/2330) (@dependabot[bot]) -- chore(deps): bump github.com/spf13/viper from 1.7.1 to 1.8.0 [#2305](https://github.com/pomerium/pomerium/pull/2305) (@dependabot[bot]) -- chore(deps): bump github.com/spf13/viper from 1.8.0 to 1.8.1 [#2317](https://github.com/pomerium/pomerium/pull/2317) (@dependabot[bot]) -- chore(deps): bump go.uber.org/zap from 1.16.0 to 1.17.0 [#2254](https://github.com/pomerium/pomerium/pull/2254) (@dependabot[bot]) -- chore(deps): bump go.uber.org/zap from 1.17.0 to 1.18.1 [#2325](https://github.com/pomerium/pomerium/pull/2325) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.45.0 to 0.46.0 [#2186](https://github.com/pomerium/pomerium/pull/2186) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.46.0 to 0.47.0 [#2233](https://github.com/pomerium/pomerium/pull/2233) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.47.0 to 0.48.0 [#2295](https://github.com/pomerium/pomerium/pull/2295) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.48.0 to 0.49.0 [#2315](https://github.com/pomerium/pomerium/pull/2315) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.49.0 to 0.50.0 [#2333](https://github.com/pomerium/pomerium/pull/2333) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.50.0 to 0.51.0 [#2394](https://github.com/pomerium/pomerium/pull/2394) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.51.0 to 0.52.0 [#2415](https://github.com/pomerium/pomerium/pull/2415) (@dependabot[bot]) -- chore(deps): bump google.golang.org/grpc from 1.37.0 to 1.37.1 [#2207](https://github.com/pomerium/pomerium/pull/2207) (@dependabot[bot]) -- chore(deps): bump google.golang.org/grpc from 1.37.1 to 1.38.0 [#2231](https://github.com/pomerium/pomerium/pull/2231) (@dependabot[bot]) -- chore(deps): bump google.golang.org/grpc from 1.38.0 to 1.39.0 [#2324](https://github.com/pomerium/pomerium/pull/2324) (@dependabot[bot]) -- chore(deps): bump google.golang.org/protobuf from 1.26.0 to 1.27.0 [#2318](https://github.com/pomerium/pomerium/pull/2318) (@dependabot[bot]) -- chore(deps): bump gopkg.in/auth0.v5 from 5.15.0 to 5.16.0 [#2187](https://github.com/pomerium/pomerium/pull/2187) (@dependabot[bot]) -- chore(deps): bump gopkg.in/auth0.v5 from 5.16.0 to 5.17.0 [#2208](https://github.com/pomerium/pomerium/pull/2208) (@dependabot[bot]) -- chore(deps): bump gopkg.in/auth0.v5 from 5.17.0 to 5.18.0 [#2292](https://github.com/pomerium/pomerium/pull/2292) (@dependabot[bot]) -- chore(deps): bump gopkg.in/auth0.v5 from 5.18.0 to 5.19.1 [#2304](https://github.com/pomerium/pomerium/pull/2304) (@dependabot[bot]) -- chore(deps): bump gopkg.in/auth0.v5 from 5.19.1 to 5.19.2 [#2422](https://github.com/pomerium/pomerium/pull/2422) (@dependabot[bot]) -- chore(deps): bump gopkg.in/square/go-jose.v2 from 2.5.1 to 2.6.0 [#2273](https://github.com/pomerium/pomerium/pull/2273) (@dependabot[bot]) -- chore(deps): upgrade kind action to v1.2.0 [#2331](https://github.com/pomerium/pomerium/pull/2331) (@travisgroth) -- ci: convert to FOSSA scan [#2371](https://github.com/pomerium/pomerium/pull/2371) (@travisgroth) -- darwin: use x86 envoy build for arm64 [#2246](https://github.com/pomerium/pomerium/pull/2246) (@calebdoxsey) -- dependency: update /x/net [#2227](https://github.com/pomerium/pomerium/pull/2227) (@desimone) -- deps: upgrade to go-jose v3 [#2284](https://github.com/pomerium/pomerium/pull/2284) (@calebdoxsey) - -### Changed - -- build: add envoy files to `make clean` [#2411](https://github.com/pomerium/pomerium/pull/2411) (@travisgroth) -- ci: add coveralls [#2279](https://github.com/pomerium/pomerium/pull/2279) (@travisgroth) -- ci: use github app for backport credentials [#2369](https://github.com/pomerium/pomerium/pull/2369) (@travisgroth) -- databroker: tests [#2367](https://github.com/pomerium/pomerium/pull/2367) (@calebdoxsey) -- envoy: bump to 1.19 [#2392](https://github.com/pomerium/pomerium/pull/2392) (@travisgroth) -- internal/envoy: add debugging information if envoy is no longer running [#2320](https://github.com/pomerium/pomerium/pull/2320) (@travisgroth) -- redis: increase timeout on test [#2425](https://github.com/pomerium/pomerium/pull/2425) (@calebdoxsey) -- redis: refactor change signal test to be more deterministic [#2335](https://github.com/pomerium/pomerium/pull/2335) (@calebdoxsey) -- storage/inmemory: add tests for close behavior [#2336](https://github.com/pomerium/pomerium/pull/2336) (@calebdoxsey) - -## [v0.14.7](https://github.com/pomerium/pomerium/tree/v0.14.7) (2021-06-24) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.6...v0.14.7) - -### Fixed - -- directory/azure: add paging support to user group members call [#2312](https://github.com/pomerium/pomerium/pull/2312) (@github-actions[bot]) - -## [v0.14.6](https://github.com/pomerium/pomerium/tree/v0.14.6) (2021-06-16) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.5...v0.14.6) - -### Fixed - -- authorize: only redirect for HTML pages (#2264) [#2298](https://github.com/pomerium/pomerium/pull/2298) (@calebdoxsey) - -## [v0.14.5](https://github.com/pomerium/pomerium/tree/v0.14.5) (2021-06-07) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.4...v0.14.5) - -### Fixed - -- envoy: fix usage of codec_type with alpn [#2278](https://github.com/pomerium/pomerium/pull/2278) (@github-actions[bot]) -- authorize: round JWT claim timestamps [#2260](https://github.com/pomerium/pomerium/pull/2260) (@wasaga) - -### Documentation - -- docs: update helm values for chart v20.0.0 [#2244](https://github.com/pomerium/pomerium/pull/2244) (@github-actions[bot]) -- docs: update \_redirects [#2238](https://github.com/pomerium/pomerium/pull/2238) (@github-actions[bot]) - -## [v0.14.4](https://github.com/pomerium/pomerium/tree/v0.14.4) (2021-05-24) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.3...v0.14.4) - -### Fixed - -- authorize: add rego functions to custom evaluator [#2236](https://github.com/pomerium/pomerium/pull/2236) (@calebdoxsey) - -## [v0.14.3](https://github.com/pomerium/pomerium/tree/v0.14.3) (2021-05-21) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.2...v0.14.3) - -### Fixed - -- authorize: fix custom rego panic [#2226](https://github.com/pomerium/pomerium/pull/2226) (@calebdoxsey) - -### Changed - -- envoy: add global response headers to local replies [#2225](https://github.com/pomerium/pomerium/pull/2225) (@github-actions[bot]) - -## [v0.14.2](https://github.com/pomerium/pomerium/tree/v0.14.2) (2021-05-17) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.1...v0.14.2) - -### Fixed - -- Revert "authenticate,proxy: add same site lax to cookies" [#2204](https://github.com/pomerium/pomerium/pull/2204) (@github-actions[bot]) - -### Documentation - -- Update programmatic-access.md [#2205](https://github.com/pomerium/pomerium/pull/2205) (@github-actions[bot]) - -## [v0.14.1](https://github.com/pomerium/pomerium/tree/v0.14.1) (2021-05-13) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.0...v0.14.1) - -### Fixed - -- proxy / controplane: use old upstream cipher suite [#2197](https://github.com/pomerium/pomerium/pull/2197) (@github-actions[bot]) - -### Security - -- deps: bump envoy to v1.17.3 [#2199](https://github.com/pomerium/pomerium/pull/2199) (@github-actions[bot]) - -### Documentation - -- docs: update slack link to vanity url [#2178](https://github.com/pomerium/pomerium/pull/2178) (@github-actions[bot]) - -## [v0.14.0](https://github.com/pomerium/pomerium/tree/v0.14.0) (2021-05-04) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.0-rc2...v0.14.0) - -### New - -- assets: use embed instead of statik [#1960](https://github.com/pomerium/pomerium/pull/1960) (@calebdoxsey) -- authenticate,proxy: add same site lax to cookies [#2159](https://github.com/pomerium/pomerium/pull/2159) (@calebdoxsey) -- authenticate: fix default sign out url [#2061](https://github.com/pomerium/pomerium/pull/2061) (@calebdoxsey) -- authenticate: validate origin of signout [#1876](https://github.com/pomerium/pomerium/pull/1876) (@desimone) -- authorize: add databroker server and record version to result, force sync via polling [#2024](https://github.com/pomerium/pomerium/pull/2024) (@calebdoxsey) -- authorize: additional tracing, add benchmark for encryptor [#2059](https://github.com/pomerium/pomerium/pull/2059) (@calebdoxsey) -- authorize: audit log had duplicate "message" key [#2141](https://github.com/pomerium/pomerium/pull/2141) (@desimone) -- authorize: audit logging [#2050](https://github.com/pomerium/pomerium/pull/2050) (@calebdoxsey) -- authorize: bypass data in rego for databroker data [#2041](https://github.com/pomerium/pomerium/pull/2041) (@calebdoxsey) -- authorize: fix empty sub policy arrays [#2119](https://github.com/pomerium/pomerium/pull/2119) (@calebdoxsey) -- authorize: fix unsigned URL [#2118](https://github.com/pomerium/pomerium/pull/2118) (@calebdoxsey) -- authorize: move headers and jwt signing to rego [#1856](https://github.com/pomerium/pomerium/pull/1856) (@calebdoxsey) -- authorize: refactor store locking [#2151](https://github.com/pomerium/pomerium/pull/2151) (@calebdoxsey) -- authorize: set JWT to expire after 5 minutes [#1980](https://github.com/pomerium/pomerium/pull/1980) (@calebdoxsey) -- authorize: support arbitrary jwt claims [#2102](https://github.com/pomerium/pomerium/pull/2102) (@calebdoxsey) -- authorize: support arbitrary jwt claims [#2106](https://github.com/pomerium/pomerium/pull/2106) (@github-actions[bot]) -- autocert: add metrics for renewal count, total and next expiration [#2019](https://github.com/pomerium/pomerium/pull/2019) (@calebdoxsey) -- autocert: remove non-determinism [#1932](https://github.com/pomerium/pomerium/pull/1932) (@calebdoxsey) -- change require_proxy_protocol to use_proxy_protocol [#2043](https://github.com/pomerium/pomerium/pull/2043) (@contrun) -- ci: pin goreleaser version [#1900](https://github.com/pomerium/pomerium/pull/1900) (@travisgroth) -- cmd/pomerium: exit 0 for normal shutdown [#1958](https://github.com/pomerium/pomerium/pull/1958) (@travisgroth) -- config: add CertificateFiles to FileWatcherSource list [#1878](https://github.com/pomerium/pomerium/pull/1878) (@travisgroth) -- config: add client_crl [#2157](https://github.com/pomerium/pomerium/pull/2157) (@calebdoxsey) -- config: add headers to config proto [#1996](https://github.com/pomerium/pomerium/pull/1996) (@calebdoxsey) -- config: add metrics_basic_auth option [#1917](https://github.com/pomerium/pomerium/pull/1917) (@calebdoxsey) -- config: add rewrite_response_headers option [#1961](https://github.com/pomerium/pomerium/pull/1961) (@calebdoxsey) -- config: add rewrite_response_headers to protobuf [#1962](https://github.com/pomerium/pomerium/pull/1962) (@calebdoxsey) -- config: add support for codec_type [#2156](https://github.com/pomerium/pomerium/pull/2156) (@calebdoxsey) -- config: add support for set_response_headers in a policy [#2171](https://github.com/pomerium/pomerium/pull/2171) (@calebdoxsey) -- config: allow customization of envoy boostrap admin options [#1872](https://github.com/pomerium/pomerium/pull/1872) (@calebdoxsey) -- config: don't change address value on databroker or authorize [#2092](https://github.com/pomerium/pomerium/pull/2092) (@travisgroth) -- config: fix redirect routes from protobuf [#1930](https://github.com/pomerium/pomerium/pull/1930) (@travisgroth) -- config: log config source changes [#1959](https://github.com/pomerium/pomerium/pull/1959) (@calebdoxsey) -- config: multiple endpoints for authorize and databroker [#1957](https://github.com/pomerium/pomerium/pull/1957) (@calebdoxsey) -- config: remove validate side effects [#2109](https://github.com/pomerium/pomerium/pull/2109) (@calebdoxsey) -- config: rename headers to set_response_headers [#2081](https://github.com/pomerium/pomerium/pull/2081) (@calebdoxsey) -- config: support map of jwt claim headers [#1906](https://github.com/pomerium/pomerium/pull/1906) (@calebdoxsey) -- config: use getters for authenticate, signout and forward auth urls [#2000](https://github.com/pomerium/pomerium/pull/2000) (@calebdoxsey) -- config: use getters for certificates [#2001](https://github.com/pomerium/pomerium/pull/2001) (@calebdoxsey) -- config: use tls_custom_ca from policy when available [#2077](https://github.com/pomerium/pomerium/pull/2077) (@calebdoxsey) -- control plane: add request id to all error pages [#2149](https://github.com/pomerium/pomerium/pull/2149) (@desimone) -- controlplane: add global headers to virtualhost [#1861](https://github.com/pomerium/pomerium/pull/1861) (@desimone) -- controlplane: save configuration events to databroker [#2153](https://github.com/pomerium/pomerium/pull/2153) (@calebdoxsey) -- crypto: use actual bytes of shared secret, not the base64 encoded representation [#2075](https://github.com/pomerium/pomerium/pull/2075) (@calebdoxsey) -- cryptutil: add envelope encryption w/key encryption key and data encryption key [#2020](https://github.com/pomerium/pomerium/pull/2020) (@calebdoxsey) -- cryptutil: always use kek public id, add x509 support [#2066](https://github.com/pomerium/pomerium/pull/2066) (@calebdoxsey) -- cryptutil: use bytes for hmac [#2067](https://github.com/pomerium/pomerium/pull/2067) (@calebdoxsey) -- databroker: add options for maximum capacity [#2095](https://github.com/pomerium/pomerium/pull/2095) (@calebdoxsey) -- databroker: refactor databroker to sync all changes [#1879](https://github.com/pomerium/pomerium/pull/1879) (@calebdoxsey) -- databroker: remove unused installation id, close streams when backend is closed [#2062](https://github.com/pomerium/pomerium/pull/2062) (@calebdoxsey) -- databroker: return server version in Get [#2039](https://github.com/pomerium/pomerium/pull/2039) (@wasaga) -- databroker: store issued at timestamp with session [#2173](https://github.com/pomerium/pomerium/pull/2173) (@calebdoxsey) -- databroker: store server version in backend [#2142](https://github.com/pomerium/pomerium/pull/2142) (@calebdoxsey) -- deployment: update alpine debug image dependencies [#2154](https://github.com/pomerium/pomerium/pull/2154) (@travisgroth) -- Drop tun.cfg.dstHost from jwtCacheKey [#2115](https://github.com/pomerium/pomerium/pull/2115) (@bl0m1) -- envoy: re-implement recommended defaults [#2123](https://github.com/pomerium/pomerium/pull/2123) (@calebdoxsey) -- envoy: refactor controlplane xds to new envoyconfig package [#2086](https://github.com/pomerium/pomerium/pull/2086) (@calebdoxsey) -- envoy: upgrade to v1.17.1 [#1993](https://github.com/pomerium/pomerium/pull/1993) (@calebdoxsey) -- envoy: validate binary checksum [#1908](https://github.com/pomerium/pomerium/pull/1908) (@calebdoxsey) -- envoyconfig: fix metrics ingress listener name [#2124](https://github.com/pomerium/pomerium/pull/2124) (@calebdoxsey) -- envoyconfig: move most bootstrap config to shared package [#2088](https://github.com/pomerium/pomerium/pull/2088) (@calebdoxsey) -- Fix process cpu usage metric [#1979](https://github.com/pomerium/pomerium/pull/1979) (@wasaga) -- fix registry test [#1911](https://github.com/pomerium/pomerium/pull/1911) (@wasaga) -- google: fix default provider URL [#1928](https://github.com/pomerium/pomerium/pull/1928) (@calebdoxsey) -- httputil: fix SPDY support with reverse proxy [#2134](https://github.com/pomerium/pomerium/pull/2134) (@calebdoxsey) -- identity: infer email from mail claim [#1977](https://github.com/pomerium/pomerium/pull/1977) (@calebdoxsey) -- identity: record metric for last refresh [#1936](https://github.com/pomerium/pomerium/pull/1936) (@calebdoxsey) -- let pass custom dial opts [#2144](https://github.com/pomerium/pomerium/pull/2144) (@wasaga) -- log context [#2107](https://github.com/pomerium/pomerium/pull/2107) (@wasaga) -- metrics_address should be optional parameter [#2087](https://github.com/pomerium/pomerium/pull/2087) (@wasaga) -- metrics: add TLS options [#1939](https://github.com/pomerium/pomerium/pull/1939) (@calebdoxsey) -- middleware: basic auth equalize lengths of input [#1934](https://github.com/pomerium/pomerium/pull/1934) (@desimone) -- onelogin: fix default scopes for v2 [#1896](https://github.com/pomerium/pomerium/pull/1896) (@calebdoxsey) -- options: header only applies to routes and authN [#1862](https://github.com/pomerium/pomerium/pull/1862) (@desimone) -- ping: identity and directory providers [#1975](https://github.com/pomerium/pomerium/pull/1975) (@calebdoxsey) -- propagate changes back from encrypted backend [#2079](https://github.com/pomerium/pomerium/pull/2079) (@wasaga) -- protoutil: add generic transformer [#2023](https://github.com/pomerium/pomerium/pull/2023) (@calebdoxsey) -- proxy: add nil check for fix-misdirected [#2040](https://github.com/pomerium/pomerium/pull/2040) (@calebdoxsey) -- proxy: implement pass-through for authenticate backend [#1870](https://github.com/pomerium/pomerium/pull/1870) (@calebdoxsey) -- proxy: redirect to dashboard for logout [#1944](https://github.com/pomerium/pomerium/pull/1944) (@calebdoxsey) -- redis: add redis cluster support [#1992](https://github.com/pomerium/pomerium/pull/1992) (@calebdoxsey) -- redis: add support for redis-sentinel [#1991](https://github.com/pomerium/pomerium/pull/1991) (@calebdoxsey) -- redis: fix deletion versioning [#1871](https://github.com/pomerium/pomerium/pull/1871) (@calebdoxsey) -- Remove internal/protoutil. [#1893](https://github.com/pomerium/pomerium/pull/1893) (@yegle) -- support host:port in metrics_address [#2042](https://github.com/pomerium/pomerium/pull/2042) (@wasaga) -- telemetry: add installation id [#2017](https://github.com/pomerium/pomerium/pull/2017) (@calebdoxsey) -- telemetry: add process collector for envoy [#1948](https://github.com/pomerium/pomerium/pull/1948) (@calebdoxsey) -- unique envoy cluster ids [#1858](https://github.com/pomerium/pomerium/pull/1858) (@wasaga) -- use build_info as liveness gauge metric [#1940](https://github.com/pomerium/pomerium/pull/1940) (@wasaga) -- xds extended event [#2158](https://github.com/pomerium/pomerium/pull/2158) (@wasaga) -- xds: fix misdirected script [#1895](https://github.com/pomerium/pomerium/pull/1895) (@calebdoxsey) -- xds: use ALPN Auto config for upstream protocol when possible [#1995](https://github.com/pomerium/pomerium/pull/1995) (@calebdoxsey) -- xdsmgr: update resource versions on NACK [#2093](https://github.com/pomerium/pomerium/pull/2093) (@calebdoxsey) - -### Security - -- authenticate: validate signature on /.pomerium, /.pomerium/sign_in and /.pomerium/sign_out [#2048](https://github.com/pomerium/pomerium/pull/2048) (@travisgroth) - -- ci: remove codecov [#2161](https://github.com/pomerium/pomerium/pull/2161) (@travisgroth) - -- deps: bump envoy to 1.17.2 [#2113](https://github.com/pomerium/pomerium/pull/2113) (@travisgroth) - -- deps: bump envoy to 1.17.2 [#2114](https://github.com/pomerium/pomerium/pull/2114) (@github-actions[bot]) -- internal/envoy: always extract envoy [#2160](https://github.com/pomerium/pomerium/pull/2160) (@travisgroth) -- proxy: restrict programmatic URLs to localhost [#2049](https://github.com/pomerium/pomerium/pull/2049) (@travisgroth) - -### Documentation - -- docs: add breaking sa changes in v0.13 [#1919](https://github.com/pomerium/pomerium/pull/1919) (@desimone) -- docs: add info note to set_response_headers [#2162](https://github.com/pomerium/pomerium/pull/2162) (@calebdoxsey) -- docs: add inline instructions to generate signing-key [#2164](https://github.com/pomerium/pomerium/pull/2164) (@desimone) -- docs: add JWT Verification w/Envoy guide [#1974](https://github.com/pomerium/pomerium/pull/1974) (@calebdoxsey) -- docs: add load balancing weight documentation [#1883](https://github.com/pomerium/pomerium/pull/1883) (@travisgroth) -- docs: add threat model to security page [#2097](https://github.com/pomerium/pomerium/pull/2097) (@desimone) -- docs: add v0.13 to docs site menu [#1913](https://github.com/pomerium/pomerium/pull/1913) (@travisgroth) -- docs: additional load balancing documentation [#1875](https://github.com/pomerium/pomerium/pull/1875) (@travisgroth) -- docs: fix query param name [#1920](https://github.com/pomerium/pomerium/pull/1920) (@calebdoxsey) -- docs: mention alternative bearer token header format [#2155](https://github.com/pomerium/pomerium/pull/2155) (@travisgroth) -- docs: misc upgrade notes and changelog [#1884](https://github.com/pomerium/pomerium/pull/1884) (@travisgroth) -- docs: update changelog for v0.13.0 [#1909](https://github.com/pomerium/pomerium/pull/1909) (@desimone) -- docs: update community slack link [#2063](https://github.com/pomerium/pomerium/pull/2063) (@travisgroth) -- docs: update security policy [#1897](https://github.com/pomerium/pomerium/pull/1897) (@desimone) -- docs: upgrade notes on `allowed\_users` by ID [#2133](https://github.com/pomerium/pomerium/pull/2133) (@travisgroth) -- ping: add documentation [#1976](https://github.com/pomerium/pomerium/pull/1976) (@calebdoxsey) -- Update data-storage.md [#1941](https://github.com/pomerium/pomerium/pull/1941) (@TanguyPatte) -- Update local-oidc.md [#1994](https://github.com/pomerium/pomerium/pull/1994) (@dharmendrakariya) - -### Dependency - -- chore(deps): bump github.com/caddyserver/certmagic from 0.12.0 to 0.13.0 [#2074](https://github.com/pomerium/pomerium/pull/2074) (@dependabot[bot]) -- chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 0.5.1 to 0.6.0 [#2129](https://github.com/pomerium/pomerium/pull/2129) (@dependabot[bot]) -- chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 0.6.0 to 0.6.1 [#2166](https://github.com/pomerium/pomerium/pull/2166) (@dependabot[bot]) -- chore(deps): bump github.com/go-redis/redis/v8 from 8.8.0 to 8.8.2 [#2099](https://github.com/pomerium/pomerium/pull/2099) (@dependabot[bot]) -- chore(deps): bump github.com/open-policy-agent/opa from 0.27.1 to 0.28.0 [#2165](https://github.com/pomerium/pomerium/pull/2165) (@dependabot[bot]) -- chore(deps): bump github.com/ory/dockertest/v3 from 3.6.3 to 3.6.5 [#2168](https://github.com/pomerium/pomerium/pull/2168) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/common from 0.20.0 to 0.21.0 [#2130](https://github.com/pomerium/pomerium/pull/2130) (@dependabot[bot]) -- chore(deps): bump github.com/prometheus/common from 0.21.0 to 0.23.0 [#2167](https://github.com/pomerium/pomerium/pull/2167) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.43.0 to 0.44.0 [#2073](https://github.com/pomerium/pomerium/pull/2073) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.44.0 to 0.45.0 [#2128](https://github.com/pomerium/pomerium/pull/2128) (@dependabot[bot]) -- chore(deps): bump google.golang.org/grpc from 1.36.1 to 1.37.0 [#2072](https://github.com/pomerium/pomerium/pull/2072) (@dependabot[bot]) -- chore(deps): bump gopkg.in/auth0.v5 from 5.13.0 to 5.14.1 [#2071](https://github.com/pomerium/pomerium/pull/2071) (@dependabot[bot]) -- chore(deps): bump gopkg.in/auth0.v5 from 5.14.1 to 5.15.0 [#2098](https://github.com/pomerium/pomerium/pull/2098) (@dependabot[bot]) -- chore(deps): update codecov/codecov-action action to v1.3.1 [#1985](https://github.com/pomerium/pomerium/pull/1985) (@renovate[bot]) -- chore(deps): update golang.org/x/oauth2 commit hash to 0101308 [#1863](https://github.com/pomerium/pomerium/pull/1863) (@renovate[bot]) -- chore(deps): update golang.org/x/oauth2 commit hash to 6667018 [#1886](https://github.com/pomerium/pomerium/pull/1886) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to bba0dbe [#1864](https://github.com/pomerium/pomerium/pull/1864) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to e7f2df4 [#1887](https://github.com/pomerium/pomerium/pull/1887) (@renovate[bot]) -- chore(deps): update mikefarah/yq action to v4.5.0 [#1865](https://github.com/pomerium/pomerium/pull/1865) (@renovate[bot]) -- chore(deps): update mikefarah/yq action to v4.5.1 [#1888](https://github.com/pomerium/pomerium/pull/1888) (@renovate[bot]) -- chore(deps): update mikefarah/yq action to v4.6.1 [#1951](https://github.com/pomerium/pomerium/pull/1951) (@renovate[bot]) -- chore(deps): update mikefarah/yq action to v4.6.2 [#2007](https://github.com/pomerium/pomerium/pull/2007) (@renovate[bot]) -- chore(deps): update mikefarah/yq action to v4.6.3 [#2031](https://github.com/pomerium/pomerium/pull/2031) (@renovate[bot]) -- chore(deps): update module auth0 to v5 [#1868](https://github.com/pomerium/pomerium/pull/1868) (@renovate[bot]) -- chore(deps): update module go-redis/redis/v8 to v8.5.0 [#1866](https://github.com/pomerium/pomerium/pull/1866) (@renovate[bot]) -- chore(deps): update module google.golang.org/api to v0.39.0 [#1867](https://github.com/pomerium/pomerium/pull/1867) (@renovate[bot]) -- chore(deps): update module google.golang.org/api to v0.40.0 [#1889](https://github.com/pomerium/pomerium/pull/1889) (@renovate[bot]) -- chore(deps): update module spf13/cobra to v1.1.3 [#1890](https://github.com/pomerium/pomerium/pull/1890) (@renovate[bot]) -- chore(deps): update vuepress monorepo to v1.8.1 [#1891](https://github.com/pomerium/pomerium/pull/1891) (@renovate[bot]) -- chore(deps): update vuepress monorepo to v1.8.2 [#1952](https://github.com/pomerium/pomerium/pull/1952) (@renovate[bot]) -- chore(deps): update yaml v2 to v3 [#1927](https://github.com/pomerium/pomerium/pull/1927) (@desimone) -- deps: bundle all patch upgrades in a single group [#2016](https://github.com/pomerium/pomerium/pull/2016) (@travisgroth) -- deps: switch from renovate to dependabot [#2069](https://github.com/pomerium/pomerium/pull/2069) (@travisgroth) -- do not require project be in GOPATH/src [#2078](https://github.com/pomerium/pomerium/pull/2078) (@wasaga) -- fix(deps): update github.com/nsf/jsondiff commit hash to 6ea3239 [#1965](https://github.com/pomerium/pomerium/pull/1965) (@renovate[bot]) -- fix(deps): update golang.org/x/crypto commit hash to 0c34fe9 [#2027](https://github.com/pomerium/pomerium/pull/2027) (@renovate[bot]) -- fix(deps): update golang.org/x/crypto commit hash to 513c2a4 [#1982](https://github.com/pomerium/pomerium/pull/1982) (@renovate[bot]) -- fix(deps): update golang.org/x/net commit hash to 0fccb6f [#2052](https://github.com/pomerium/pomerium/pull/2052) (@renovate[bot]) -- fix(deps): update golang.org/x/net commit hash to 61e0566 [#2028](https://github.com/pomerium/pomerium/pull/2028) (@renovate[bot]) -- fix(deps): update golang.org/x/net commit hash to d523dce [#2005](https://github.com/pomerium/pomerium/pull/2005) (@renovate[bot]) -- fix(deps): update golang.org/x/net commit hash to e18ecbb [#1949](https://github.com/pomerium/pomerium/pull/1949) (@renovate[bot]) -- fix(deps): update golang.org/x/oauth2 commit hash to 22b0ada [#2029](https://github.com/pomerium/pomerium/pull/2029) (@renovate[bot]) -- fix(deps): update golang.org/x/oauth2 commit hash to 2e8d934 [#2053](https://github.com/pomerium/pomerium/pull/2053) (@renovate[bot]) -- fix(deps): update golang.org/x/oauth2 commit hash to cd4f82c [#1983](https://github.com/pomerium/pomerium/pull/1983) (@renovate[bot]) -- fix(deps): update google.golang.org/genproto commit hash to 5f0e893 [#2006](https://github.com/pomerium/pomerium/pull/2006) (@renovate[bot]) -- fix(deps): update google.golang.org/genproto commit hash to 679c6ae [#2030](https://github.com/pomerium/pomerium/pull/2030) (@renovate[bot]) -- fix(deps): update google.golang.org/genproto commit hash to 6c239bb [#2054](https://github.com/pomerium/pomerium/pull/2054) (@renovate[bot]) -- fix(deps): update google.golang.org/genproto commit hash to 8812039 [#1984](https://github.com/pomerium/pomerium/pull/1984) (@renovate[bot]) -- fix(deps): update google.golang.org/genproto commit hash to 9728d6b [#1966](https://github.com/pomerium/pomerium/pull/1966) (@renovate[bot]) -- fix(deps): update google.golang.org/genproto commit hash to ab064af [#1950](https://github.com/pomerium/pomerium/pull/1950) (@renovate[bot]) -- fix(deps): update module contrib.go.opencensus.io/exporter/prometheus to v0.3.0 [#1986](https://github.com/pomerium/pomerium/pull/1986) (@renovate[bot]) -- fix(deps): update module github.com/envoyproxy/protoc-gen-validate to v0.5.0 [#2008](https://github.com/pomerium/pomerium/pull/2008) (@renovate[bot]) -- fix(deps): update module github.com/envoyproxy/protoc-gen-validate to v0.5.1 [#2056](https://github.com/pomerium/pomerium/pull/2056) (@renovate[bot]) -- fix(deps): update module github.com/go-chi/chi to v5 [#1956](https://github.com/pomerium/pomerium/pull/1956) (@renovate[bot]) -- fix(deps): update module github.com/go-redis/redis/v8 to v8.7.1 [#1967](https://github.com/pomerium/pomerium/pull/1967) (@renovate[bot]) -- fix(deps): update module github.com/go-redis/redis/v8 to v8.8.0 [#2032](https://github.com/pomerium/pomerium/pull/2032) (@renovate[bot]) -- fix(deps): update module github.com/golang/protobuf to v1.5.1 [#2009](https://github.com/pomerium/pomerium/pull/2009) (@renovate[bot]) -- fix(deps): update module github.com/golang/protobuf to v1.5.2 [#2057](https://github.com/pomerium/pomerium/pull/2057) (@renovate[bot]) -- fix(deps): update module github.com/google/btree to v1.0.1 [#2010](https://github.com/pomerium/pomerium/pull/2010) (@renovate[bot]) -- fix(deps): update module github.com/google/go-cmp to v0.5.5 [#1968](https://github.com/pomerium/pomerium/pull/1968) (@renovate[bot]) -- fix(deps): update module github.com/hashicorp/go-multierror to v1.1.1 [#1987](https://github.com/pomerium/pomerium/pull/1987) (@renovate[bot]) -- fix(deps): update module github.com/lithammer/shortuuid/v3 to v3.0.6 [#1953](https://github.com/pomerium/pomerium/pull/1953) (@renovate[bot]) -- fix(deps): update module github.com/open-policy-agent/opa to v0.27.1 [#1988](https://github.com/pomerium/pomerium/pull/1988) (@renovate[bot]) -- fix(deps): update module github.com/prometheus/client_golang to v1.10.0 [#2011](https://github.com/pomerium/pomerium/pull/2011) (@renovate[bot]) -- fix(deps): update module github.com/prometheus/common to v0.20.0 [#2033](https://github.com/pomerium/pomerium/pull/2033) (@renovate[bot]) -- fix(deps): update module github.com/prometheus/procfs to v0.6.0 [#1969](https://github.com/pomerium/pomerium/pull/1969) (@renovate[bot]) -- fix(deps): update module github.com/rs/zerolog to v1.21.0 [#2034](https://github.com/pomerium/pomerium/pull/2034) (@renovate[bot]) -- fix(deps): update module go.opencensus.io to v0.23.0 [#1954](https://github.com/pomerium/pomerium/pull/1954) (@renovate[bot]) -- fix(deps): update module google.golang.org/api to v0.42.0 [#1989](https://github.com/pomerium/pomerium/pull/1989) (@renovate[bot]) -- fix(deps): update module google.golang.org/api to v0.43.0 [#2035](https://github.com/pomerium/pomerium/pull/2035) (@renovate[bot]) -- fix(deps): update module google.golang.org/grpc to v1.36.0 [#1955](https://github.com/pomerium/pomerium/pull/1955) (@renovate[bot]) -- fix(deps): update module google.golang.org/grpc to v1.36.1 [#2036](https://github.com/pomerium/pomerium/pull/2036) (@renovate[bot]) -- fix(deps): update module google.golang.org/protobuf to v1.26.0 [#2012](https://github.com/pomerium/pomerium/pull/2012) (@renovate[bot]) -- fix(deps): update module gopkg.in/auth0.v5 to v5.13.0 [#2037](https://github.com/pomerium/pomerium/pull/2037) (@renovate[bot]) -- skip REDIS cluster test if GOOS != linux [#2045](https://github.com/pomerium/pomerium/pull/2045) (@wasaga) -- use cached envoy [#2132](https://github.com/pomerium/pomerium/pull/2132) (@wasaga) - -### Deployment - -- ci: cache build and test binaries [#1938](https://github.com/pomerium/pomerium/pull/1938) (@desimone) -- ci: go 1.16.x, cached tests [#1937](https://github.com/pomerium/pomerium/pull/1937) (@desimone) -- deployment: Publish OS packages to cloudsmith [#2105](https://github.com/pomerium/pomerium/pull/2105) (@travisgroth) -- deployment: Publish OS packages to cloudsmith [#2108](https://github.com/pomerium/pomerium/pull/2108) (@github-actions[bot]) -- deployment: update get-envoy script and release hooks [#2111](https://github.com/pomerium/pomerium/pull/2111) (@travisgroth) -- deployment: update get-envoy script and release hooks [#2112](https://github.com/pomerium/pomerium/pull/2112) (@github-actions[bot]) - -### Changed - -- Add `xff\_num\_trusted\_hops` config option [#2003](https://github.com/pomerium/pomerium/pull/2003) (@ntoofu) - -- add default gitlab url [#2044](https://github.com/pomerium/pomerium/pull/2044) (@contrun) - -- authorize: remove log [#2122](https://github.com/pomerium/pomerium/pull/2122) (@calebdoxsey) -- ci: deploy latest release to test environment [#1916](https://github.com/pomerium/pomerium/pull/1916) (@travisgroth) -- ci: deploy master to integration environments [#1973](https://github.com/pomerium/pomerium/pull/1973) (@travisgroth) -- config related metrics [#2065](https://github.com/pomerium/pomerium/pull/2065) (@wasaga) -- config: expose viper policy hooks [#1947](https://github.com/pomerium/pomerium/pull/1947) (@calebdoxsey) -- controlplane: maybe fix flaky test [#1873](https://github.com/pomerium/pomerium/pull/1873) (@calebdoxsey) -- envoy: restrict permissions on embedded envoy binary [#1999](https://github.com/pomerium/pomerium/pull/1999) (@calebdoxsey) -- in-memory service registry [#1892](https://github.com/pomerium/pomerium/pull/1892) (@wasaga) -- logs: strip query string [#1894](https://github.com/pomerium/pomerium/pull/1894) (@calebdoxsey) -- oidc: use groups claim from ID token if present [#1970](https://github.com/pomerium/pomerium/pull/1970) (@bonifaido) -- proxy: support re-proxying request through control plane for kubernetes [#2051](https://github.com/pomerium/pomerium/pull/2051) (@calebdoxsey) -- remove generated code from code coverage metrics [#1857](https://github.com/pomerium/pomerium/pull/1857) (@travisgroth) -- Updating Doc for Pomerium-Dex Exercise [#2018](https://github.com/pomerium/pomerium/pull/2018) (@dharmendrakariya) - -## [v0.14.0-rc2](https://github.com/pomerium/pomerium/tree/v0.14.0-rc2) (2021-04-29) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.0-rc1...v0.14.0-rc2) - -### New - -- config: remove validate side effects [#2109](https://github.com/pomerium/pomerium/pull/2109) (@calebdoxsey) -- control plane: add request id to all error pages [#2149](https://github.com/pomerium/pomerium/pull/2149) (@desimone) -- controlplane: save configuration events to databroker [#2153](https://github.com/pomerium/pomerium/pull/2153) (@calebdoxsey) -- databroker: add options for maximum capacity [#2095](https://github.com/pomerium/pomerium/pull/2095) (@calebdoxsey) -- Drop tun.cfg.dstHost from jwtCacheKey [#2115](https://github.com/pomerium/pomerium/pull/2115) (@bl0m1) -- envoy: re-implement recommended defaults [#2123](https://github.com/pomerium/pomerium/pull/2123) (@calebdoxsey) -- let pass custom dial opts [#2144](https://github.com/pomerium/pomerium/pull/2144) (@wasaga) -- log context [#2107](https://github.com/pomerium/pomerium/pull/2107) (@wasaga) - -### Fixed - -- deployment: update alpine debug image dependencies [#2154](https://github.com/pomerium/pomerium/pull/2154) (@travisgroth) - -- authorize: refactor store locking [#2151](https://github.com/pomerium/pomerium/pull/2151) (@calebdoxsey) - -- databroker: store server version in backend [#2142](https://github.com/pomerium/pomerium/pull/2142) (@calebdoxsey) - -- authorize: audit log had duplicate "message" key [#2141](https://github.com/pomerium/pomerium/pull/2141) (@desimone) -- httputil: fix SPDY support with reverse proxy [#2134](https://github.com/pomerium/pomerium/pull/2134) (@calebdoxsey) -- envoyconfig: fix metrics ingress listener name [#2124](https://github.com/pomerium/pomerium/pull/2124) (@calebdoxsey) -- authorize: fix empty sub policy arrays [#2119](https://github.com/pomerium/pomerium/pull/2119) (@calebdoxsey) -- authorize: fix unsigned URL [#2118](https://github.com/pomerium/pomerium/pull/2118) (@calebdoxsey) -- authorize: support arbitrary jwt claims [#2102](https://github.com/pomerium/pomerium/pull/2102) (@calebdoxsey) - -### Security - -- deps: bump envoy to 1.17.2 [#2113](https://github.com/pomerium/pomerium/pull/2113) (@travisgroth) - -### Documentation - -- docs: mention alternative bearer token header format [#2155](https://github.com/pomerium/pomerium/pull/2155) (@travisgroth) -- docs: upgrade notes on `allowed\_users` by ID [#2133](https://github.com/pomerium/pomerium/pull/2133) (@travisgroth) - -### Dependency - -- use cached envoy [#2132](https://github.com/pomerium/pomerium/pull/2132) (@wasaga) -- chore(deps): bump github.com/prometheus/common from 0.20.0 to 0.21.0 [#2130](https://github.com/pomerium/pomerium/pull/2130) (@dependabot[bot]) -- chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 0.5.1 to 0.6.0 [#2129](https://github.com/pomerium/pomerium/pull/2129) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.44.0 to 0.45.0 [#2128](https://github.com/pomerium/pomerium/pull/2128) (@dependabot[bot]) -- chore(deps): bump github.com/caddyserver/certmagic from 0.12.0 to 0.13.0 [#2074](https://github.com/pomerium/pomerium/pull/2074) (@dependabot[bot]) - -### Deployment - -- deployment: update get-envoy script and release hooks [#2111](https://github.com/pomerium/pomerium/pull/2111) (@travisgroth) -- deployment: Publish OS packages to cloudsmith [#2105](https://github.com/pomerium/pomerium/pull/2105) (@travisgroth) - -### Changed - -- authorize: remove log [#2122](https://github.com/pomerium/pomerium/pull/2122) (@calebdoxsey) - -## [v0.14.0-rc1](https://github.com/pomerium/pomerium/tree/v0.14.0-rc1) (2021-04-22) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.13.6...v0.14.0-rc1) - -### Breaking - -- directory: remove provider from user id [#2068](https://github.com/pomerium/pomerium/pull/2068) (@calebdoxsey) - -### New - -- assets: use embed instead of statik [#1960](https://github.com/pomerium/pomerium/pull/1960) (@calebdoxsey) -- authorize: add databroker server and record version to result, force sync via polling [#2024](https://github.com/pomerium/pomerium/pull/2024) (@calebdoxsey) -- authorize: additional tracing, add benchmark for encryptor [#2059](https://github.com/pomerium/pomerium/pull/2059) (@calebdoxsey) -- authorize: audit logging [#2050](https://github.com/pomerium/pomerium/pull/2050) (@calebdoxsey) -- authorize: move headers and jwt signing to rego [#1856](https://github.com/pomerium/pomerium/pull/1856) (@calebdoxsey) -- authorize: set JWT to expire after 5 minutes [#1980](https://github.com/pomerium/pomerium/pull/1980) (@calebdoxsey) -- autocert: add metrics for renewal count, total and next expiration [#2019](https://github.com/pomerium/pomerium/pull/2019) (@calebdoxsey) -- autocert: remove non-determinism [#1932](https://github.com/pomerium/pomerium/pull/1932) (@calebdoxsey) -- config: add CertificateFiles to FileWatcherSource list [#1878](https://github.com/pomerium/pomerium/pull/1878) (@travisgroth) -- config: add metrics_basic_auth option [#1917](https://github.com/pomerium/pomerium/pull/1917) (@calebdoxsey) -- config: add rewrite_response_headers option [#1961](https://github.com/pomerium/pomerium/pull/1961) (@calebdoxsey) -- config: add rewrite_response_headers to protobuf [#1962](https://github.com/pomerium/pomerium/pull/1962) (@calebdoxsey) -- config: allow customization of envoy boostrap admin options [#1872](https://github.com/pomerium/pomerium/pull/1872) (@calebdoxsey) -- config: log config source changes [#1959](https://github.com/pomerium/pomerium/pull/1959) (@calebdoxsey) -- config: multiple endpoints for authorize and databroker [#1957](https://github.com/pomerium/pomerium/pull/1957) (@calebdoxsey) -- config: rename headers to set_response_headers [#2081](https://github.com/pomerium/pomerium/pull/2081) (@calebdoxsey) -- config: support map of jwt claim headers [#1906](https://github.com/pomerium/pomerium/pull/1906) (@calebdoxsey) -- config: use getters for authenticate, signout and forward auth urls [#2000](https://github.com/pomerium/pomerium/pull/2000) (@calebdoxsey) -- config: use getters for certificates [#2001](https://github.com/pomerium/pomerium/pull/2001) (@calebdoxsey) -- crypto: use actual bytes of shared secret, not the base64 encoded representation [#2075](https://github.com/pomerium/pomerium/pull/2075) (@calebdoxsey) -- cryptutil: add envelope encryption w/key encryption key and data encryption key [#2020](https://github.com/pomerium/pomerium/pull/2020) (@calebdoxsey) -- cryptutil: always use kek public id, add x509 support [#2066](https://github.com/pomerium/pomerium/pull/2066) (@calebdoxsey) -- cryptutil: use bytes for hmac [#2067](https://github.com/pomerium/pomerium/pull/2067) (@calebdoxsey) -- databroker: refactor databroker to sync all changes [#1879](https://github.com/pomerium/pomerium/pull/1879) (@calebdoxsey) -- databroker: return server version in Get [#2039](https://github.com/pomerium/pomerium/pull/2039) (@wasaga) -- envoy: refactor controlplane xds to new envoyconfig package [#2086](https://github.com/pomerium/pomerium/pull/2086) (@calebdoxsey) -- envoy: upgrade to v1.17.1 [#1993](https://github.com/pomerium/pomerium/pull/1993) (@calebdoxsey) -- envoy: validate binary checksum [#1908](https://github.com/pomerium/pomerium/pull/1908) (@calebdoxsey) -- envoyconfig: move most bootstrap config to shared package [#2088](https://github.com/pomerium/pomerium/pull/2088) (@calebdoxsey) -- identity: infer email from mail claim [#1977](https://github.com/pomerium/pomerium/pull/1977) (@calebdoxsey) -- identity: record metric for last refresh [#1936](https://github.com/pomerium/pomerium/pull/1936) (@calebdoxsey) -- metrics: add TLS options [#1939](https://github.com/pomerium/pomerium/pull/1939) (@calebdoxsey) -- middleware: basic auth equalize lengths of input [#1934](https://github.com/pomerium/pomerium/pull/1934) (@desimone) -- ping: identity and directory providers [#1975](https://github.com/pomerium/pomerium/pull/1975) (@calebdoxsey) -- protoutil: add generic transformer [#2023](https://github.com/pomerium/pomerium/pull/2023) (@calebdoxsey) -- proxy: implement pass-through for authenticate backend [#1870](https://github.com/pomerium/pomerium/pull/1870) (@calebdoxsey) -- redis: add redis cluster support [#1992](https://github.com/pomerium/pomerium/pull/1992) (@calebdoxsey) -- redis: add support for redis-sentinel [#1991](https://github.com/pomerium/pomerium/pull/1991) (@calebdoxsey) -- Remove internal/protoutil. [#1893](https://github.com/pomerium/pomerium/pull/1893) (@yegle) -- support host:port in metrics_address [#2042](https://github.com/pomerium/pomerium/pull/2042) (@wasaga) -- telemetry: add installation id [#2017](https://github.com/pomerium/pomerium/pull/2017) (@calebdoxsey) -- telemetry: add process collector for envoy [#1948](https://github.com/pomerium/pomerium/pull/1948) (@calebdoxsey) -- use build_info as liveness gauge metric [#1940](https://github.com/pomerium/pomerium/pull/1940) (@wasaga) -- xds: use ALPN Auto config for upstream protocol when possible [#1995](https://github.com/pomerium/pomerium/pull/1995) (@calebdoxsey) - -### Fixed - -- authenticate: fix default sign out url [#2061](https://github.com/pomerium/pomerium/pull/2061) (@calebdoxsey) -- authenticate: validate origin of signout [#1876](https://github.com/pomerium/pomerium/pull/1876) (@desimone) -- authorize: bypass data in rego for databroker data [#2041](https://github.com/pomerium/pomerium/pull/2041) (@calebdoxsey) -- authorize: support arbitrary jwt claims [#2106](https://github.com/pomerium/pomerium/pull/2106) (@github-actions[bot]) -- change require_proxy_protocol to use_proxy_protocol [#2043](https://github.com/pomerium/pomerium/pull/2043) (@contrun) -- ci: pin goreleaser version [#1900](https://github.com/pomerium/pomerium/pull/1900) (@travisgroth) -- cmd/pomerium: exit 0 for normal shutdown [#1958](https://github.com/pomerium/pomerium/pull/1958) (@travisgroth) -- config: add headers to config proto [#1996](https://github.com/pomerium/pomerium/pull/1996) (@calebdoxsey) -- config: don't change address value on databroker or authorize [#2092](https://github.com/pomerium/pomerium/pull/2092) (@travisgroth) -- config: fix redirect routes from protobuf [#1930](https://github.com/pomerium/pomerium/pull/1930) (@travisgroth) -- config: use tls_custom_ca from policy when available [#2077](https://github.com/pomerium/pomerium/pull/2077) (@calebdoxsey) -- controlplane: add global headers to virtualhost [#1861](https://github.com/pomerium/pomerium/pull/1861) (@desimone) -- databroker: remove unused installation id, close streams when backend is closed [#2062](https://github.com/pomerium/pomerium/pull/2062) (@calebdoxsey) -- Fix process cpu usage metric [#1979](https://github.com/pomerium/pomerium/pull/1979) (@wasaga) -- fix registry test [#1911](https://github.com/pomerium/pomerium/pull/1911) (@wasaga) -- google: fix default provider URL [#1928](https://github.com/pomerium/pomerium/pull/1928) (@calebdoxsey) -- metrics_address should be optional parameter [#2087](https://github.com/pomerium/pomerium/pull/2087) (@wasaga) -- onelogin: fix default scopes for v2 [#1896](https://github.com/pomerium/pomerium/pull/1896) (@calebdoxsey) -- options: header only applies to routes and authN [#1862](https://github.com/pomerium/pomerium/pull/1862) (@desimone) -- propagate changes back from encrypted backend [#2079](https://github.com/pomerium/pomerium/pull/2079) (@wasaga) -- proxy: add nil check for fix-misdirected [#2040](https://github.com/pomerium/pomerium/pull/2040) (@calebdoxsey) -- proxy: redirect to dashboard for logout [#1944](https://github.com/pomerium/pomerium/pull/1944) (@calebdoxsey) -- redis: fix deletion versioning [#1871](https://github.com/pomerium/pomerium/pull/1871) (@calebdoxsey) -- unique envoy cluster ids [#1858](https://github.com/pomerium/pomerium/pull/1858) (@wasaga) -- xds: fix misdirected script [#1895](https://github.com/pomerium/pomerium/pull/1895) (@calebdoxsey) -- xdsmgr: update resource versions on NACK [#2093](https://github.com/pomerium/pomerium/pull/2093) (@calebdoxsey) - -### Security - -- authenticate: validate signature on /.pomerium, /.pomerium/sign_in and /.pomerium/sign_out [#2048](https://github.com/pomerium/pomerium/pull/2048) (@travisgroth) -- deps: bump envoy to 1.17.2 [#2114](https://github.com/pomerium/pomerium/pull/2114) (@github-actions[bot]) -- proxy: restrict programmatic URLs to localhost [#2049](https://github.com/pomerium/pomerium/pull/2049) (@travisgroth) - -### Documentation - -- docs: add breaking sa changes in v0.13 [#1919](https://github.com/pomerium/pomerium/pull/1919) (@desimone) - -- docs: add JWT Verification w/Envoy guide [#1974](https://github.com/pomerium/pomerium/pull/1974) (@calebdoxsey) - -- docs: add load balancing weight documentation [#1883](https://github.com/pomerium/pomerium/pull/1883) (@travisgroth) - -- docs: add threat model to security page [#2097](https://github.com/pomerium/pomerium/pull/2097) (@desimone) -- docs: add v0.13 to docs site menu [#1913](https://github.com/pomerium/pomerium/pull/1913) (@travisgroth) -- docs: additional load balancing documentation [#1875](https://github.com/pomerium/pomerium/pull/1875) (@travisgroth) -- docs: fix query param name [#1920](https://github.com/pomerium/pomerium/pull/1920) (@calebdoxsey) -- docs: misc upgrade notes and changelog [#1884](https://github.com/pomerium/pomerium/pull/1884) (@travisgroth) -- docs: update changelog for v0.13.0 [#1909](https://github.com/pomerium/pomerium/pull/1909) (@desimone) -- docs: update community slack link [#2063](https://github.com/pomerium/pomerium/pull/2063) (@travisgroth) -- docs: update security policy [#1897](https://github.com/pomerium/pomerium/pull/1897) (@desimone) -- ping: add documentation [#1976](https://github.com/pomerium/pomerium/pull/1976) (@calebdoxsey) -- Update data-storage.md [#1941](https://github.com/pomerium/pomerium/pull/1941) (@TanguyPatte) -- Update local-oidc.md [#1994](https://github.com/pomerium/pomerium/pull/1994) (@dharmendrakariya) - -### Dependency - -- chore(deps): bump github.com/go-redis/redis/v8 from 8.8.0 to 8.8.2 [#2099](https://github.com/pomerium/pomerium/pull/2099) (@dependabot[bot]) -- chore(deps): bump google.golang.org/api from 0.43.0 to 0.44.0 [#2073](https://github.com/pomerium/pomerium/pull/2073) (@dependabot[bot]) -- chore(deps): bump google.golang.org/grpc from 1.36.1 to 1.37.0 [#2072](https://github.com/pomerium/pomerium/pull/2072) (@dependabot[bot]) -- chore(deps): bump gopkg.in/auth0.v5 from 5.13.0 to 5.14.1 [#2071](https://github.com/pomerium/pomerium/pull/2071) (@dependabot[bot]) -- chore(deps): bump gopkg.in/auth0.v5 from 5.14.1 to 5.15.0 [#2098](https://github.com/pomerium/pomerium/pull/2098) (@dependabot[bot]) -- chore(deps): update codecov/codecov-action action to v1.3.1 [#1985](https://github.com/pomerium/pomerium/pull/1985) (@renovate[bot]) -- chore(deps): update golang.org/x/oauth2 commit hash to 0101308 [#1863](https://github.com/pomerium/pomerium/pull/1863) (@renovate[bot]) -- chore(deps): update golang.org/x/oauth2 commit hash to 6667018 [#1886](https://github.com/pomerium/pomerium/pull/1886) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to bba0dbe [#1864](https://github.com/pomerium/pomerium/pull/1864) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to e7f2df4 [#1887](https://github.com/pomerium/pomerium/pull/1887) (@renovate[bot]) -- chore(deps): update mikefarah/yq action to v4.5.0 [#1865](https://github.com/pomerium/pomerium/pull/1865) (@renovate[bot]) -- chore(deps): update mikefarah/yq action to v4.5.1 [#1888](https://github.com/pomerium/pomerium/pull/1888) (@renovate[bot]) -- chore(deps): update mikefarah/yq action to v4.6.1 [#1951](https://github.com/pomerium/pomerium/pull/1951) (@renovate[bot]) -- chore(deps): update mikefarah/yq action to v4.6.2 [#2007](https://github.com/pomerium/pomerium/pull/2007) (@renovate[bot]) -- chore(deps): update mikefarah/yq action to v4.6.3 [#2031](https://github.com/pomerium/pomerium/pull/2031) (@renovate[bot]) -- chore(deps): update module auth0 to v5 [#1868](https://github.com/pomerium/pomerium/pull/1868) (@renovate[bot]) -- chore(deps): update module go-redis/redis/v8 to v8.5.0 [#1866](https://github.com/pomerium/pomerium/pull/1866) (@renovate[bot]) -- chore(deps): update module google.golang.org/api to v0.39.0 [#1867](https://github.com/pomerium/pomerium/pull/1867) (@renovate[bot]) -- chore(deps): update module google.golang.org/api to v0.40.0 [#1889](https://github.com/pomerium/pomerium/pull/1889) (@renovate[bot]) -- chore(deps): update module spf13/cobra to v1.1.3 [#1890](https://github.com/pomerium/pomerium/pull/1890) (@renovate[bot]) -- chore(deps): update vuepress monorepo to v1.8.1 [#1891](https://github.com/pomerium/pomerium/pull/1891) (@renovate[bot]) -- chore(deps): update vuepress monorepo to v1.8.2 [#1952](https://github.com/pomerium/pomerium/pull/1952) (@renovate[bot]) -- chore(deps): update yaml v2 to v3 [#1927](https://github.com/pomerium/pomerium/pull/1927) (@desimone) -- deps: bundle all patch upgrades in a single group [#2016](https://github.com/pomerium/pomerium/pull/2016) (@travisgroth) -- deps: switch from renovate to dependabot [#2069](https://github.com/pomerium/pomerium/pull/2069) (@travisgroth) -- do not require project be in GOPATH/src [#2078](https://github.com/pomerium/pomerium/pull/2078) (@wasaga) -- fix(deps): update github.com/nsf/jsondiff commit hash to 6ea3239 [#1965](https://github.com/pomerium/pomerium/pull/1965) (@renovate[bot]) -- fix(deps): update golang.org/x/crypto commit hash to 0c34fe9 [#2027](https://github.com/pomerium/pomerium/pull/2027) (@renovate[bot]) -- fix(deps): update golang.org/x/crypto commit hash to 513c2a4 [#1982](https://github.com/pomerium/pomerium/pull/1982) (@renovate[bot]) -- fix(deps): update golang.org/x/net commit hash to 0fccb6f [#2052](https://github.com/pomerium/pomerium/pull/2052) (@renovate[bot]) -- fix(deps): update golang.org/x/net commit hash to 61e0566 [#2028](https://github.com/pomerium/pomerium/pull/2028) (@renovate[bot]) -- fix(deps): update golang.org/x/net commit hash to d523dce [#2005](https://github.com/pomerium/pomerium/pull/2005) (@renovate[bot]) -- fix(deps): update golang.org/x/net commit hash to e18ecbb [#1949](https://github.com/pomerium/pomerium/pull/1949) (@renovate[bot]) -- fix(deps): update golang.org/x/oauth2 commit hash to 22b0ada [#2029](https://github.com/pomerium/pomerium/pull/2029) (@renovate[bot]) -- fix(deps): update golang.org/x/oauth2 commit hash to 2e8d934 [#2053](https://github.com/pomerium/pomerium/pull/2053) (@renovate[bot]) -- fix(deps): update golang.org/x/oauth2 commit hash to cd4f82c [#1983](https://github.com/pomerium/pomerium/pull/1983) (@renovate[bot]) -- fix(deps): update google.golang.org/genproto commit hash to 5f0e893 [#2006](https://github.com/pomerium/pomerium/pull/2006) (@renovate[bot]) -- fix(deps): update google.golang.org/genproto commit hash to 679c6ae [#2030](https://github.com/pomerium/pomerium/pull/2030) (@renovate[bot]) -- fix(deps): update google.golang.org/genproto commit hash to 6c239bb [#2054](https://github.com/pomerium/pomerium/pull/2054) (@renovate[bot]) -- fix(deps): update google.golang.org/genproto commit hash to 8812039 [#1984](https://github.com/pomerium/pomerium/pull/1984) (@renovate[bot]) -- fix(deps): update google.golang.org/genproto commit hash to 9728d6b [#1966](https://github.com/pomerium/pomerium/pull/1966) (@renovate[bot]) -- fix(deps): update google.golang.org/genproto commit hash to ab064af [#1950](https://github.com/pomerium/pomerium/pull/1950) (@renovate[bot]) -- fix(deps): update module contrib.go.opencensus.io/exporter/prometheus to v0.3.0 [#1986](https://github.com/pomerium/pomerium/pull/1986) (@renovate[bot]) -- fix(deps): update module github.com/envoyproxy/protoc-gen-validate to v0.5.0 [#2008](https://github.com/pomerium/pomerium/pull/2008) (@renovate[bot]) -- fix(deps): update module github.com/envoyproxy/protoc-gen-validate to v0.5.1 [#2056](https://github.com/pomerium/pomerium/pull/2056) (@renovate[bot]) -- fix(deps): update module github.com/go-chi/chi to v5 [#1956](https://github.com/pomerium/pomerium/pull/1956) (@renovate[bot]) -- fix(deps): update module github.com/go-redis/redis/v8 to v8.7.1 [#1967](https://github.com/pomerium/pomerium/pull/1967) (@renovate[bot]) -- fix(deps): update module github.com/go-redis/redis/v8 to v8.8.0 [#2032](https://github.com/pomerium/pomerium/pull/2032) (@renovate[bot]) -- fix(deps): update module github.com/golang/protobuf to v1.5.1 [#2009](https://github.com/pomerium/pomerium/pull/2009) (@renovate[bot]) -- fix(deps): update module github.com/golang/protobuf to v1.5.2 [#2057](https://github.com/pomerium/pomerium/pull/2057) (@renovate[bot]) -- fix(deps): update module github.com/google/btree to v1.0.1 [#2010](https://github.com/pomerium/pomerium/pull/2010) (@renovate[bot]) -- fix(deps): update module github.com/google/go-cmp to v0.5.5 [#1968](https://github.com/pomerium/pomerium/pull/1968) (@renovate[bot]) -- fix(deps): update module github.com/hashicorp/go-multierror to v1.1.1 [#1987](https://github.com/pomerium/pomerium/pull/1987) (@renovate[bot]) -- fix(deps): update module github.com/lithammer/shortuuid/v3 to v3.0.6 [#1953](https://github.com/pomerium/pomerium/pull/1953) (@renovate[bot]) -- fix(deps): update module github.com/open-policy-agent/opa to v0.27.1 [#1988](https://github.com/pomerium/pomerium/pull/1988) (@renovate[bot]) -- fix(deps): update module github.com/prometheus/client_golang to v1.10.0 [#2011](https://github.com/pomerium/pomerium/pull/2011) (@renovate[bot]) -- fix(deps): update module github.com/prometheus/common to v0.20.0 [#2033](https://github.com/pomerium/pomerium/pull/2033) (@renovate[bot]) -- fix(deps): update module github.com/prometheus/procfs to v0.6.0 [#1969](https://github.com/pomerium/pomerium/pull/1969) (@renovate[bot]) -- fix(deps): update module github.com/rs/zerolog to v1.21.0 [#2034](https://github.com/pomerium/pomerium/pull/2034) (@renovate[bot]) -- fix(deps): update module go.opencensus.io to v0.23.0 [#1954](https://github.com/pomerium/pomerium/pull/1954) (@renovate[bot]) -- fix(deps): update module google.golang.org/api to v0.42.0 [#1989](https://github.com/pomerium/pomerium/pull/1989) (@renovate[bot]) -- fix(deps): update module google.golang.org/api to v0.43.0 [#2035](https://github.com/pomerium/pomerium/pull/2035) (@renovate[bot]) -- fix(deps): update module google.golang.org/grpc to v1.36.0 [#1955](https://github.com/pomerium/pomerium/pull/1955) (@renovate[bot]) -- fix(deps): update module google.golang.org/grpc to v1.36.1 [#2036](https://github.com/pomerium/pomerium/pull/2036) (@renovate[bot]) -- fix(deps): update module google.golang.org/protobuf to v1.26.0 [#2012](https://github.com/pomerium/pomerium/pull/2012) (@renovate[bot]) -- fix(deps): update module gopkg.in/auth0.v5 to v5.13.0 [#2037](https://github.com/pomerium/pomerium/pull/2037) (@renovate[bot]) -- skip REDIS cluster test if GOOS != linux [#2045](https://github.com/pomerium/pomerium/pull/2045) (@wasaga) - -### Deployment - -- ci: cache build and test binaries [#1938](https://github.com/pomerium/pomerium/pull/1938) (@desimone) -- ci: go 1.16.x, cached tests [#1937](https://github.com/pomerium/pomerium/pull/1937) (@desimone) -- deployment: Publish OS packages to cloudsmith [#2108](https://github.com/pomerium/pomerium/pull/2108) (@github-actions[bot]) -- deployment: update get-envoy script and release hooks [#2112](https://github.com/pomerium/pomerium/pull/2112) (@github-actions[bot]) - -### Changed - -- Add `xff\_num\_trusted\_hops` config option [#2003](https://github.com/pomerium/pomerium/pull/2003) (@ntoofu) - -- add default gitlab url [#2044](https://github.com/pomerium/pomerium/pull/2044) (@contrun) - -- ci: deploy latest release to test environment [#1916](https://github.com/pomerium/pomerium/pull/1916) (@travisgroth) - -- ci: deploy master to integration environments [#1973](https://github.com/pomerium/pomerium/pull/1973) (@travisgroth) -- config related metrics [#2065](https://github.com/pomerium/pomerium/pull/2065) (@wasaga) -- config: expose viper policy hooks [#1947](https://github.com/pomerium/pomerium/pull/1947) (@calebdoxsey) -- controlplane: maybe fix flaky test [#1873](https://github.com/pomerium/pomerium/pull/1873) (@calebdoxsey) -- envoy: restrict permissions on embedded envoy binary [#1999](https://github.com/pomerium/pomerium/pull/1999) (@calebdoxsey) -- in-memory service registry [#1892](https://github.com/pomerium/pomerium/pull/1892) (@wasaga) -- logs: strip query string [#1894](https://github.com/pomerium/pomerium/pull/1894) (@calebdoxsey) -- oidc: use groups claim from ID token if present [#1970](https://github.com/pomerium/pomerium/pull/1970) (@bonifaido) -- proxy: support re-proxying request through control plane for kubernetes [#2051](https://github.com/pomerium/pomerium/pull/2051) (@calebdoxsey) -- remove generated code from code coverage metrics [#1857](https://github.com/pomerium/pomerium/pull/1857) (@travisgroth) -- Updating Doc for Pomerium-Dex Exercise [#2018](https://github.com/pomerium/pomerium/pull/2018) (@dharmendrakariya) - -## [v0.13.6](https://github.com/pomerium/pomerium/tree/v0.13.6) (2021-04-17) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.13.5...v0.13.6) - -### Security - -- deps: upgrade envoy to 1.16.3 [#2096](https://github.com/pomerium/pomerium/pull/2096) (@travisgroth) - -### Documentation - -- docs: update community slack link [#2064](https://github.com/pomerium/pomerium/pull/2064) (@github-actions[bot]) - -## [v0.13.5](https://github.com/pomerium/pomerium/tree/v0.13.5) (2021-04-06) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.13.4...v0.13.5) - -### Fixed - -- change require_proxy_protocol to use_proxy_protocol [#2058](https://github.com/pomerium/pomerium/pull/2058) (@github-actions[bot]) - -## [v0.13.4](https://github.com/pomerium/pomerium/tree/v0.13.4) (2021-03-31) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.13.3...v0.13.4) - -### Security - -- proxy: restrict programmatic URLs to localhost [#2047](https://github.com/pomerium/pomerium/pull/2047) (@travisgroth) -- authenticate: validate signature on /.pomerium, /.pomerium/sign_in and /.pomerium/sign_out [#2046](https://github.com/pomerium/pomerium/pull/2046) (@travisgroth) - -## [v0.13.3](https://github.com/pomerium/pomerium/tree/v0.13.3) (2021-03-12) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.13.2...v0.13.3) - -### New - -- identity: infer email from mail claim [#1978](https://github.com/pomerium/pomerium/pull/1978) (@github-actions[bot]) - -## [v0.13.2](https://github.com/pomerium/pomerium/tree/v0.13.2) (2021-02-25) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.13.1...v0.13.2) - -### Documentation - -- Update data-storage.md [#1942](https://github.com/pomerium/pomerium/pull/1942) (@github-actions[bot]) - -### Changed - -- proxy: redirect to dashboard for logout [#1945](https://github.com/pomerium/pomerium/pull/1945) (@github-actions[bot]) - -## [v0.13.1](https://github.com/pomerium/pomerium/tree/v0.13.1) (2021-02-22) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.13.0...v0.13.1) - -### Fixed - -- config: fix redirect routes from protobuf [#1931](https://github.com/pomerium/pomerium/pull/1931) (@github-actions[bot]) -- google: fix default provider URL [#1929](https://github.com/pomerium/pomerium/pull/1929) (@github-actions[bot]) - -### Documentation - -- docs: fix query param name [#1923](https://github.com/pomerium/pomerium/pull/1923) (@github-actions[bot]) -- docs: add breaking sa changes in v0.13 [#1921](https://github.com/pomerium/pomerium/pull/1921) (@github-actions[bot]) -- docs: add v0.13 to docs site menu [#1914](https://github.com/pomerium/pomerium/pull/1914) (@github-actions[bot]) - -### Changed - -- ci: deploy releases to test environment (#1916) [#1918](https://github.com/pomerium/pomerium/pull/1918) (@travisgroth) - -* _This Changelog was automatically generated by [github_changelog_generator](https://github.com/github-changelog-generator/github-changelog-generator)_ - -## [v0.13.0](https://github.com/pomerium/pomerium/tree/v0.13.0) (2021-02-17) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.12.2...v0.13.0) - -### Breaking - -- authorize: remove admin [#1833](https://github.com/pomerium/pomerium/pull/1833) (@calebdoxsey) -- remove user impersonation and service account cli [#1768](https://github.com/pomerium/pomerium/pull/1768) (@calebdoxsey) - -### New - -- authorize: allow access by user id [#1850](https://github.com/pomerium/pomerium/pull/1850) (@calebdoxsey) -- authorize: remove DataBrokerData input [#1847](https://github.com/pomerium/pomerium/pull/1847) (@calebdoxsey) -- opa: format rego files [#1845](https://github.com/pomerium/pomerium/pull/1845) (@calebdoxsey) -- policy: add new certificate-authority option for downstream mTLS client certificates [#1835](https://github.com/pomerium/pomerium/pull/1835) (@calebdoxsey) -- metrics: human readable cluster name [#1834](https://github.com/pomerium/pomerium/pull/1834) (@wasaga) -- upstream endpoints load balancer weights [#1830](https://github.com/pomerium/pomerium/pull/1830) (@wasaga) -- controlplane: only add listener virtual domains for addresses matching the current TLS domain [#1823](https://github.com/pomerium/pomerium/pull/1823) (@calebdoxsey) -- authenticate: delay evaluation of OIDC provider [#1802](https://github.com/pomerium/pomerium/pull/1802) (@calebdoxsey) -- config: require shared key if using redis backed databroker [#1801](https://github.com/pomerium/pomerium/pull/1801) (@travisgroth) -- upstream health check config [#1796](https://github.com/pomerium/pomerium/pull/1796) (@wasaga) -- new skip_xff_append option [#1788](https://github.com/pomerium/pomerium/pull/1788) (@wasaga) -- policy: add outlier_detection [#1786](https://github.com/pomerium/pomerium/pull/1786) (@calebdoxsey) -- reduce memory usage by handling http/2 coalescing via a lua script [#1779](https://github.com/pomerium/pomerium/pull/1779) (@calebdoxsey) -- add support for proxy protocol on HTTP listener [#1777](https://github.com/pomerium/pomerium/pull/1777) (@calebdoxsey) -- config: support redirect actions [#1776](https://github.com/pomerium/pomerium/pull/1776) (@calebdoxsey) -- config: detect underlying file changes [#1775](https://github.com/pomerium/pomerium/pull/1775) (@calebdoxsey) -- authenticate: update user info screens [#1774](https://github.com/pomerium/pomerium/pull/1774) (@desimone) -- jws: remove issuer [#1754](https://github.com/pomerium/pomerium/pull/1754) (@calebdoxsey) - -### Fixed - -- redis: fix deletion versioning [#1874](https://github.com/pomerium/pomerium/pull/1874) (@github-actions[bot]) -- rego: handle null [#1853](https://github.com/pomerium/pomerium/pull/1853) (@calebdoxsey) -- config: fix data race [#1851](https://github.com/pomerium/pomerium/pull/1851) (@calebdoxsey) -- deployment: set maintainer field in packages [#1848](https://github.com/pomerium/pomerium/pull/1848) (@travisgroth) -- xds: fix always requiring client certificates [#1844](https://github.com/pomerium/pomerium/pull/1844) (@calebdoxsey) -- fix go:generate for envoy config [#1826](https://github.com/pomerium/pomerium/pull/1826) (@calebdoxsey) -- controlplane: only enable STATIC dns when all adresses are IP addresses [#1822](https://github.com/pomerium/pomerium/pull/1822) (@calebdoxsey) -- config: fix databroker policies [#1821](https://github.com/pomerium/pomerium/pull/1821) (@calebdoxsey) -- config: fix hot-reloading [#1820](https://github.com/pomerium/pomerium/pull/1820) (@calebdoxsey) -- Revert "reduce memory usage by handling http/2 coalescing via a lua script" [#1785](https://github.com/pomerium/pomerium/pull/1785) (@calebdoxsey) -- google: fix nil name [#1771](https://github.com/pomerium/pomerium/pull/1771) (@calebdoxsey) -- autocert: improve logging [#1767](https://github.com/pomerium/pomerium/pull/1767) (@travisgroth) - -### Documentation - -- github: add tag suggestion to checklist [#1819](https://github.com/pomerium/pomerium/pull/1819) (@desimone) -- docs: add reference to the go-sdk [#1800](https://github.com/pomerium/pomerium/pull/1800) (@desimone) -- updated host rewrite docs [#1799](https://github.com/pomerium/pomerium/pull/1799) (@vihardesu) -- docs: update menu for v0.12 [#1755](https://github.com/pomerium/pomerium/pull/1755) (@travisgroth) -- Update GitLab provider docs [#1591](https://github.com/pomerium/pomerium/pull/1591) (@bradjones1) -- Fix command in Kubernetes Quick start docs [#1582](https://github.com/pomerium/pomerium/pull/1582) (@wesleyw72) - -### Dependency - -- chore(deps): update module go.opencensus.io to v0.22.6 [#1842](https://github.com/pomerium/pomerium/pull/1842) (@renovate[bot]) -- chore(deps): update module go-redis/redis/v8 to v8.4.11 [#1841](https://github.com/pomerium/pomerium/pull/1841) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to 44e461b [#1840](https://github.com/pomerium/pomerium/pull/1840) (@renovate[bot]) -- chore(deps): update golang.org/x/oauth2 commit hash to f9ce19e [#1839](https://github.com/pomerium/pomerium/pull/1839) (@renovate[bot]) -- chore(deps): update module stretchr/testify to v1.7.0 [#1816](https://github.com/pomerium/pomerium/pull/1816) (@renovate[bot]) -- chore(deps): update module open-policy-agent/opa to v0.26.0 [#1815](https://github.com/pomerium/pomerium/pull/1815) (@renovate[bot]) -- chore(deps): update module mitchellh/mapstructure to v1.4.1 [#1814](https://github.com/pomerium/pomerium/pull/1814) (@renovate[bot]) -- chore(deps): update module google/uuid to v1.2.0 [#1813](https://github.com/pomerium/pomerium/pull/1813) (@renovate[bot]) -- chore(deps): update module google.golang.org/grpc to v1.35.0 [#1812](https://github.com/pomerium/pomerium/pull/1812) (@renovate[bot]) -- chore(deps): update module go-redis/redis/v8 to v8.4.10 [#1811](https://github.com/pomerium/pomerium/pull/1811) (@renovate[bot]) -- chore(deps): update mikefarah/yq action to v4.4.1 [#1810](https://github.com/pomerium/pomerium/pull/1810) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to 8081c04 [#1809](https://github.com/pomerium/pomerium/pull/1809) (@renovate[bot]) -- chore(deps): update golang.org/x/oauth2 commit hash to d3ed898 [#1808](https://github.com/pomerium/pomerium/pull/1808) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to 5f4716e [#1807](https://github.com/pomerium/pomerium/pull/1807) (@renovate[bot]) -- chore(deps): update oidc to v3 [#1783](https://github.com/pomerium/pomerium/pull/1783) (@desimone) -- chore(deps): update vuepress monorepo to v1.8.0 [#1761](https://github.com/pomerium/pomerium/pull/1761) (@renovate[bot]) -- chore(deps): update module go-redis/redis/v8 to v8.4.8 [#1760](https://github.com/pomerium/pomerium/pull/1760) (@renovate[bot]) -- chore(deps): update mikefarah/yq action to v4.3.1 [#1759](https://github.com/pomerium/pomerium/pull/1759) (@renovate[bot]) -- chore(deps): update codecov/codecov-action action to v1.2.1 [#1758](https://github.com/pomerium/pomerium/pull/1758) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to c7d5778 [#1757](https://github.com/pomerium/pomerium/pull/1757) (@renovate[bot]) -- chore(deps): update module google.golang.org/api to v0.38.0 [#1656](https://github.com/pomerium/pomerium/pull/1656) (@renovate[bot]) - -#### Deployment - -- ci: fix usage of env variable in latest tag [#1791](https://github.com/pomerium/pomerium/pull/1791) (@travisgroth) -- databroker: rename cache service [#1790](https://github.com/pomerium/pomerium/pull/1790) (@calebdoxsey) -- ci: fix deprecated command in latestTag step [#1763](https://github.com/pomerium/pomerium/pull/1763) (@travisgroth) - -### Changed - -- docs: additional load balancing documentation [#1882](https://github.com/pomerium/pomerium/pull/1882) (@github-actions[bot]) -- authenticate: validate origin of signout [#1881](https://github.com/pomerium/pomerium/pull/1881) (@github-actions[bot]) -- config: add CertificateFiles to FileWatcherSource list [#1880](https://github.com/pomerium/pomerium/pull/1880) (@github-actions[bot]) -- ci: enable backporting from forks [#1854](https://github.com/pomerium/pomerium/pull/1854) (@travisgroth) -- ci: fix version metadata in non-releases [#1836](https://github.com/pomerium/pomerium/pull/1836) (@travisgroth) -- protobuf: upgrade protoc to 3.14 [#1832](https://github.com/pomerium/pomerium/pull/1832) (@calebdoxsey) -- Update codeowners [#1831](https://github.com/pomerium/pomerium/pull/1831) (@travisgroth) -- config: return errors on invalid URLs, fix linting [#1829](https://github.com/pomerium/pomerium/pull/1829) (@calebdoxsey) -- grpc: use custom resolver [#1828](https://github.com/pomerium/pomerium/pull/1828) (@calebdoxsey) -- controlplane: return errors in xds build methods [#1827](https://github.com/pomerium/pomerium/pull/1827) (@calebdoxsey) -- include envoy's proto specs into config.proto [#1817](https://github.com/pomerium/pomerium/pull/1817) (@wasaga) -- expose all envoy cluster options in policy [#1804](https://github.com/pomerium/pomerium/pull/1804) (@wasaga) -- autocert: store certificates separately from config certificates [#1794](https://github.com/pomerium/pomerium/pull/1794) (@calebdoxsey) -- move file change detection before autocert [#1793](https://github.com/pomerium/pomerium/pull/1793) (@calebdoxsey) -- config: support multiple destination addresses [#1789](https://github.com/pomerium/pomerium/pull/1789) (@calebdoxsey) -- ci: license check action [#1773](https://github.com/pomerium/pomerium/pull/1773) (@travisgroth) -- authorize: move impersonation into session/service account [#1765](https://github.com/pomerium/pomerium/pull/1765) (@calebdoxsey) - - ### [v0.12.2](https://github.com/pomerium/pomerium/tree/v0.12.2) (2021-02-02) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.12.1...v0.12.2) - -### Fixed - -- [Backport 0-12-0] deployment: set maintainer field in packages [#1849](https://github.com/pomerium/pomerium/pull/1849) (@github-actions[bot]) - -### Changed - -- [Backport 0-12-0] ci: fix usage of env variable in latest tag [#1806](https://github.com/pomerium/pomerium/pull/1806) (@github-actions[bot]) -- [Backport 0-12-0] docs: add reference to the go-sdk [#1803](https://github.com/pomerium/pomerium/pull/1803) (@github-actions[bot]) - - ### [v0.12.1](https://github.com/pomerium/pomerium/tree/v0.12.1) (2021-01-13) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.12.0...v0.12.1) - -### Fixed - -- [Backport 0-12-0] google: fix nil name [#1772](https://github.com/pomerium/pomerium/pull/1772) (@github-actions[bot]) -- [Backport 0-12-0] autocert: improve logging [#1769](https://github.com/pomerium/pomerium/pull/1769) (@travisgroth) - -### Documentation - -- [Backport 0-12-0] docs: update menu for v0.12 [#1762](https://github.com/pomerium/pomerium/pull/1762) (@github-actions[bot]) - -#### Deployment - -- [Backport 0-12-0] ci: fix deprecated command in latestTag step [#1764](https://github.com/pomerium/pomerium/pull/1764) (@github-actions[bot]) - -## [v0.12.0](https://github.com/pomerium/pomerium/tree/v0.12.0) (2021-01-07) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.11.1...v0.12.0) - -### New - -- tcp: prevent idle stream timeouts for TCP and Websocket routes [#1744](https://github.com/pomerium/pomerium/pull/1744) (@calebdoxsey) -- telemetry: add support for datadog tracing [#1743](https://github.com/pomerium/pomerium/pull/1743) (@calebdoxsey) -- use incremental API for envoy xDS [#1732](https://github.com/pomerium/pomerium/pull/1732) (@calebdoxsey) -- cli: add version command [#1726](https://github.com/pomerium/pomerium/pull/1726) (@desimone) -- add TLS flags for TCP tunnel [#1725](https://github.com/pomerium/pomerium/pull/1725) (@calebdoxsey) -- k8s cmd: use authclient package [#1722](https://github.com/pomerium/pomerium/pull/1722) (@calebdoxsey) -- internal/controlplane: 0s default timeout for tcp routes [#1716](https://github.com/pomerium/pomerium/pull/1716) (@travisgroth) -- use impersonate groups if impersonate email is set [#1701](https://github.com/pomerium/pomerium/pull/1701) (@calebdoxsey) -- unimpersonate button [#1700](https://github.com/pomerium/pomerium/pull/1700) (@calebdoxsey) -- TCP client command [#1696](https://github.com/pomerium/pomerium/pull/1696) (@calebdoxsey) -- add support for TCP routes [#1695](https://github.com/pomerium/pomerium/pull/1695) (@calebdoxsey) -- internal/directory: use gitlab provider url option [#1689](https://github.com/pomerium/pomerium/pull/1689) (@nghnam) -- improve ca cert error message, use GetCertPool for databroker storage [#1666](https://github.com/pomerium/pomerium/pull/1666) (@calebdoxsey) -- implement new redis storage backend with go-redis package [#1649](https://github.com/pomerium/pomerium/pull/1649) (@calebdoxsey) -- authenticate: oidc frontchannel-logout endpoint [#1586](https://github.com/pomerium/pomerium/pull/1586) (@pflipp) - -### Fixed - -- remove :443 or :80 from proxy URLs in authclient [#1733](https://github.com/pomerium/pomerium/pull/1733) (@calebdoxsey) -- tcptunnel: handle invalid http response codes [#1727](https://github.com/pomerium/pomerium/pull/1727) (@calebdoxsey) -- update azure docs [#1723](https://github.com/pomerium/pomerium/pull/1723) (@calebdoxsey) -- config: fix ignored yaml fields [#1698](https://github.com/pomerium/pomerium/pull/1698) (@travisgroth) -- fix concurrency race [#1675](https://github.com/pomerium/pomerium/pull/1675) (@calebdoxsey) -- don't create users when updating sessions [#1671](https://github.com/pomerium/pomerium/pull/1671) (@calebdoxsey) - -### Documentation - -- update google docs [#1738](https://github.com/pomerium/pomerium/pull/1738) (@calebdoxsey) -- docs: add TCP guide [#1714](https://github.com/pomerium/pomerium/pull/1714) (@travisgroth) -- docs: tcp support [#1712](https://github.com/pomerium/pomerium/pull/1712) (@travisgroth) -- docs: replace httpbin with verify [#1702](https://github.com/pomerium/pomerium/pull/1702) (@desimone) -- docs: fix nginx config [#1691](https://github.com/pomerium/pomerium/pull/1691) (@desimone) -- remove "see policy" phrase in settings docs [#1668](https://github.com/pomerium/pomerium/pull/1668) (@calebdoxsey) -- docs: add allowed_idp_claims docs [#1665](https://github.com/pomerium/pomerium/pull/1665) (@travisgroth) -- docs: add v0.11 link to version menu [#1663](https://github.com/pomerium/pomerium/pull/1663) (@travisgroth) - -### Dependency - -- chore(deps): update module google/uuid to v1.1.4 [#1729](https://github.com/pomerium/pomerium/pull/1729) (@renovate[bot]) -- dev: update linter [#1728](https://github.com/pomerium/pomerium/pull/1728) (@desimone) -- chore(deps): update codecov/codecov-action action to v1.1.1 [#1720](https://github.com/pomerium/pomerium/pull/1720) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to 6772e93 [#1719](https://github.com/pomerium/pomerium/pull/1719) (@renovate[bot]) -- chore(deps): update golang.org/x/crypto commit hash to eec23a3 [#1718](https://github.com/pomerium/pomerium/pull/1718) (@renovate[bot]) -- chore(deps): update precommit hook pre-commit/pre-commit-hooks to v3.4.0 [#1710](https://github.com/pomerium/pomerium/pull/1710) (@renovate[bot]) -- chore(deps): update module prometheus/client_golang to v1.9.0 [#1709](https://github.com/pomerium/pomerium/pull/1709) (@renovate[bot]) -- chore(deps): update module ory/dockertest/v3 to v3.6.3 [#1708](https://github.com/pomerium/pomerium/pull/1708) (@renovate[bot]) -- chore(deps): update module go-redis/redis/v8 to v8.4.4 [#1707](https://github.com/pomerium/pomerium/pull/1707) (@renovate[bot]) -- chore(deps): update codecov/codecov-action action to v1.1.0 [#1706](https://github.com/pomerium/pomerium/pull/1706) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to 8c77b98 [#1705](https://github.com/pomerium/pomerium/pull/1705) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to 986b41b [#1704](https://github.com/pomerium/pomerium/pull/1704) (@renovate[bot]) -- chore(deps): update golang.org/x/crypto commit hash to 9d13527 [#1703](https://github.com/pomerium/pomerium/pull/1703) (@renovate[bot]) -- chore(deps): update module open-policy-agent/opa to v0.25.2 [#1685](https://github.com/pomerium/pomerium/pull/1685) (@renovate[bot]) -- chore(deps): update module go-redis/redis/v8 to v8.4.2 [#1684](https://github.com/pomerium/pomerium/pull/1684) (@renovate[bot]) -- chore(deps): update module envoyproxy/go-control-plane to v0.9.8 [#1683](https://github.com/pomerium/pomerium/pull/1683) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to 40ec1c2 [#1682](https://github.com/pomerium/pomerium/pull/1682) (@renovate[bot]) -- chore(deps): update golang.org/x/sync commit hash to 09787c9 [#1681](https://github.com/pomerium/pomerium/pull/1681) (@renovate[bot]) -- chore(deps): update golang.org/x/oauth2 commit hash to 08078c5 [#1680](https://github.com/pomerium/pomerium/pull/1680) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to ac852fb [#1679](https://github.com/pomerium/pomerium/pull/1679) (@renovate[bot]) -- chore(deps): update golang.org/x/crypto commit hash to 5f87f34 [#1678](https://github.com/pomerium/pomerium/pull/1678) (@renovate[bot]) - -#### Deployment - -- ci: upgrade yq syntax for v4 [#1745](https://github.com/pomerium/pomerium/pull/1745) (@travisgroth) -- deployment: Fix docker and rpm workflows [#1687](https://github.com/pomerium/pomerium/pull/1687) (@travisgroth) -- ci: fix pomerium-cli rpm name [#1661](https://github.com/pomerium/pomerium/pull/1661) (@travisgroth) - -### Changed - -- ci: fix typo in yq image [#1746](https://github.com/pomerium/pomerium/pull/1746) (@travisgroth) -- fix coverage [#1741](https://github.com/pomerium/pomerium/pull/1741) (@calebdoxsey) -- fix error wrapping [#1737](https://github.com/pomerium/pomerium/pull/1737) (@calebdoxsey) -- Revert "set recommended defaults" [#1735](https://github.com/pomerium/pomerium/pull/1735) (@calebdoxsey) -- set recommended defaults [#1734](https://github.com/pomerium/pomerium/pull/1734) (@calebdoxsey) -- internal/telemetry/metrics: update redis metrics for go-redis [#1694](https://github.com/pomerium/pomerium/pull/1694) (@travisgroth) - -## [v0.11.1](https://github.com/pomerium/pomerium/tree/v0.11.1) (2020-12-11) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.11.0...v0.11.1) - -### Fixed - -- [Backport 0-11-0] fix concurrency race [#1676](https://github.com/pomerium/pomerium/pull/1676) (@github-actions[bot]) -- [Backport 0-11-0] don't create users when updating sessions [#1672](https://github.com/pomerium/pomerium/pull/1672) (@github-actions[bot]) - -### Documentation - -- [Backport 0-11-0] remove "see policy" phrase in settings docs [#1669](https://github.com/pomerium/pomerium/pull/1669) (@github-actions[bot]) -- [Backport 0-11-0] docs: add allowed_idp_claims docs [#1667](https://github.com/pomerium/pomerium/pull/1667) (@github-actions[bot]) -- [Backport 0-11-0] docs: add v0.11 link to version menu [#1664](https://github.com/pomerium/pomerium/pull/1664) (@github-actions[bot]) - -#### Deployment - -- [Backport 0-11-0] ci: fix pomerium-cli rpm name [#1662](https://github.com/pomerium/pomerium/pull/1662) (@travisgroth) - -## [v0.11.0](https://github.com/pomerium/pomerium/tree/v0.11.0) (2020-12-04) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.10.6...v0.11.0) - -### Breaking - -- remove deprecated cache_service_url config option [#1614](https://github.com/pomerium/pomerium/pull/1614) (@calebdoxsey) -- add flag to enable user impersonation [#1514](https://github.com/pomerium/pomerium/pull/1514) (@calebdoxsey) - -### New - -- microsoft: add support for common endpoint [#1648](https://github.com/pomerium/pomerium/pull/1648) (@desimone) -- use the directory email when provided for the jwt [#1647](https://github.com/pomerium/pomerium/pull/1647) (@calebdoxsey) -- fix profile image on dashboard [#1637](https://github.com/pomerium/pomerium/pull/1637) (@calebdoxsey) -- wait for initial sync to complete before starting control plane [#1636](https://github.com/pomerium/pomerium/pull/1636) (@calebdoxsey) -- authorize: add signature algo support (RSA / EdDSA) [#1631](https://github.com/pomerium/pomerium/pull/1631) (@desimone) -- replace GetAllPages with InitialSync, improve merge performance [#1624](https://github.com/pomerium/pomerium/pull/1624) (@calebdoxsey) -- cryptutil: more explicit decryption error [#1607](https://github.com/pomerium/pomerium/pull/1607) (@desimone) -- add paging support to GetAll [#1601](https://github.com/pomerium/pomerium/pull/1601) (@calebdoxsey) -- attach version to gRPC server metadata [#1598](https://github.com/pomerium/pomerium/pull/1598) (@calebdoxsey) -- use custom default http transport [#1576](https://github.com/pomerium/pomerium/pull/1576) (@calebdoxsey) -- update user info in addition to refreshing the token [#1572](https://github.com/pomerium/pomerium/pull/1572) (@calebdoxsey) -- databroker: add audience to session [#1557](https://github.com/pomerium/pomerium/pull/1557) (@calebdoxsey) -- authorize: implement allowed_idp_claims [#1542](https://github.com/pomerium/pomerium/pull/1542) (@calebdoxsey) -- autocert: support certificate renewal [#1516](https://github.com/pomerium/pomerium/pull/1516) (@calebdoxsey) -- add policy to allow any authenticated user [#1515](https://github.com/pomerium/pomerium/pull/1515) (@pflipp) -- debug: add pprof endpoints [#1504](https://github.com/pomerium/pomerium/pull/1504) (@calebdoxsey) -- databroker: require JWT for access [#1503](https://github.com/pomerium/pomerium/pull/1503) (@calebdoxsey) -- authenticate: remove unused paths, generate cipher at startup, remove qp store [#1495](https://github.com/pomerium/pomerium/pull/1495) (@desimone) -- forward-auth: use envoy's ext_authz check [#1482](https://github.com/pomerium/pomerium/pull/1482) (@desimone) -- auth0: implement directory provider [#1479](https://github.com/pomerium/pomerium/pull/1479) (@grounded042) -- azure: incremental sync [#1471](https://github.com/pomerium/pomerium/pull/1471) (@calebdoxsey) -- auth0: implement identity provider [#1470](https://github.com/pomerium/pomerium/pull/1470) (@calebdoxsey) -- dashboard: format timestamps [#1468](https://github.com/pomerium/pomerium/pull/1468) (@calebdoxsey) -- directory: additional user info [#1467](https://github.com/pomerium/pomerium/pull/1467) (@calebdoxsey) -- directory: add explicit RefreshUser endpoint for faster sync [#1460](https://github.com/pomerium/pomerium/pull/1460) (@calebdoxsey) -- config: add support for host header rewriting [#1457](https://github.com/pomerium/pomerium/pull/1457) (@calebdoxsey) -- proxy: preserve path and query string for http->https redirect [#1456](https://github.com/pomerium/pomerium/pull/1456) (@calebdoxsey) -- redis: use pubsub instead of keyspace events [#1450](https://github.com/pomerium/pomerium/pull/1450) (@calebdoxsey) -- proxy: add support for /.pomerium/jwt [#1446](https://github.com/pomerium/pomerium/pull/1446) (@calebdoxsey) -- databroker: add support for querying the databroker [#1443](https://github.com/pomerium/pomerium/pull/1443) (@calebdoxsey) -- config: add dns_lookup_family option to customize DNS IP resolution [#1436](https://github.com/pomerium/pomerium/pull/1436) (@calebdoxsey) -- okta: handle deleted groups [#1418](https://github.com/pomerium/pomerium/pull/1418) (@calebdoxsey) -- controlplane: support P-384 / P-512 EC curves [#1409](https://github.com/pomerium/pomerium/pull/1409) (@desimone) -- azure: add support for nested groups [#1408](https://github.com/pomerium/pomerium/pull/1408) (@calebdoxsey) -- authorize: add support for service accounts [#1374](https://github.com/pomerium/pomerium/pull/1374) (@calebdoxsey) -- Cuonglm/improve timeout error message [#1373](https://github.com/pomerium/pomerium/pull/1373) (@cuonglm) -- internal/directory/okta: remove rate limiter [#1370](https://github.com/pomerium/pomerium/pull/1370) (@cuonglm) -- proxy/controlplane: make health checks debug level [#1368](https://github.com/pomerium/pomerium/pull/1368) (@desimone) -- databroker: add tracing for rego evaluation and databroker sync, fix bug in databroker config source [#1367](https://github.com/pomerium/pomerium/pull/1367) (@calebdoxsey) -- authorize: use impersonate email/groups in JWT [#1364](https://github.com/pomerium/pomerium/pull/1364) (@calebdoxsey) -- config: support explicit prefix and regex path rewriting [#1363](https://github.com/pomerium/pomerium/pull/1363) (@calebdoxsey) -- proxy: support websocket timeouts [#1362](https://github.com/pomerium/pomerium/pull/1362) (@calebdoxsey) -- proxy: disable control-plane robots.txt for public unauthenticated routes [#1361](https://github.com/pomerium/pomerium/pull/1361) (@calebdoxsey) -- certmagic: improve logging [#1358](https://github.com/pomerium/pomerium/pull/1358) (@calebdoxsey) -- logs: add new log scrubber [#1346](https://github.com/pomerium/pomerium/pull/1346) (@calebdoxsey) -- Allow setting the shared secret via an environment variable. [#1337](https://github.com/pomerium/pomerium/pull/1337) (@rspier) -- authorize: add jti to JWT payload [#1328](https://github.com/pomerium/pomerium/pull/1328) (@calebdoxsey) -- all: add signout redirect url [#1324](https://github.com/pomerium/pomerium/pull/1324) (@cuonglm) -- proxy: remove unused handlers [#1317](https://github.com/pomerium/pomerium/pull/1317) (@desimone) -- azure: support deriving credentials from client id, client secret and provider url [#1300](https://github.com/pomerium/pomerium/pull/1300) (@calebdoxsey) -- cache: support databroker option changes [#1294](https://github.com/pomerium/pomerium/pull/1294) (@calebdoxsey) -- authenticate: move databroker connection to state [#1292](https://github.com/pomerium/pomerium/pull/1292) (@calebdoxsey) -- authorize: use atomic state for properties [#1290](https://github.com/pomerium/pomerium/pull/1290) (@calebdoxsey) -- proxy: move properties to atomically updated state [#1280](https://github.com/pomerium/pomerium/pull/1280) (@calebdoxsey) -- Improving okta API requests [#1278](https://github.com/pomerium/pomerium/pull/1278) (@cuonglm) -- authenticate: move properties to atomically updated state [#1277](https://github.com/pomerium/pomerium/pull/1277) (@calebdoxsey) -- authenticate: support reloading IDP settings [#1273](https://github.com/pomerium/pomerium/pull/1273) (@calebdoxsey) -- Rate limit for okta [#1271](https://github.com/pomerium/pomerium/pull/1271) (@cuonglm) -- config: allow dynamic configuration of cookie settings [#1267](https://github.com/pomerium/pomerium/pull/1267) (@calebdoxsey) -- internal/directory/okta: increase default batch size to 200 [#1264](https://github.com/pomerium/pomerium/pull/1264) (@cuonglm) -- envoy: add support for hot-reloading bootstrap configuration [#1259](https://github.com/pomerium/pomerium/pull/1259) (@calebdoxsey) -- config: allow reloading of telemetry settings [#1255](https://github.com/pomerium/pomerium/pull/1255) (@calebdoxsey) -- databroker: add support for config settings [#1253](https://github.com/pomerium/pomerium/pull/1253) (@calebdoxsey) -- config: warn if custom scopes set for builtin providers [#1252](https://github.com/pomerium/pomerium/pull/1252) (@cuonglm) -- authorize: add databroker url check [#1228](https://github.com/pomerium/pomerium/pull/1228) (@desimone) -- internal/databroker: make Sync send data in smaller batches [#1226](https://github.com/pomerium/pomerium/pull/1226) (@cuonglm) - -### Fixed - -- fix config race [#1660](https://github.com/pomerium/pomerium/pull/1660) (@calebdoxsey) -- fix ordering of autocert config source [#1640](https://github.com/pomerium/pomerium/pull/1640) (@calebdoxsey) -- pkg/storage/redis: Prevent connection churn [#1603](https://github.com/pomerium/pomerium/pull/1603) (@travisgroth) -- forward-auth: fix special character support for nginx [#1578](https://github.com/pomerium/pomerium/pull/1578) (@desimone) -- proxy/forward_auth: copy response headers as request headers [#1577](https://github.com/pomerium/pomerium/pull/1577) (@desimone) -- fix querying claim data on the dashboard [#1560](https://github.com/pomerium/pomerium/pull/1560) (@calebdoxsey) -- github: fix retrieving team id with graphql API (#1554) [#1555](https://github.com/pomerium/pomerium/pull/1555) (@toshipp) -- store raw id token so it can be passed to the logout url [#1543](https://github.com/pomerium/pomerium/pull/1543) (@calebdoxsey) -- fix databroker requiring signed jwt [#1538](https://github.com/pomerium/pomerium/pull/1538) (@calebdoxsey) -- authorize: add redirect url to debug page [#1533](https://github.com/pomerium/pomerium/pull/1533) (@desimone) -- internal/frontend: resolve authN helper url [#1521](https://github.com/pomerium/pomerium/pull/1521) (@desimone) -- fwd-auth: match nginx-ingress config [#1505](https://github.com/pomerium/pomerium/pull/1505) (@desimone) -- authenticate: protect /.pomerium/admin endpoint [#1500](https://github.com/pomerium/pomerium/pull/1500) (@calebdoxsey) -- ci: ensure systemd unit file is in packages [#1481](https://github.com/pomerium/pomerium/pull/1481) (@travisgroth) -- identity manager: fix directory sync timing [#1455](https://github.com/pomerium/pomerium/pull/1455) (@calebdoxsey) -- proxy/forward_auth: don't reset forward auth path if X-Forwarded-Uri is not set [#1447](https://github.com/pomerium/pomerium/pull/1447) (@whs) -- httputil: remove retry button [#1438](https://github.com/pomerium/pomerium/pull/1438) (@desimone) -- proxy: always use https for application callback [#1433](https://github.com/pomerium/pomerium/pull/1433) (@travisgroth) -- controplane: remove p-521 EC [#1420](https://github.com/pomerium/pomerium/pull/1420) (@desimone) -- redirect-server: add config headers to responses [#1416](https://github.com/pomerium/pomerium/pull/1416) (@calebdoxsey) -- proxy: remove impersonate headers for kubernetes [#1394](https://github.com/pomerium/pomerium/pull/1394) (@calebdoxsey) -- Desimone/authenticate default logout [#1390](https://github.com/pomerium/pomerium/pull/1390) (@desimone) -- proxy: for filter matches only include bare domain name [#1389](https://github.com/pomerium/pomerium/pull/1389) (@calebdoxsey) -- internal/envoy: start epoch from 0 [#1387](https://github.com/pomerium/pomerium/pull/1387) (@travisgroth) -- internal/directory/okta: acceept non-json service account [#1359](https://github.com/pomerium/pomerium/pull/1359) (@cuonglm) -- internal/controlplane: add telemetry http handler [#1353](https://github.com/pomerium/pomerium/pull/1353) (@travisgroth) -- autocert: fix locking issue [#1310](https://github.com/pomerium/pomerium/pull/1310) (@calebdoxsey) -- authorize: log users and groups [#1303](https://github.com/pomerium/pomerium/pull/1303) (@desimone) -- proxy: fix wrong applied middleware [#1298](https://github.com/pomerium/pomerium/pull/1298) (@cuonglm) -- internal/directory/okta: fix wrong API query filter [#1296](https://github.com/pomerium/pomerium/pull/1296) (@cuonglm) -- autocert: fix bootstrapped cache store path [#1283](https://github.com/pomerium/pomerium/pull/1283) (@desimone) -- config: validate databroker settings [#1260](https://github.com/pomerium/pomerium/pull/1260) (@calebdoxsey) -- internal/autocert: re-use cert if renewing failed but cert not expired [#1237](https://github.com/pomerium/pomerium/pull/1237) (@cuonglm) - -### Security - -- chore(deps): update envoy 1.16.1 [#1613](https://github.com/pomerium/pomerium/pull/1613) (@desimone) - -### Documentation - -- move signing key algorithm documentation into yaml file [#1646](https://github.com/pomerium/pomerium/pull/1646) (@calebdoxsey) -- update docs [#1645](https://github.com/pomerium/pomerium/pull/1645) (@desimone) -- docs: update build badge [#1635](https://github.com/pomerium/pomerium/pull/1635) (@travisgroth) -- docs: add cache_service_url upgrade notice [#1621](https://github.com/pomerium/pomerium/pull/1621) (@travisgroth) -- docs: use standard language for lists [#1590](https://github.com/pomerium/pomerium/pull/1590) (@desimone) -- Fix command in Kubernetes Quick start docs [#1582](https://github.com/pomerium/pomerium/pull/1582) (@wesleyw72) -- move docs to settings.yaml [#1579](https://github.com/pomerium/pomerium/pull/1579) (@calebdoxsey) -- docs: add round logo [#1574](https://github.com/pomerium/pomerium/pull/1574) (@desimone) -- add settings.yaml file [#1540](https://github.com/pomerium/pomerium/pull/1540) (@calebdoxsey) -- update the documentation for auth0 to include group/role information [#1502](https://github.com/pomerium/pomerium/pull/1502) (@grounded042) -- examples: fix nginx example [#1478](https://github.com/pomerium/pomerium/pull/1478) (@desimone) -- docs: add architecture diagram for cloudrun [#1444](https://github.com/pomerium/pomerium/pull/1444) (@travisgroth) -- fix(examples): Use X-Pomerium-Claim headers [#1422](https://github.com/pomerium/pomerium/pull/1422) (@tdorsey) -- chore(docs): Fix typo in example policy [#1419](https://github.com/pomerium/pomerium/pull/1419) (@tdorsey) -- docs: fix grammar [#1412](https://github.com/pomerium/pomerium/pull/1412) (@shinebayar-g) -- docs: Add Traefik + Kubernetes example [#1411](https://github.com/pomerium/pomerium/pull/1411) (@travisgroth) -- Remove typo on remove_request_headers docs [#1388](https://github.com/pomerium/pomerium/pull/1388) (@whs) -- docs: update azure docs [#1377](https://github.com/pomerium/pomerium/pull/1377) (@desimone) -- docs: add nginx example [#1329](https://github.com/pomerium/pomerium/pull/1329) (@travisgroth) -- docs: use .com sitemap hostname [#1274](https://github.com/pomerium/pomerium/pull/1274) (@desimone) -- docs: fix in-action video [#1268](https://github.com/pomerium/pomerium/pull/1268) (@travisgroth) -- docs: image, sitemap and redirect fixes [#1263](https://github.com/pomerium/pomerium/pull/1263) (@travisgroth) -- Fix broken logo link in README.md [#1261](https://github.com/pomerium/pomerium/pull/1261) (@cuonglm) -- docs/docs: fix wrong okta service account field [#1251](https://github.com/pomerium/pomerium/pull/1251) (@cuonglm) -- [Backport latest] Docs/enterprise button [#1247](https://github.com/pomerium/pomerium/pull/1247) (@github-actions[bot]) -- Docs/enterprise button [#1245](https://github.com/pomerium/pomerium/pull/1245) (@desimone) -- remove rootDomain from examples [#1244](https://github.com/pomerium/pomerium/pull/1244) (@karelbilek) -- docs: add / redirect [#1241](https://github.com/pomerium/pomerium/pull/1241) (@desimone) -- docs: prepare for enterprise / oss split [#1238](https://github.com/pomerium/pomerium/pull/1238) (@desimone) - -### Dependency - -- chore(deps): update module open-policy-agent/opa to v0.25.1 [#1659](https://github.com/pomerium/pomerium/pull/1659) (@renovate[bot]) -- chore(deps): update module lithammer/shortuuid/v3 to v3.0.5 [#1658](https://github.com/pomerium/pomerium/pull/1658) (@renovate[bot]) -- chore(deps): update module google.golang.org/grpc to v1.34.0 [#1657](https://github.com/pomerium/pomerium/pull/1657) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to 9ee31aa [#1655](https://github.com/pomerium/pomerium/pull/1655) (@renovate[bot]) -- chore(deps): update golang.org/x/oauth2 commit hash to 9317641 [#1654](https://github.com/pomerium/pomerium/pull/1654) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to c7110b5 [#1653](https://github.com/pomerium/pomerium/pull/1653) (@renovate[bot]) -- chore(deps): update golang.org/x/crypto commit hash to be400ae [#1652](https://github.com/pomerium/pomerium/pull/1652) (@renovate[bot]) -- deps: update hashstructure v2 [#1632](https://github.com/pomerium/pomerium/pull/1632) (@desimone) -- chore(deps): update precommit hook pre-commit/pre-commit-hooks to v3 [#1630](https://github.com/pomerium/pomerium/pull/1630) (@renovate[bot]) -- chore(deps): update module yaml to v2.4.0 [#1629](https://github.com/pomerium/pomerium/pull/1629) (@renovate[bot]) -- chore(deps): update module google/go-cmp to v0.5.4 [#1628](https://github.com/pomerium/pomerium/pull/1628) (@renovate[bot]) -- chore(deps): update golang.org/x/crypto commit hash to c8d3bf9 [#1627](https://github.com/pomerium/pomerium/pull/1627) (@renovate[bot]) -- chore(deps): update module google/go-jsonnet to v0.17.0 [#1611](https://github.com/pomerium/pomerium/pull/1611) (@renovate[bot]) -- chore(deps): update codecov/codecov-action action to v1.0.15 [#1610](https://github.com/pomerium/pomerium/pull/1610) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to 9b1e624 [#1609](https://github.com/pomerium/pomerium/pull/1609) (@renovate[bot]) -- chore(deps): update golang.org/x/crypto commit hash to c1f2f97 [#1608](https://github.com/pomerium/pomerium/pull/1608) (@renovate[bot]) -- chore(deps): update module google/go-cmp to v0.5.3 [#1597](https://github.com/pomerium/pomerium/pull/1597) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to ce600e9 [#1596](https://github.com/pomerium/pomerium/pull/1596) (@renovate[bot]) -- chore(deps): update golang.org/x/oauth2 commit hash to 9fd6049 [#1595](https://github.com/pomerium/pomerium/pull/1595) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to 69a7880 [#1594](https://github.com/pomerium/pomerium/pull/1594) (@renovate[bot]) -- chore(deps): update golang.org/x/crypto commit hash to 0c6587e [#1593](https://github.com/pomerium/pomerium/pull/1593) (@renovate[bot]) -- chore(deps): update module google.golang.org/grpc to v1.33.2 [#1585](https://github.com/pomerium/pomerium/pull/1585) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to f9bfe23 [#1583](https://github.com/pomerium/pomerium/pull/1583) (@renovate[bot]) -- chore(deps): update mikefarah/yq action to v3.4.1 [#1567](https://github.com/pomerium/pomerium/pull/1567) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to 24207fd [#1566](https://github.com/pomerium/pomerium/pull/1566) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to ff519b6 [#1565](https://github.com/pomerium/pomerium/pull/1565) (@renovate[bot]) -- chore(deps): update olegtarasov/get-tag action to v2 [#1552](https://github.com/pomerium/pomerium/pull/1552) (@renovate[bot]) -- chore(deps): update goreleaser/goreleaser-action action to v2 [#1551](https://github.com/pomerium/pomerium/pull/1551) (@renovate[bot]) -- chore(deps): update actions/setup-go action to v2 [#1550](https://github.com/pomerium/pomerium/pull/1550) (@renovate[bot]) -- chore(deps): update toolmantim/release-drafter action to v5.12.1 [#1549](https://github.com/pomerium/pomerium/pull/1549) (@renovate[bot]) -- chore(deps): update module google.golang.org/grpc to v1.33.1 [#1548](https://github.com/pomerium/pomerium/pull/1548) (@renovate[bot]) -- chore(deps): update codecov/codecov-action action to v1.0.14 [#1547](https://github.com/pomerium/pomerium/pull/1547) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to 0ff5f38 [#1546](https://github.com/pomerium/pomerium/pull/1546) (@renovate[bot]) -- chore(deps): update golang.org/x/sync commit hash to 67f06af [#1545](https://github.com/pomerium/pomerium/pull/1545) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to be3efd7 [#1544](https://github.com/pomerium/pomerium/pull/1544) (@renovate[bot]) -- chore(deps): update vuepress monorepo to v1.7.1 [#1531](https://github.com/pomerium/pomerium/pull/1531) (@renovate[bot]) -- chore(deps): update module spf13/cobra to v1.1.1 [#1530](https://github.com/pomerium/pomerium/pull/1530) (@renovate[bot]) -- chore(deps): update module prometheus/client_golang to v1.8.0 [#1529](https://github.com/pomerium/pomerium/pull/1529) (@renovate[bot]) -- chore(deps): update module ory/dockertest/v3 to v3.6.2 [#1528](https://github.com/pomerium/pomerium/pull/1528) (@renovate[bot]) -- chore(deps): update module open-policy-agent/opa to v0.24.0 [#1527](https://github.com/pomerium/pomerium/pull/1527) (@renovate[bot]) -- chore(deps): update module golang/protobuf to v1.4.3 [#1525](https://github.com/pomerium/pomerium/pull/1525) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to 32ed001 [#1524](https://github.com/pomerium/pomerium/pull/1524) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to 7b1cca2 [#1523](https://github.com/pomerium/pomerium/pull/1523) (@renovate[bot]) -- chore(deps): update golang.org/x/crypto commit hash to 9e8e0b3 [#1522](https://github.com/pomerium/pomerium/pull/1522) (@renovate[bot]) -- chore(deps): upgrade envoy to v0.16.0 [#1519](https://github.com/pomerium/pomerium/pull/1519) (@desimone) -- deployment: run go mod tidy [#1512](https://github.com/pomerium/pomerium/pull/1512) (@desimone) -- chore(deps): update module ory/dockertest/v3 to v3.6.1 [#1511](https://github.com/pomerium/pomerium/pull/1511) (@renovate[bot]) -- chore(deps): update module go.opencensus.io to v0.22.5 [#1510](https://github.com/pomerium/pomerium/pull/1510) (@renovate[bot]) -- chore(deps): update module cenkalti/backoff/v4 to v4.1.0 [#1509](https://github.com/pomerium/pomerium/pull/1509) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to 4d944d3 [#1508](https://github.com/pomerium/pomerium/pull/1508) (@renovate[bot]) -- chore(deps): update golang.org/x/sync commit hash to b3e1573 [#1507](https://github.com/pomerium/pomerium/pull/1507) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to 4f7140c [#1506](https://github.com/pomerium/pomerium/pull/1506) (@renovate[bot]) -- deployment: pin /x/sys to fix dockertest [#1491](https://github.com/pomerium/pomerium/pull/1491) (@desimone) -- chore(deps): update module openzipkin/zipkin-go to v0.2.5 [#1488](https://github.com/pomerium/pomerium/pull/1488) (@renovate[bot]) -- chore(deps): update module envoyproxy/go-control-plane to v0.9.7 [#1487](https://github.com/pomerium/pomerium/pull/1487) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to bcad7cf [#1486](https://github.com/pomerium/pomerium/pull/1486) (@renovate[bot]) -- chore(deps): update golang.org/x/sync commit hash to 3042136 [#1485](https://github.com/pomerium/pomerium/pull/1485) (@renovate[bot]) -- chore(deps): update golang.org/x/crypto commit hash to 7f63de1 [#1483](https://github.com/pomerium/pomerium/pull/1483) (@renovate[bot]) -- deps: update envoy arm64 to v1.15.1 [#1475](https://github.com/pomerium/pomerium/pull/1475) (@travisgroth) -- chore(deps): envoy 1.15.1 [#1473](https://github.com/pomerium/pomerium/pull/1473) (@desimone) -- chore(deps): update vuepress monorepo to v1.6.0 [#1463](https://github.com/pomerium/pomerium/pull/1463) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to c2d885f [#1462](https://github.com/pomerium/pomerium/pull/1462) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to 5d4f700 [#1461](https://github.com/pomerium/pomerium/pull/1461) (@renovate[bot]) -- deps: go mod tidy [#1434](https://github.com/pomerium/pomerium/pull/1434) (@travisgroth) -- chore(deps): update module rs/zerolog to v1.20.0 [#1431](https://github.com/pomerium/pomerium/pull/1431) (@renovate[bot]) -- chore(deps): update module caddyserver/certmagic to v0.12.0 [#1429](https://github.com/pomerium/pomerium/pull/1429) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to d0d6055 [#1428](https://github.com/pomerium/pomerium/pull/1428) (@renovate[bot]) -- chore(deps): update module openzipkin/zipkin-go to v0.2.4 [#1407](https://github.com/pomerium/pomerium/pull/1407) (@renovate[bot]) -- chore(deps): update module gorilla/handlers to v1.5.1 [#1406](https://github.com/pomerium/pomerium/pull/1406) (@renovate[bot]) -- chore(deps): update module google.golang.org/grpc to v1.32.0 [#1405](https://github.com/pomerium/pomerium/pull/1405) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to 645f7a4 [#1404](https://github.com/pomerium/pomerium/pull/1404) (@renovate[bot]) -- Run go mod tidy [#1384](https://github.com/pomerium/pomerium/pull/1384) (@cuonglm) -- chore(deps): update module go.uber.org/zap to v1.16.0 [#1381](https://github.com/pomerium/pomerium/pull/1381) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to 0bd0a95 [#1380](https://github.com/pomerium/pomerium/pull/1380) (@renovate[bot]) -- chore(deps): update golang.org/x/oauth2 commit hash to 5d25da1 [#1379](https://github.com/pomerium/pomerium/pull/1379) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to 62affa3 [#1378](https://github.com/pomerium/pomerium/pull/1378) (@renovate[bot]) -- deps: ensure renovate runs `go mod tidy` [#1357](https://github.com/pomerium/pomerium/pull/1357) (@travisgroth) -- deps: go mod tidy [#1356](https://github.com/pomerium/pomerium/pull/1356) (@travisgroth) -- Update module open-policy-agent/opa to v0.23.2 [#1351](https://github.com/pomerium/pomerium/pull/1351) (@renovate[bot]) -- Update module google/uuid to v1.1.2 [#1350](https://github.com/pomerium/pomerium/pull/1350) (@renovate[bot]) -- Update module google/go-cmp to v0.5.2 [#1349](https://github.com/pomerium/pomerium/pull/1349) (@renovate[bot]) -- Update module google.golang.org/grpc to v1.31.1 [#1348](https://github.com/pomerium/pomerium/pull/1348) (@renovate[bot]) -- Update google.golang.org/genproto commit hash to 2bf3329 [#1347](https://github.com/pomerium/pomerium/pull/1347) (@renovate[bot]) -- chore(deps): update vuepress monorepo to v1.5.4 [#1323](https://github.com/pomerium/pomerium/pull/1323) (@renovate[bot]) -- chore(deps): update module open-policy-agent/opa to v0.23.1 [#1322](https://github.com/pomerium/pomerium/pull/1322) (@renovate[bot]) -- chore(deps): update module gorilla/mux to v1.8.0 [#1321](https://github.com/pomerium/pomerium/pull/1321) (@renovate[bot]) -- chore(deps): update module gorilla/handlers to v1.5.0 [#1320](https://github.com/pomerium/pomerium/pull/1320) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to c890458 [#1319](https://github.com/pomerium/pomerium/pull/1319) (@renovate[bot]) -- chore(deps): update golang.org/x/crypto commit hash to 5c72a88 [#1318](https://github.com/pomerium/pomerium/pull/1318) (@renovate[bot]) -- Upgrade zipkin-go to v0.2.3 [#1288](https://github.com/pomerium/pomerium/pull/1288) (@cuonglm) -- chore(deps): update google.golang.org/genproto commit hash to f69a880 [#1286](https://github.com/pomerium/pomerium/pull/1286) (@renovate[bot]) -- chore(deps): update golang.org/x/time commit hash to 3af7569 [#1285](https://github.com/pomerium/pomerium/pull/1285) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to 3edf25e [#1284](https://github.com/pomerium/pomerium/pull/1284) (@renovate[bot]) -- .github/workflows: upgrade to go1.15 [#1258](https://github.com/pomerium/pomerium/pull/1258) (@cuonglm) -- Fix tests failed with go115 [#1257](https://github.com/pomerium/pomerium/pull/1257) (@cuonglm) -- chore(deps): update dependency @vuepress/plugin-google-analytics to v1.5.3 [#1236](https://github.com/pomerium/pomerium/pull/1236) (@renovate[bot]) -- Update module google.golang.org/api to v0.30.0 [#1235](https://github.com/pomerium/pomerium/pull/1235) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to a062522 [#1234](https://github.com/pomerium/pomerium/pull/1234) (@renovate[bot]) - -#### Deployment - -- deployment: enable multi-arch release images [#1643](https://github.com/pomerium/pomerium/pull/1643) (@travisgroth) -- ci: add bintray publishing [#1618](https://github.com/pomerium/pomerium/pull/1618) (@travisgroth) -- ci: remove bad quoting in publish steps [#1617](https://github.com/pomerium/pomerium/pull/1617) (@travisgroth) -- ci: update tag parsing step [#1616](https://github.com/pomerium/pomerium/pull/1616) (@travisgroth) -- remove memberlist [#1615](https://github.com/pomerium/pomerium/pull/1615) (@calebdoxsey) -- ci: automatically update test environment with master [#1562](https://github.com/pomerium/pomerium/pull/1562) (@travisgroth) -- deployment: add debug build / container / docs [#1513](https://github.com/pomerium/pomerium/pull/1513) (@travisgroth) -- deployment: Generate deb and rpm packages [#1458](https://github.com/pomerium/pomerium/pull/1458) (@travisgroth) -- deployment: bump release go to v1.15.x [#1439](https://github.com/pomerium/pomerium/pull/1439) (@desimone) -- ci: publish cloudrun latest tag [#1398](https://github.com/pomerium/pomerium/pull/1398) (@travisgroth) -- deployment: fully split release archives and brews [#1365](https://github.com/pomerium/pomerium/pull/1365) (@travisgroth) -- Include pomerium-cli in the docker image by default. Fixes #1343\. [#1345](https://github.com/pomerium/pomerium/pull/1345) (@rspier) -- Use apt-get instead of apt to eliminate warning. [#1344](https://github.com/pomerium/pomerium/pull/1344) (@rspier) -- deployment: add goimports with path awareness [#1316](https://github.com/pomerium/pomerium/pull/1316) (@desimone) - -### Changed - -- identity/oidc/azure: goimports [#1651](https://github.com/pomerium/pomerium/pull/1651) (@travisgroth) -- fix panic when deleting a record twice from the inmemory data store [#1639](https://github.com/pomerium/pomerium/pull/1639) (@calebdoxsey) -- ci: improve release snapshot name template [#1602](https://github.com/pomerium/pomerium/pull/1602) (@travisgroth) -- ci: fix release workflow syntax [#1592](https://github.com/pomerium/pomerium/pull/1592) (@travisgroth) -- ci: update changelog generation to script [#1589](https://github.com/pomerium/pomerium/pull/1589) (@travisgroth) -- [Backport 0-10-0] docs: add round logo [#1575](https://github.com/pomerium/pomerium/pull/1575) (@github-actions[bot]) -- tidy [#1494](https://github.com/pomerium/pomerium/pull/1494) (@desimone) -- dev: add remote container debug configs [#1459](https://github.com/pomerium/pomerium/pull/1459) (@desimone) -- ci: add stale issue automation [#1366](https://github.com/pomerium/pomerium/pull/1366) (@travisgroth) -- internal/urlutil: remove un-used constants [#1326](https://github.com/pomerium/pomerium/pull/1326) (@cuonglm) -- integration: add forward auth test [#1312](https://github.com/pomerium/pomerium/pull/1312) (@cuonglm) -- pkg/storage/redis: update tests to use local certs + upstream image [#1306](https://github.com/pomerium/pomerium/pull/1306) (@travisgroth) -- config: omit empty subpolicies in yaml/json [#1229](https://github.com/pomerium/pomerium/pull/1229) (@travisgroth) -- Cuonglm/increase coverrage 1 [#1227](https://github.com/pomerium/pomerium/pull/1227) (@cuonglm) - -## [v0.11.0-rc2](https://github.com/pomerium/pomerium/tree/v0.11.0-rc2) (2020-11-19) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.11.0-rc1...v0.11.0-rc2) - -### New - -- add paging support to GetAll [#1601](https://github.com/pomerium/pomerium/pull/1601) (@calebdoxsey) -- attach version to gRPC server metadata [#1598](https://github.com/pomerium/pomerium/pull/1598) (@calebdoxsey) - -### Fixed - -- pkg/storage/redis: Prevent connection churn [#1603](https://github.com/pomerium/pomerium/pull/1603) (@travisgroth) - -### Dependency - -- chore(deps): update module google/go-cmp to v0.5.3 [#1597](https://github.com/pomerium/pomerium/pull/1597) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to ce600e9 [#1596](https://github.com/pomerium/pomerium/pull/1596) (@renovate[bot]) -- chore(deps): update golang.org/x/oauth2 commit hash to 9fd6049 [#1595](https://github.com/pomerium/pomerium/pull/1595) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to 69a7880 [#1594](https://github.com/pomerium/pomerium/pull/1594) (@renovate[bot]) -- chore(deps): update golang.org/x/crypto commit hash to 0c6587e [#1593](https://github.com/pomerium/pomerium/pull/1593) (@renovate[bot]) - -### Changed - -- ci: improve release snapshot name template [#1602](https://github.com/pomerium/pomerium/pull/1602) (@travisgroth) - -## [v0.11.0-rc1](https://github.com/pomerium/pomerium/tree/v0.11.0-rc1) (2020-11-13) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.10.6...v0.11.0-rc1) - -### Breaking - -- add flag to enable user impersonation [#1514](https://github.com/pomerium/pomerium/pull/1514) (@calebdoxsey) - -### New - -- use custom default http transport [#1576](https://github.com/pomerium/pomerium/pull/1576) (@calebdoxsey) -- update user info in addition to refreshing the token [#1572](https://github.com/pomerium/pomerium/pull/1572) (@calebdoxsey) -- databroker: add audience to session [#1557](https://github.com/pomerium/pomerium/pull/1557) (@calebdoxsey) -- authorize: implement allowed_idp_claims [#1542](https://github.com/pomerium/pomerium/pull/1542) (@calebdoxsey) -- autocert: support certificate renewal [#1516](https://github.com/pomerium/pomerium/pull/1516) (@calebdoxsey) -- add policy to allow any authenticated user [#1515](https://github.com/pomerium/pomerium/pull/1515) (@pflipp) -- debug: add pprof endpoints [#1504](https://github.com/pomerium/pomerium/pull/1504) (@calebdoxsey) -- databroker: require JWT for access [#1503](https://github.com/pomerium/pomerium/pull/1503) (@calebdoxsey) -- authenticate: remove unused paths, generate cipher at startup, remove qp store [#1495](https://github.com/pomerium/pomerium/pull/1495) (@desimone) -- forward-auth: use envoy's ext_authz check [#1482](https://github.com/pomerium/pomerium/pull/1482) (@desimone) -- auth0: implement directory provider [#1479](https://github.com/pomerium/pomerium/pull/1479) (@grounded042) -- azure: incremental sync [#1471](https://github.com/pomerium/pomerium/pull/1471) (@calebdoxsey) -- auth0: implement identity provider [#1470](https://github.com/pomerium/pomerium/pull/1470) (@calebdoxsey) -- dashboard: format timestamps [#1468](https://github.com/pomerium/pomerium/pull/1468) (@calebdoxsey) -- directory: additional user info [#1467](https://github.com/pomerium/pomerium/pull/1467) (@calebdoxsey) -- directory: add explicit RefreshUser endpoint for faster sync [#1460](https://github.com/pomerium/pomerium/pull/1460) (@calebdoxsey) -- config: add support for host header rewriting [#1457](https://github.com/pomerium/pomerium/pull/1457) (@calebdoxsey) -- proxy: preserve path and query string for http->https redirect [#1456](https://github.com/pomerium/pomerium/pull/1456) (@calebdoxsey) -- redis: use pubsub instead of keyspace events [#1450](https://github.com/pomerium/pomerium/pull/1450) (@calebdoxsey) -- proxy: add support for /.pomerium/jwt [#1446](https://github.com/pomerium/pomerium/pull/1446) (@calebdoxsey) -- databroker: add support for querying the databroker [#1443](https://github.com/pomerium/pomerium/pull/1443) (@calebdoxsey) -- config: add dns_lookup_family option to customize DNS IP resolution [#1436](https://github.com/pomerium/pomerium/pull/1436) (@calebdoxsey) -- okta: handle deleted groups [#1418](https://github.com/pomerium/pomerium/pull/1418) (@calebdoxsey) -- controlplane: support P-384 / P-512 EC curves [#1409](https://github.com/pomerium/pomerium/pull/1409) (@desimone) -- azure: add support for nested groups [#1408](https://github.com/pomerium/pomerium/pull/1408) (@calebdoxsey) -- authorize: add support for service accounts [#1374](https://github.com/pomerium/pomerium/pull/1374) (@calebdoxsey) -- Cuonglm/improve timeout error message [#1373](https://github.com/pomerium/pomerium/pull/1373) (@cuonglm) -- internal/directory/okta: remove rate limiter [#1370](https://github.com/pomerium/pomerium/pull/1370) (@cuonglm) -- proxy/controlplane: make health checks debug level [#1368](https://github.com/pomerium/pomerium/pull/1368) (@desimone) -- databroker: add tracing for rego evaluation and databroker sync, fix bug in databroker config source [#1367](https://github.com/pomerium/pomerium/pull/1367) (@calebdoxsey) -- authorize: use impersonate email/groups in JWT [#1364](https://github.com/pomerium/pomerium/pull/1364) (@calebdoxsey) -- config: support explicit prefix and regex path rewriting [#1363](https://github.com/pomerium/pomerium/pull/1363) (@calebdoxsey) -- proxy: support websocket timeouts [#1362](https://github.com/pomerium/pomerium/pull/1362) (@calebdoxsey) -- proxy: disable control-plane robots.txt for public unauthenticated routes [#1361](https://github.com/pomerium/pomerium/pull/1361) (@calebdoxsey) -- certmagic: improve logging [#1358](https://github.com/pomerium/pomerium/pull/1358) (@calebdoxsey) -- logs: add new log scrubber [#1346](https://github.com/pomerium/pomerium/pull/1346) (@calebdoxsey) -- Allow setting the shared secret via an environment variable. [#1337](https://github.com/pomerium/pomerium/pull/1337) (@rspier) -- authorize: add jti to JWT payload [#1328](https://github.com/pomerium/pomerium/pull/1328) (@calebdoxsey) -- all: add signout redirect url [#1324](https://github.com/pomerium/pomerium/pull/1324) (@cuonglm) -- proxy: remove unused handlers [#1317](https://github.com/pomerium/pomerium/pull/1317) (@desimone) -- azure: support deriving credentials from client id, client secret and provider url [#1300](https://github.com/pomerium/pomerium/pull/1300) (@calebdoxsey) -- cache: support databroker option changes [#1294](https://github.com/pomerium/pomerium/pull/1294) (@calebdoxsey) -- authenticate: move databroker connection to state [#1292](https://github.com/pomerium/pomerium/pull/1292) (@calebdoxsey) -- authorize: use atomic state for properties [#1290](https://github.com/pomerium/pomerium/pull/1290) (@calebdoxsey) -- proxy: move properties to atomically updated state [#1280](https://github.com/pomerium/pomerium/pull/1280) (@calebdoxsey) -- Improving okta API requests [#1278](https://github.com/pomerium/pomerium/pull/1278) (@cuonglm) -- authenticate: move properties to atomically updated state [#1277](https://github.com/pomerium/pomerium/pull/1277) (@calebdoxsey) -- authenticate: support reloading IDP settings [#1273](https://github.com/pomerium/pomerium/pull/1273) (@calebdoxsey) -- Rate limit for okta [#1271](https://github.com/pomerium/pomerium/pull/1271) (@cuonglm) -- config: allow dynamic configuration of cookie settings [#1267](https://github.com/pomerium/pomerium/pull/1267) (@calebdoxsey) -- internal/directory/okta: increase default batch size to 200 [#1264](https://github.com/pomerium/pomerium/pull/1264) (@cuonglm) -- envoy: add support for hot-reloading bootstrap configuration [#1259](https://github.com/pomerium/pomerium/pull/1259) (@calebdoxsey) -- config: allow reloading of telemetry settings [#1255](https://github.com/pomerium/pomerium/pull/1255) (@calebdoxsey) -- databroker: add support for config settings [#1253](https://github.com/pomerium/pomerium/pull/1253) (@calebdoxsey) -- config: warn if custom scopes set for builtin providers [#1252](https://github.com/pomerium/pomerium/pull/1252) (@cuonglm) -- authorize: add databroker url check [#1228](https://github.com/pomerium/pomerium/pull/1228) (@desimone) -- internal/databroker: make Sync send data in smaller batches [#1226](https://github.com/pomerium/pomerium/pull/1226) (@cuonglm) - -### Fixed - -- forward-auth: fix special character support for nginx [#1578](https://github.com/pomerium/pomerium/pull/1578) (@desimone) -- proxy/forward_auth: copy response headers as request headers [#1577](https://github.com/pomerium/pomerium/pull/1577) (@desimone) -- fix querying claim data on the dashboard [#1560](https://github.com/pomerium/pomerium/pull/1560) (@calebdoxsey) -- github: fix retrieving team id with graphql API (#1554) [#1555](https://github.com/pomerium/pomerium/pull/1555) (@toshipp) -- store raw id token so it can be passed to the logout url [#1543](https://github.com/pomerium/pomerium/pull/1543) (@calebdoxsey) -- fix databroker requiring signed jwt [#1538](https://github.com/pomerium/pomerium/pull/1538) (@calebdoxsey) -- authorize: add redirect url to debug page [#1533](https://github.com/pomerium/pomerium/pull/1533) (@desimone) -- internal/frontend: resolve authN helper url [#1521](https://github.com/pomerium/pomerium/pull/1521) (@desimone) -- fwd-auth: match nginx-ingress config [#1505](https://github.com/pomerium/pomerium/pull/1505) (@desimone) -- authenticate: protect /.pomerium/admin endpoint [#1500](https://github.com/pomerium/pomerium/pull/1500) (@calebdoxsey) -- ci: ensure systemd unit file is in packages [#1481](https://github.com/pomerium/pomerium/pull/1481) (@travisgroth) -- identity manager: fix directory sync timing [#1455](https://github.com/pomerium/pomerium/pull/1455) (@calebdoxsey) -- proxy/forward_auth: don't reset forward auth path if X-Forwarded-Uri is not set [#1447](https://github.com/pomerium/pomerium/pull/1447) (@whs) -- httputil: remove retry button [#1438](https://github.com/pomerium/pomerium/pull/1438) (@desimone) -- proxy: always use https for application callback [#1433](https://github.com/pomerium/pomerium/pull/1433) (@travisgroth) -- controplane: remove p-521 EC [#1420](https://github.com/pomerium/pomerium/pull/1420) (@desimone) -- redirect-server: add config headers to responses [#1416](https://github.com/pomerium/pomerium/pull/1416) (@calebdoxsey) -- proxy: remove impersonate headers for kubernetes [#1394](https://github.com/pomerium/pomerium/pull/1394) (@calebdoxsey) -- Desimone/authenticate default logout [#1390](https://github.com/pomerium/pomerium/pull/1390) (@desimone) -- proxy: for filter matches only include bare domain name [#1389](https://github.com/pomerium/pomerium/pull/1389) (@calebdoxsey) -- internal/envoy: start epoch from 0 [#1387](https://github.com/pomerium/pomerium/pull/1387) (@travisgroth) -- internal/directory/okta: acceept non-json service account [#1359](https://github.com/pomerium/pomerium/pull/1359) (@cuonglm) -- internal/controlplane: add telemetry http handler [#1353](https://github.com/pomerium/pomerium/pull/1353) (@travisgroth) -- autocert: fix locking issue [#1310](https://github.com/pomerium/pomerium/pull/1310) (@calebdoxsey) -- authorize: log users and groups [#1303](https://github.com/pomerium/pomerium/pull/1303) (@desimone) -- proxy: fix wrong applied middleware [#1298](https://github.com/pomerium/pomerium/pull/1298) (@cuonglm) -- internal/directory/okta: fix wrong API query filter [#1296](https://github.com/pomerium/pomerium/pull/1296) (@cuonglm) -- autocert: fix bootstrapped cache store path [#1283](https://github.com/pomerium/pomerium/pull/1283) (@desimone) -- config: validate databroker settings [#1260](https://github.com/pomerium/pomerium/pull/1260) (@calebdoxsey) -- internal/autocert: re-use cert if renewing failed but cert not expired [#1237](https://github.com/pomerium/pomerium/pull/1237) (@cuonglm) - -### Documentation - -- docs: use standard language for lists [#1590](https://github.com/pomerium/pomerium/pull/1590) (@desimone) -- Fix command in Kubernetes Quick start docs [#1582](https://github.com/pomerium/pomerium/pull/1582) (@wesleyw72) -- move docs to settings.yaml [#1579](https://github.com/pomerium/pomerium/pull/1579) (@calebdoxsey) -- docs: add round logo [#1574](https://github.com/pomerium/pomerium/pull/1574) (@desimone) -- add settings.yaml file [#1540](https://github.com/pomerium/pomerium/pull/1540) (@calebdoxsey) -- update the documentation for auth0 to include group/role information [#1502](https://github.com/pomerium/pomerium/pull/1502) (@grounded042) -- examples: fix nginx example [#1478](https://github.com/pomerium/pomerium/pull/1478) (@desimone) -- docs: add architecture diagram for cloudrun [#1444](https://github.com/pomerium/pomerium/pull/1444) (@travisgroth) -- fix(examples): Use X-Pomerium-Claim headers [#1422](https://github.com/pomerium/pomerium/pull/1422) (@tdorsey) -- chore(docs): Fix typo in example policy [#1419](https://github.com/pomerium/pomerium/pull/1419) (@tdorsey) -- docs: fix grammar [#1412](https://github.com/pomerium/pomerium/pull/1412) (@shinebayar-g) -- docs: Add Traefik + Kubernetes example [#1411](https://github.com/pomerium/pomerium/pull/1411) (@travisgroth) -- Remove typo on remove_request_headers docs [#1388](https://github.com/pomerium/pomerium/pull/1388) (@whs) -- docs: update azure docs [#1377](https://github.com/pomerium/pomerium/pull/1377) (@desimone) -- docs: add nginx example [#1329](https://github.com/pomerium/pomerium/pull/1329) (@travisgroth) -- docs: use .com sitemap hostname [#1274](https://github.com/pomerium/pomerium/pull/1274) (@desimone) -- docs: fix in-action video [#1268](https://github.com/pomerium/pomerium/pull/1268) (@travisgroth) -- docs: image, sitemap and redirect fixes [#1263](https://github.com/pomerium/pomerium/pull/1263) (@travisgroth) -- Fix broken logo link in README.md [#1261](https://github.com/pomerium/pomerium/pull/1261) (@cuonglm) -- docs/docs: fix wrong okta service account field [#1251](https://github.com/pomerium/pomerium/pull/1251) (@cuonglm) -- [Backport latest] Docs/enterprise button [#1247](https://github.com/pomerium/pomerium/pull/1247) (@github-actions[bot]) -- Docs/enterprise button [#1245](https://github.com/pomerium/pomerium/pull/1245) (@desimone) -- remove rootDomain from examples [#1244](https://github.com/pomerium/pomerium/pull/1244) (@karelbilek) -- docs: add / redirect [#1241](https://github.com/pomerium/pomerium/pull/1241) (@desimone) -- docs: prepare for enterprise / oss split [#1238](https://github.com/pomerium/pomerium/pull/1238) (@desimone) - -### Dependency - -- chore(deps): update module google.golang.org/grpc to v1.33.2 [#1585](https://github.com/pomerium/pomerium/pull/1585) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to f9bfe23 [#1583](https://github.com/pomerium/pomerium/pull/1583) (@renovate[bot]) -- chore(deps): update mikefarah/yq action to v3.4.1 [#1567](https://github.com/pomerium/pomerium/pull/1567) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to 24207fd [#1566](https://github.com/pomerium/pomerium/pull/1566) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to ff519b6 [#1565](https://github.com/pomerium/pomerium/pull/1565) (@renovate[bot]) -- chore(deps): update olegtarasov/get-tag action to v2 [#1552](https://github.com/pomerium/pomerium/pull/1552) (@renovate[bot]) -- chore(deps): update goreleaser/goreleaser-action action to v2 [#1551](https://github.com/pomerium/pomerium/pull/1551) (@renovate[bot]) -- chore(deps): update actions/setup-go action to v2 [#1550](https://github.com/pomerium/pomerium/pull/1550) (@renovate[bot]) -- chore(deps): update toolmantim/release-drafter action to v5.12.1 [#1549](https://github.com/pomerium/pomerium/pull/1549) (@renovate[bot]) -- chore(deps): update module google.golang.org/grpc to v1.33.1 [#1548](https://github.com/pomerium/pomerium/pull/1548) (@renovate[bot]) -- chore(deps): update codecov/codecov-action action to v1.0.14 [#1547](https://github.com/pomerium/pomerium/pull/1547) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to 0ff5f38 [#1546](https://github.com/pomerium/pomerium/pull/1546) (@renovate[bot]) -- chore(deps): update golang.org/x/sync commit hash to 67f06af [#1545](https://github.com/pomerium/pomerium/pull/1545) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to be3efd7 [#1544](https://github.com/pomerium/pomerium/pull/1544) (@renovate[bot]) -- chore(deps): update vuepress monorepo to v1.7.1 [#1531](https://github.com/pomerium/pomerium/pull/1531) (@renovate[bot]) -- chore(deps): update module spf13/cobra to v1.1.1 [#1530](https://github.com/pomerium/pomerium/pull/1530) (@renovate[bot]) -- chore(deps): update module prometheus/client_golang to v1.8.0 [#1529](https://github.com/pomerium/pomerium/pull/1529) (@renovate[bot]) -- chore(deps): update module ory/dockertest/v3 to v3.6.2 [#1528](https://github.com/pomerium/pomerium/pull/1528) (@renovate[bot]) -- chore(deps): update module open-policy-agent/opa to v0.24.0 [#1527](https://github.com/pomerium/pomerium/pull/1527) (@renovate[bot]) -- chore(deps): update module golang/protobuf to v1.4.3 [#1525](https://github.com/pomerium/pomerium/pull/1525) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to 32ed001 [#1524](https://github.com/pomerium/pomerium/pull/1524) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to 7b1cca2 [#1523](https://github.com/pomerium/pomerium/pull/1523) (@renovate[bot]) -- chore(deps): update golang.org/x/crypto commit hash to 9e8e0b3 [#1522](https://github.com/pomerium/pomerium/pull/1522) (@renovate[bot]) -- chore(deps): upgrade envoy to v0.16.0 [#1519](https://github.com/pomerium/pomerium/pull/1519) (@desimone) -- deployment: run go mod tidy [#1512](https://github.com/pomerium/pomerium/pull/1512) (@desimone) -- chore(deps): update module ory/dockertest/v3 to v3.6.1 [#1511](https://github.com/pomerium/pomerium/pull/1511) (@renovate[bot]) -- chore(deps): update module go.opencensus.io to v0.22.5 [#1510](https://github.com/pomerium/pomerium/pull/1510) (@renovate[bot]) -- chore(deps): update module cenkalti/backoff/v4 to v4.1.0 [#1509](https://github.com/pomerium/pomerium/pull/1509) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to 4d944d3 [#1508](https://github.com/pomerium/pomerium/pull/1508) (@renovate[bot]) -- chore(deps): update golang.org/x/sync commit hash to b3e1573 [#1507](https://github.com/pomerium/pomerium/pull/1507) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to 4f7140c [#1506](https://github.com/pomerium/pomerium/pull/1506) (@renovate[bot]) -- deployment: pin /x/sys to fix dockertest [#1491](https://github.com/pomerium/pomerium/pull/1491) (@desimone) -- chore(deps): update module openzipkin/zipkin-go to v0.2.5 [#1488](https://github.com/pomerium/pomerium/pull/1488) (@renovate[bot]) -- chore(deps): update module envoyproxy/go-control-plane to v0.9.7 [#1487](https://github.com/pomerium/pomerium/pull/1487) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to bcad7cf [#1486](https://github.com/pomerium/pomerium/pull/1486) (@renovate[bot]) -- chore(deps): update golang.org/x/sync commit hash to 3042136 [#1485](https://github.com/pomerium/pomerium/pull/1485) (@renovate[bot]) -- chore(deps): update golang.org/x/crypto commit hash to 7f63de1 [#1483](https://github.com/pomerium/pomerium/pull/1483) (@renovate[bot]) -- deps: update envoy arm64 to v1.15.1 [#1475](https://github.com/pomerium/pomerium/pull/1475) (@travisgroth) -- chore(deps): envoy 1.15.1 [#1473](https://github.com/pomerium/pomerium/pull/1473) (@desimone) -- chore(deps): update vuepress monorepo to v1.6.0 [#1463](https://github.com/pomerium/pomerium/pull/1463) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to c2d885f [#1462](https://github.com/pomerium/pomerium/pull/1462) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to 5d4f700 [#1461](https://github.com/pomerium/pomerium/pull/1461) (@renovate[bot]) -- deps: go mod tidy [#1434](https://github.com/pomerium/pomerium/pull/1434) (@travisgroth) -- chore(deps): update module rs/zerolog to v1.20.0 [#1431](https://github.com/pomerium/pomerium/pull/1431) (@renovate[bot]) -- chore(deps): update module caddyserver/certmagic to v0.12.0 [#1429](https://github.com/pomerium/pomerium/pull/1429) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to d0d6055 [#1428](https://github.com/pomerium/pomerium/pull/1428) (@renovate[bot]) -- chore(deps): update module openzipkin/zipkin-go to v0.2.4 [#1407](https://github.com/pomerium/pomerium/pull/1407) (@renovate[bot]) -- chore(deps): update module gorilla/handlers to v1.5.1 [#1406](https://github.com/pomerium/pomerium/pull/1406) (@renovate[bot]) -- chore(deps): update module google.golang.org/grpc to v1.32.0 [#1405](https://github.com/pomerium/pomerium/pull/1405) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to 645f7a4 [#1404](https://github.com/pomerium/pomerium/pull/1404) (@renovate[bot]) -- Run go mod tidy [#1384](https://github.com/pomerium/pomerium/pull/1384) (@cuonglm) -- chore(deps): update module go.uber.org/zap to v1.16.0 [#1381](https://github.com/pomerium/pomerium/pull/1381) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to 0bd0a95 [#1380](https://github.com/pomerium/pomerium/pull/1380) (@renovate[bot]) -- chore(deps): update golang.org/x/oauth2 commit hash to 5d25da1 [#1379](https://github.com/pomerium/pomerium/pull/1379) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to 62affa3 [#1378](https://github.com/pomerium/pomerium/pull/1378) (@renovate[bot]) -- deps: ensure renovate runs `go mod tidy` [#1357](https://github.com/pomerium/pomerium/pull/1357) (@travisgroth) -- deps: go mod tidy [#1356](https://github.com/pomerium/pomerium/pull/1356) (@travisgroth) -- Update module open-policy-agent/opa to v0.23.2 [#1351](https://github.com/pomerium/pomerium/pull/1351) (@renovate[bot]) -- Update module google/uuid to v1.1.2 [#1350](https://github.com/pomerium/pomerium/pull/1350) (@renovate[bot]) -- Update module google/go-cmp to v0.5.2 [#1349](https://github.com/pomerium/pomerium/pull/1349) (@renovate[bot]) -- Update module google.golang.org/grpc to v1.31.1 [#1348](https://github.com/pomerium/pomerium/pull/1348) (@renovate[bot]) -- Update google.golang.org/genproto commit hash to 2bf3329 [#1347](https://github.com/pomerium/pomerium/pull/1347) (@renovate[bot]) -- chore(deps): update vuepress monorepo to v1.5.4 [#1323](https://github.com/pomerium/pomerium/pull/1323) (@renovate[bot]) -- chore(deps): update module open-policy-agent/opa to v0.23.1 [#1322](https://github.com/pomerium/pomerium/pull/1322) (@renovate[bot]) -- chore(deps): update module gorilla/mux to v1.8.0 [#1321](https://github.com/pomerium/pomerium/pull/1321) (@renovate[bot]) -- chore(deps): update module gorilla/handlers to v1.5.0 [#1320](https://github.com/pomerium/pomerium/pull/1320) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to c890458 [#1319](https://github.com/pomerium/pomerium/pull/1319) (@renovate[bot]) -- chore(deps): update golang.org/x/crypto commit hash to 5c72a88 [#1318](https://github.com/pomerium/pomerium/pull/1318) (@renovate[bot]) -- Upgrade zipkin-go to v0.2.3 [#1288](https://github.com/pomerium/pomerium/pull/1288) (@cuonglm) -- chore(deps): update google.golang.org/genproto commit hash to f69a880 [#1286](https://github.com/pomerium/pomerium/pull/1286) (@renovate[bot]) -- chore(deps): update golang.org/x/time commit hash to 3af7569 [#1285](https://github.com/pomerium/pomerium/pull/1285) (@renovate[bot]) -- chore(deps): update golang.org/x/net commit hash to 3edf25e [#1284](https://github.com/pomerium/pomerium/pull/1284) (@renovate[bot]) -- .github/workflows: upgrade to go1.15 [#1258](https://github.com/pomerium/pomerium/pull/1258) (@cuonglm) -- Fix tests failed with go115 [#1257](https://github.com/pomerium/pomerium/pull/1257) (@cuonglm) -- chore(deps): update dependency @vuepress/plugin-google-analytics to v1.5.3 [#1236](https://github.com/pomerium/pomerium/pull/1236) (@renovate[bot]) -- Update module google.golang.org/api to v0.30.0 [#1235](https://github.com/pomerium/pomerium/pull/1235) (@renovate[bot]) -- chore(deps): update google.golang.org/genproto commit hash to a062522 [#1234](https://github.com/pomerium/pomerium/pull/1234) (@renovate[bot]) - -#### Deployment - -- ci: automatically update test environment with master [#1562](https://github.com/pomerium/pomerium/pull/1562) (@travisgroth) -- deployment: add debug build / container / docs [#1513](https://github.com/pomerium/pomerium/pull/1513) (@travisgroth) -- deployment: Generate deb and rpm packages [#1458](https://github.com/pomerium/pomerium/pull/1458) (@travisgroth) -- deployment: bump release go to v1.15.x [#1439](https://github.com/pomerium/pomerium/pull/1439) (@desimone) -- ci: publish cloudrun latest tag [#1398](https://github.com/pomerium/pomerium/pull/1398) (@travisgroth) -- deployment: fully split release archives and brews [#1365](https://github.com/pomerium/pomerium/pull/1365) (@travisgroth) -- Include pomerium-cli in the docker image by default. Fixes #1343\. [#1345](https://github.com/pomerium/pomerium/pull/1345) (@rspier) -- Use apt-get instead of apt to eliminate warning. [#1344](https://github.com/pomerium/pomerium/pull/1344) (@rspier) -- deployment: add goimports with path awareness [#1316](https://github.com/pomerium/pomerium/pull/1316) (@desimone) - -### Changed - -- ci: fix release workflow syntax [#1592](https://github.com/pomerium/pomerium/pull/1592) (@travisgroth) -- ci: update changelog generation to script [#1589](https://github.com/pomerium/pomerium/pull/1589) (@travisgroth) -- [Backport 0-10-0] docs: add round logo [#1575](https://github.com/pomerium/pomerium/pull/1575) (@github-actions[bot]) -- tidy [#1494](https://github.com/pomerium/pomerium/pull/1494) (@desimone) -- dev: add remote container debug configs [#1459](https://github.com/pomerium/pomerium/pull/1459) (@desimone) -- ci: add stale issue automation [#1366](https://github.com/pomerium/pomerium/pull/1366) (@travisgroth) -- internal/urlutil: remove un-used constants [#1326](https://github.com/pomerium/pomerium/pull/1326) (@cuonglm) -- integration: add forward auth test [#1312](https://github.com/pomerium/pomerium/pull/1312) (@cuonglm) -- pkg/storage/redis: update tests to use local certs + upstream image [#1306](https://github.com/pomerium/pomerium/pull/1306) (@travisgroth) -- config: omit empty subpolicies in yaml/json [#1229](https://github.com/pomerium/pomerium/pull/1229) (@travisgroth) -- Cuonglm/increase coverrage 1 [#1227](https://github.com/pomerium/pomerium/pull/1227) (@cuonglm) - -## [v0.10.6](https://github.com/pomerium/pomerium/tree/v0.10.6) (2020-09-30) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.10.5...v0.10.6) - -### Changed - -- docs: Update changelog for v0.10.6 [#1477](https://github.com/pomerium/pomerium/pull/1477) (@travisgroth) -- [Backport 0-10-0] deps: update envoy arm64 to v1.15.1 [#1476](https://github.com/pomerium/pomerium/pull/1476) (@github-actions[bot]) -- [Backport 0-10-0] chore(deps): envoy 1.15.1 [#1474](https://github.com/pomerium/pomerium/pull/1474) (@github-actions[bot]) - -## [v0.10.5](https://github.com/pomerium/pomerium/tree/v0.10.5) (2020-09-28) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.10.4...v0.10.5) - -### Documentation - -- docs: Update changelog for v0.10.5 [#1469](https://github.com/pomerium/pomerium/pull/1469) (@travisgroth) - -### Changed - -- redis: use pubsub instead of keyspace events [#1451](https://github.com/pomerium/pomerium/pull/1451) (@calebdoxsey) - -## [v0.10.4](https://github.com/pomerium/pomerium/tree/v0.10.4) (2020-09-22) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.10.3...v0.10.4) - -### Documentation - -- docs: update 0.10.4 changelog [#1441](https://github.com/pomerium/pomerium/pull/1441) (@travisgroth) -- Add v0.10.4 changelog entry [#1437](https://github.com/pomerium/pomerium/pull/1437) (@travisgroth) - -### Changed - -- [Backport 0-10-0] httputil: remove retry button [#1440](https://github.com/pomerium/pomerium/pull/1440) (@github-actions[bot]) -- [Backport 0-10-0] proxy: always use https for application callback [#1435](https://github.com/pomerium/pomerium/pull/1435) (@github-actions[bot]) -- [Backport 0-10-0] redirect-server: add config headers to responses [#1427](https://github.com/pomerium/pomerium/pull/1427) (@github-actions[bot]) -- [Backport 0-10-0] controplane: remove p-521 EC [#1423](https://github.com/pomerium/pomerium/pull/1423) (@github-actions[bot]) -- [Backport 0-10-0] controlplane: support P-384 / P-512 EC curves [#1410](https://github.com/pomerium/pomerium/pull/1410) (@github-actions[bot]) - -## [v0.10.3](https://github.com/pomerium/pomerium/tree/v0.10.3) (2020-09-11) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.10.2...v0.10.3) - -### Changed - -- Update changelog for v0.10.3 [#1401](https://github.com/pomerium/pomerium/pull/1401) (@travisgroth) -- [Backport 0-10-0] ci: publish cloudrun latest tag [#1399](https://github.com/pomerium/pomerium/pull/1399) (@github-actions[bot]) -- [Backport 0-10-0] proxy: remove impersonate headers for kubernetes [#1396](https://github.com/pomerium/pomerium/pull/1396) (@travisgroth) -- [Backport 0-10-0] docs: update azure docs [#1385](https://github.com/pomerium/pomerium/pull/1385) (@github-actions[bot]) -- internal/directory/okta: remove rate limiter (#1370) [#1371](https://github.com/pomerium/pomerium/pull/1371) (@cuonglm) -- [Backport 0-10-0] internal/directory/okta: acceept non-json service account [#1360](https://github.com/pomerium/pomerium/pull/1360) (@github-actions[bot]) -- [Backport 0-10-0] internal/controlplane: add telemetry http handler [#1355](https://github.com/pomerium/pomerium/pull/1355) (@github-actions[bot]) -- [Backport 0-10-0] docs: add nginx example [#1339](https://github.com/pomerium/pomerium/pull/1339) (@github-actions[bot]) - -## [v0.10.2](https://github.com/pomerium/pomerium/tree/v0.10.2) (2020-08-26) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.10.1...v0.10.2) - -### Documentation - -- docs: update change log for 0.10.2 [#1330](https://github.com/pomerium/pomerium/pull/1330) (@travisgroth) - -### Changed - -- Backport go 1.15 changes for 0-10-0 [#1334](https://github.com/pomerium/pomerium/pull/1334) (@travisgroth) -- [Backport 0-10-0] internal/directory/okta: improve API requests [#1332](https://github.com/pomerium/pomerium/pull/1332) (@travisgroth) -- autocert: fix locking issue (#1310) [#1311](https://github.com/pomerium/pomerium/pull/1311) (@calebdoxsey) - -## [v0.10.1](https://github.com/pomerium/pomerium/tree/v0.10.1) (2020-08-20) - -[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.10.0...v0.10.1) - -### Documentation - -- [Backport 0-10-0] Docs/enterprise button [#1246](https://github.com/pomerium/pomerium/pull/1246) (@github-actions[bot]) -- [Backport 0-10-0] docs: add / redirect [#1242](https://github.com/pomerium/pomerium/pull/1242) (@github-actions[bot]) - -### Changed - -- docs: v0.10.1 changelog [#1308](https://github.com/pomerium/pomerium/pull/1308) (@travisgroth) -- [Backport 0-10-0] pkg/storage/redis: update tests to use local certs + upstream image [#1307](https://github.com/pomerium/pomerium/pull/1307) (@github-actions[bot]) -- azure: support deriving credentials from client id, client secret and... [#1301](https://github.com/pomerium/pomerium/pull/1301) (@calebdoxsey) -- [Backport 0-10-0] autocert: fix bootstrapped cache store path [#1291](https://github.com/pomerium/pomerium/pull/1291) (@github-actions[bot]) -- [Backport 0-10-0] docs: use .com sitemap hostname [#1275](https://github.com/pomerium/pomerium/pull/1275) (@github-actions[bot]) -- [Backport 0-10-0] docs: fix in-action video [#1269](https://github.com/pomerium/pomerium/pull/1269) (@github-actions[bot]) -- [Backport 0-10-0] docs: image, sitemap and redirect fixes [#1265](https://github.com/pomerium/pomerium/pull/1265) (@github-actions[bot]) -- [Backport 0-10-0] docs: prepare for enterprise / oss split [#1239](https://github.com/pomerium/pomerium/pull/1239) (@github-actions[bot]) -- [Backport 0-10-0] authorize: add databroker url check [#1231](https://github.com/pomerium/pomerium/pull/1231) (@github-actions[bot]) -- [Backport 0-10-0] config: omit empty subpolicies in yaml/json [#1230](https://github.com/pomerium/pomerium/pull/1230) (@github-actions[bot]) - -## v0.10.0 - -### Changes - -- Add storage backend interface @cuonglm GH-1072 -- all: update outdated comments about OptionsUpdater interface @cuonglm GH-1207 -- Allow specify go executable in Makefile @cuonglm GH-1008 -- audit: add protobuf definitions @calebdoxsey GH-1047 -- authenticate: hide impersonation form from non-admin users @cuonglm GH-979 -- authenticate: move impersonate from proxy to authenticate @calebdoxsey GH-965 -- authenticate: remove useless/duplicated code block @cuonglm GH-962 -- authenticate: revoke current session oauth token before sign out @cuonglm GH-964 -- authorize,proxy: allow traefik forward auth without uri query @cuonglm GH-1103 -- authorize: add evaluator store @calebdoxsey GH-1105 -- authorize: add test for denied response @cuonglm GH-1197 -- authorize: avoid serializing databroker data map to improve performance @calebdoxsey GH-995 -- authorize: clear session state if session was deleted in databroker @cuonglm GH-1053 -- authorize: derive check response message from reply message @cuonglm GH-1193 -- authorize: include "kid" in JWT header @cuonglm GH-1049 -- authorize: store policy evaluator on success only @cuonglm GH-1206 -- authorize/evaluator: add more test cases @cuonglm GH-1198 -- authorize/evaluator: fix wrong custom policies decision @cuonglm GH-1199 -- authorize/evaluator/opa: use route policy object instead of array index @cuonglm GH-1001 -- cache: add client telemetry @travisgroth GH-975 -- cache: add test for runMemberList @cuonglm GH-1007 -- cache: attempt to join memberlist cluster for sanity check @travisgroth GH-1004 -- cache: fix missing parameter @travisgroth GH-1005 -- cache: only run memberlist for in-memory databroker @travisgroth GH-1224 -- ci: Add cloudrun build @travisgroth GH-1097 -- ci: support rc releases @travisgroth GH-1011 -- cmd/pomerium-cli: do not require terminal with cached creds @travisgroth GH-1196 -- config: add check to assert service account is required for policies with allowed_groups @desimone GH-997 -- config: add support for policies stored in the databroker @calebdoxsey GH-1099 -- config: additional kubernetes token source support @travisgroth GH-1200 -- config: allow setting directory sync interval and timeout @cuonglm GH-1098 -- config: default to google idp credentials for serverless @travisgroth GH-1170 -- config: fix loading storage client cert from wrong location @travisgroth GH-1212 -- config: Set loopback address by ipv4 IP @travisgroth GH-1116 -- cryptutil: move to pkg dir, add token generator @calebdoxsey GH-1029 -- deployment: fix brew creation for pomerium-cli @travisgroth GH-1192 -- directory.Group entry for groups @calebdoxsey GH-1118 -- docs/docs: update upgrading to mention redis storage backend @cuonglm GH-1172 -- envoy: disable idle timeouts to controlplane @travisgroth GH-1000 -- grpc: rename internal/grpc to pkg/grpc @calebdoxsey GH-1010 -- grpc: use relative paths in codegen @desimone GH-1106 -- grpcutil: add functions for JWTs in gRPC metadata @calebdoxsey GH-1165 -- Increasing authorize coverage @cuonglm GH-1221 -- integration: add dummy value for idp_service_account @cuonglm GH-1009 -- internal/controlplane: set envoy prefix rewrite if present @cuonglm GH-1034 -- internal/controlplane: using envoy strip host port matching @cuonglm GH-1126 -- internal/databroker: handle new db error @cuonglm GH-1129 -- internal/databroker: store server version @cuonglm GH-1121 -- internal/directory: improve google user groups list @cuonglm GH-1092 -- internal/directory: use both id and name for group @cuonglm GH-1086 -- internal/directory/google: return both group e-mail and id @travisgroth GH-1083 -- internal/frontend/assets/html: make timestamp human readable @cuonglm GH-1107 -- internal/sessions: handle claims "ver" field generally @cuonglm GH-990 -- internal/urlutil: add tests for GetDomainsForURL @cuonglm GH-1183 -- memberlist: use bufio reader instead of scanner @calebdoxsey GH-1002 -- config: options refactor @calebdoxsey GH-1088 -- pkg: add grpcutil package @calebdoxsey GH-1032 -- pkg/storage: add package docs @cuonglm GH-1078 -- pkg/storage: change backend interface to return error @cuonglm GH-1131 -- pkg/storage: introduce storage.Backend Watch method @cuonglm GH-1135 -- pkg/storage: make Watch returns receive only channel @cuonglm GH-1211 -- pkg/storage/redis: do not use timeout to signal redis conn to stop @cuonglm GH-1155 -- pkg/storage/redis: fix multiple data race @cuonglm GH-1210 -- pkg/storage/redis: metrics updates @travisgroth GH-1195 -- pkg/storage/redis: move last version to redis @cuonglm GH-1134 -- proxy: add support for spdy upgrades @travisgroth GH-1203 -- proxy: avoid second policy validation @travisgroth GH-1204 -- proxy: refactor handler setup code @travisgroth GH-1205 -- set session state expiry @calebdoxsey GH-1215 -- Sleep longer before running integration tests @cuonglm GH-968 -- telemetry: add tracing spans to cache and databroker @travisgroth GH-987 - -### New - -- authenticate: allow hot reloaded admin users config @cuonglm [GH-984] -- authenticate: support hot reloaded config @cuonglm GH-984 -- authorize: custom rego policies @calebdoxsey GH-1123 -- authorize: include "kid" in JWT headers @cuonglm [GH-1046] -- azure: use OID for user id in session @calebdoxsey GH-985 -- config: add pass_identity_headers @cuonglm [GH-903] -- config: add remove_request_headers @cuonglm [GH-822] -- config: both base64 and file reference can be used for "certificates" @dmitrif [GH-1055] -- config: change config key parsing to attempt Base64 decoding first. @dmitrif GH-1055 -- config: change default log level to INFO @cuonglm [GH-902] -- custom rego in databroker @calebdoxsey GH-1124 -- databroker server backend config @cuonglm GH-1127 -- databroker: add encryption for records @calebdoxsey GH-1168 -- deploy: Add homebrew tap publishing @travisgroth GH-1179 -- deployment: cut separate archive for cli @desimone GH-1177 -- directory: add service account struct and parsing method @calebdoxsey GH-971 -- envoy: enable strip host port matching @cuonglm [GH-1126] -- github: implement github directory provider @calebdoxsey GH-963 -- google: store directory information by user id @calebdoxsey GH-988 -- identity: support custom code flow request params @desimone GH-998 -- implement google cloud serverless authentication @calebdoxsey GH-1080 -- internal/directory/okta: store directory information by user id @cuonglm GH-991 -- internal/directory/onelogin: store directory information by user id @cuonglm GH-992 -- kubernetes apiserver integration @calebdoxsey GH-1063 -- pkg/storage/redis: add authentication support @cuonglm GH-1159 -- pkg/storage/redis: add redis TLS support @cuonglm GH-1163 -- pomerium-cli k8s exec-credential @calebdoxsey GH-1073 -- redis storage backend @cuonglm GH-1082 -- telmetry: add databroker storage metrics and tracing @travisgroth GH-1161 -- use custom binary for arm64 linux release @calebdoxsey GH-1065 - -### Fixed - -- authenticate: fix wrong condition checking in VerifySession @cuonglm GH-1146 -- authenticate: fix wrong SignIn telemetry name @cuonglm GH-1038 -- authorize: Force redirect scheme to https @travisgroth GH-1075 -- authorize: strip port from host header if necessary @cuonglm GH-1175 -- authorize/evaluator/opa: set client tls cert usage explicitly @travisgroth GH-1026 -- authorize/evaluator/opa/policy: fix allow rules with impersonate @cuonglm GH-1094 -- cache: fix data race in NotifyJoin @cuonglm GH-1028 -- ci: fix arm docker image releases @travisgroth GH-1178 -- ci: Prevent dirty git state @travisgroth GH-1117 -- ci: release fixes @travisgroth GH-1181 -- config: fix deep copy of config @calebdoxsey GH-1089 -- controlplane: add robots route @desimone GH-966 -- deploy: ensure pomerium-cli is built correctly @travisgroth GH-1180 -- deployment: fix pomerium-cli release @desimone GH-1104 -- envoy: Set ExtAuthz Cluster name to URL Host @travisgroth GH-1132 -- fix databroker restart versioning, handle missing sessions @calebdoxsey GH-1145 -- fix lint errors @travisgroth GH-1171 -- fix redirect loop, remove user/session services, remove duplicate deleted_at fields @calebdoxsey GH-1162 -- handle example.com and example.com:443 @calebdoxsey GH-1153 -- internal/controlplane: enable envoy use remote address @cuonglm GH-1023 -- internal/databroker: fix wrong server version init @cuonglm GH-1125 -- pkg/grpc: fix wrong audit protoc gen file @cuonglm GH-1048 -- pkg/storage/redis: handling connection to redis backend failure @cuonglm GH-1174 -- pomerium-cli: fix kubernetes token caching @calebdoxsey GH-1169 -- pomerium-cli: kubernetes fixes @calebdoxsey GH-1176 -- proxy: do not set X-Pomerium-Jwt-Assertion/X-Pomerium-Claim-\* headers by default @cuonglm [GH-903] -- proxy: fix invalid session after logout in forward auth mode @cuonglm GH-1062 -- proxy: fix redirect url with traefik forward auth @cuonglm GH-1037 -- proxy: fix wrong forward auth request @cuonglm GH-1030 - -### Documentation - -- docs: Update synology.md @roulesse GH-1219 -- docs: add installation section @travisgroth GH-1223 -- docs: add kubectl config commands @travisgroth GH-1152 -- docs: add kubernetes docs @calebdoxsey GH-1087 -- docs: add recipe for TiddlyWiki on Node.js @favadi GH-1143 -- docs: add required in cookie_secret @mig4ng GH-1142 -- docs: add warnings cones around requiring IdP Service Accounts @travisgroth GH-999 -- docs: cloud Run / GCP Serverless @travisgroth GH-1101 -- docs: document preserve_host_header with policy routes to static ip @cuonglm GH-1024 -- docs: fix incorrect example middleware @travisgroth GH-1128 -- docs: fix links, clarify upgrade guide for v0.10 @desimone GH-1220 -- docs: fix minor errors @travisgroth GH-1214 -- docs: Kubernetes topic @travisgroth GH-1222 -- docs: Move examples repo into main repo @travisgroth GH-1102 -- docs: Redis and stateful storage docs @travisgroth GH-1173 -- docs: refactor sections, consolidate examples @desimone GH-1164 -- docs: rename docs/reference to docs/conceptststststststststs @desimone GH-1182 -- docs: service account instructions for azure @calebdoxsey GH-969 -- docs: service account instructions for gitlab @calebdoxsey GH-970 -- docs: update architecture diagrams + descriptions @travisgroth GH-1218 -- docs: update GitHub documentation for service account @calebdoxsey GH-967 -- docs: Update Istio VirtualService example @jeffhubLR GH-1006 -- docs: update okta service account docs to match new format @calebdoxsey GH-972 -- Docs: Update README stating specific requirements for SIGNING_KEY @bradjones1 GH-1217 -- docs: update reference docs @desimone GH-1208 -- docs: update service account instructions for OneLogin @calebdoxsey GH-973 -- docs: update upgrading document for breaking changes @calebdoxsey GH-974 -- docs/.vuepress: fix missing local-oidc recipes section @cuonglm GH-1147 -- docs/configuration: add doc for trailing slash limitation in "To" field @cuonglm GH-1040 -- docs/docs: add changelog for #1055 @cuonglm GH-1084 -- docs/identity-providers: document gitlab default scopes changed @cuonglm GH-980 -- docs/recipes: add local oidc example @cuonglm GH-1045 - -### Dependency - -- chore(deps): bump envoy to 1.15.0 @desimone GH-1119 -- chore(deps): google.golang.org/genproto commit hash to da3ae01 @renovate GH-1138 -- chore(deps): module google/go-cmp to v0.5.1 @renovate GH-1139 -- chore(deps): update envoy to 1.14.4 @desimone GH-1076 -- chore(deps): update github.com/skratchdot/open-golang commit hash to eef8423 @renovate GH-1108 -- chore(deps): update golang.org/x/crypto commit hash to 123391f @renovate GH-1184 -- chore(deps): update golang.org/x/crypto commit hash to 948cd5f @renovate GH-1056 -- chore(deps): update golang.org/x/net commit hash to 4c52546 @renovate GH-1017 -- chore(deps): update golang.org/x/net commit hash to ab34263 @renovate GH-1057 -- chore(deps): update golang.org/x/sync commit hash to 6e8e738 @renovate GH-1018 -- chore(deps): update google.golang.org/genproto commit hash to 11fb19a @renovate GH-1109 -- chore(deps): update google.golang.org/genproto commit hash to 8145dea @renovate GH-1185 -- chore(deps): update google.golang.org/genproto commit hash to 8698661 @renovate GH-1058 -- chore(deps): update google.golang.org/genproto commit hash to 8e8330b @renovate GH-1039 -- chore(deps): update google.golang.org/genproto commit hash to ee7919e @renovate GH-1019 -- chore(deps): update google.golang.org/genproto commit hash to fbb79ea @renovate GH-945 -- chore(deps): update module cenkalti/backoff/v4 to v4.0.2 @renovate GH-946 -- chore(deps): update module contrib.go.opencensus.io/exporter/jaeger to v0.2.1 @renovate GH-1186 -- chore(deps): update module contrib.go.opencensus.io/exporter/zipkin to v0.1.2 @renovate GH-1187 -- chore(deps): update module envoyproxy/go-control-plane to v0.9.6 @renovate GH-1059 -- chore(deps): update module go.opencensus.io to v0.22.4 @renovate GH-948 -- chore(deps): update module golang/mock to v1.4.4 @renovate GH-1188 -- chore(deps): update module google.golang.org/api to v0.28.0 @renovate GH-949 -- chore(deps): update module google.golang.org/api to v0.29.0 @renovate GH-1060 -- chore(deps): update module google.golang.org/grpc to v1.30.0 @renovate GH-1020 -- chore(deps): update module google.golang.org/grpc to v1.31.0 @renovate GH-1189 -- chore(deps): update module google.golang.org/protobuf to v1.25.0 @renovate GH-1021 -- chore(deps): update module google/go-cmp to v0.5.0 @renovate GH-950 -- chore(deps): update module hashicorp/memberlist to v0.2.2 @renovate GH-951 -- chore(deps): update module open-policy-agent/opa to v0.21.0 @renovate GH-952 -- chore(deps): update module open-policy-agent/opa to v0.21.1 @renovate GH-1061 -- chore(deps): update module open-policy-agent/opa to v0.22.0 @renovate GH-1110 -- chore(deps): update module prometheus/client_golang to v1.7.0 @renovate GH-953 -- chore(deps): update module prometheus/client_golang to v1.7.1 @renovate GH-1022 -- chore(deps): update module spf13/cobra to v1 @renovate GH-1111 -- chore(deps): update module spf13/viper to v1.7.1 @renovate GH-1190 -- chore(deps):s bump opa v0.21.0 @desimone GH-993 - -## v0.9.1 - -### Security - -- envoy: fixes CVE-2020-11080 by rejecting HTTP/2 SETTINGS frames with too many parameters - -## v0.9.0 - -### New - -- proxy: envoy is now used to handle proxying -- authenticate: add jwks and .well-known endpoint @desimone [GH-745] -- authorize: add client mTLS support @calebdoxsey [GH-751] - -### Fixed - -- cache: fix closing too early @calebdoxsey [GH-791] -- authenticate: fix insecure gRPC connection string default port @calebdoxsey [GH-795] -- authenticate: fix user-info call for AWS cognito @calebdoxsey [GH-792] -- authenticate: clear session if ctx fails @desimone [GH-806] -- telemetry: fix autocache labels @travisgroth [GH-805] -- telemetry: fix missing/incorrect grpc labels @travisgroth [GH-804] -- authorize: fix authorization panic caused by logging a nil reference @desimone [GH-704] - -### Changes - -- authenticate: remove authorize url validate check @calebdoxsey [GH-790] -- authorize: reduce log noise for empty jwt @calebdoxsey [GH-793] -- authorize: refactor and add additional unit tests @calebdoxsey [GH-757] -- envoy: add GRPC stats handler to control plane service @travisgroth [GH-744] -- envoy: enable zipkin tracing @travisgroth [GH-737] -- envoy: improvements to logging @calebdoxsey [GH-742] -- envoy: remove 'accept-encoding' header from proxied metric requests @travisgroth [GH-750] -- envoy: support ports in hosts for routing @calebdoxsey [GH-748] -- forward-auth: support x-forwarded-uri @calebdoxsey [GH-780] -- proxy/forward-auth: block expired request prior to 302 @desimone [GH-773] -- sessions/state: add nickname claim @BenoitKnecht [GH-755] -- state: infer user (`user`) from subject (`sub`) @desimone [GH-772] -- telemetry: refactor GRPC Server Handler @travisgroth [GH-756] -- telemetry: service label updates @travisgroth [GH-802] -- xds: add catch-all for pomerium routes @calebdoxsey [GH-789] -- xds: disable cluster validation to handle out-of-order updates @calebdoxsey [GH-783] - -### Documentation - -- docs: add mTLS recipe @calebdoxsey [GH-807] -- docs: add argo recipe @calebdoxsey [GH-803] -- docs: update dockerfiles for v0.9.0 @calebdoxsey [GH-801] -- docs: typo on configuration doc @kintoandar [GH-800] -- docs: docs regarding claim headers @strideynet [GH-782] -- docs: update traefik example and add note about forwarded headers @calebdoxsey [GH-784] -- docs: add note about unsupported platforms @calebdoxsey [GH-799] -- docs: expose config parameters in sidebar @travisgroth [GH-797] -- docs: update examples @travisgroth [GH-796] - -## v0.8.3 - -### Changes - -- state: infer user (`user`) from subject (`sub`) @desimone GH-772 -- proxy/forward-auth: block expired request prior to 302 @desimone GH-773 - -## v0.8.2 - -### Security - -This release includes a fix for a bug that, under certain circumstances, could allow a user with a valid but expired session to resend a request to an upstream application. The repeated request would not return a response, but could reach the upstream application. Thank you to @selaux for reporting this issue! [GH-762] - -## v0.8.1 - -### Fixed - -- authorize: fix authorization panic caused by logging a nil reference @desimone [GH-704] - -## v0.8.0 - -To see a complete list of changes [see the diff](https://github.com/pomerium/pomerium/compare/v0.7.0...v0.8.0). - -### New - -- cryptutil: add automatic certificate management @desimone [GH-644] -- implement path-based route matching @calebdoxsey [GH-615] -- internal/identity: implement github provider support @Lumexralph [GH-582] -- proxy: add configurable JWT claim headers @travisgroth (#596) -- proxy: remove extra session unmarshalling @desimone (#592) - -### Changes - -- ci: Switch integration tests from minikube to kind @travisgroth [GH-656] -- integration-tests: add CORS test @calebdoxsey [GH-662] -- integration-tests: add websocket enabled/disabled test @calebdoxsey [GH-661] -- integration-tests: set_request_headers and preserve_host_header options @calebdoxsey [GH-668] -- pre-commit: add pre-commit configuration @calebdoxsey [GH-666] -- proxy: improve JWT header behavior @travisgroth [GH-642] - -### Fixed - -- authorize: fix authorization check for allowed_domains to only match current route @calebdoxsey [GH-624] -- authorize: fix unexpected panic on reload @travisgroth [GH-652] -- site: fix site on mobile @desimone [GH-597] - -### Documentation - -- deploy: autocert documentation and defaults @travisgroth [GH-658] - -## v0.7.5 - -### Fixed - -- authorize: fix authorization check for allowed_domains to only match current route @calebdoxsey [GH-624] - -## v0.7.4 - -### Fixed - -- pomerium-cli: fix service account cli @desimone [GH-613] - -## v0.7.3 - -### Fixed - -- Upgrade gRPC to 1.27.1 @travisgroth [GH-609] - -## v0.7.2 - -### Changes - -- proxy: remove extra session unmarshalling @desimone [GH-592] -- proxy: add configurable JWT claim headers @travisgroth [GH-596] -- grpcutil: remove unused pkg @desimone [GH-593] - -### Fixed - -- site: fix site on mobile @desimone [GH-597] - -### Documentation - -- site: fix site on mobile @desimone [GH-597] - -### Dependency - -- chore(deps): update vuepress monorepo to v1.4.0 @renovate [GH-559] - -## v0.7.1 - -There were no changes in the v0.7.1 release, but we updated the build process slightly. - -## v0.7.0 - -### New - -- \*: remove import path comments @desimone [GH-545] -- authenticate: make callback path configurable @desimone [GH-493] -- authenticate: return 401 for some specific error codes @cuonglm [GH-561] -- authorization: log audience claim failure @desimone [GH-553] -- authorize: use jwt instead of state struct @desimone [GH-514] -- authorize: use opa for policy engine @desimone [GH-474] -- cmd: add cli to generate service accounts @desimone [GH-552] -- config: Expose and set default GRPC Server Keepalive Parameters @travisgroth [GH-509] -- config: Make IDP_PROVIDER env var mandatory @mihaitodor [GH-536] -- config: Remove superfluous Options.Checksum type conversions @travisgroth [GH-522] -- gitlab/identity: change group unique identifier to ID @Lumexralph [GH-571] -- identity: support oidc UserInfo Response @desimone [GH-529] -- internal/cryptutil: standardize leeway to 5 mins @desimone [GH-476] -- metrics: Add storage metrics @travisgroth [GH-554] - -### Fixed - -- cache: add option validations @desimone [GH-468] -- config: Add proper yaml tag to Options.Policies @travisgroth [GH-475] -- ensure correct service name on GRPC related metrics @travisgroth [GH-510] -- fix group impersonation @desimone [GH-569] -- fix sign-out bug , fixes #530 @desimone [GH-544] -- proxy: move set request headers before handle allow public access @ohdarling [GH-479] -- use service port for session audiences @travisgroth [GH-562] - -### Documentation - -- fix `the` typo @ilgooz [GH-566] -- fix kubernetes dashboard recipe docs @desimone [GH-504] -- make from source quickstart @desimone [GH-519] -- update background @desimone [GH-505] -- update helm for v3 @desimone [GH-469] -- various fixes @desimone [GH-478] -- fix cookie_domain @nitper [GH-472] - -### Dependency - -- chore(deps): update github.com/pomerium/autocache commit hash to 6c66ed5 @renovate [GH-480] -- chore(deps): update github.com/pomerium/autocache commit hash to 227c993 @renovate [GH-537] -- chore(deps): update golang.org/x/crypto commit hash to 0ec3e99 @renovate [GH-574] -- chore(deps): update golang.org/x/crypto commit hash to 1b76d66 @renovate [GH-538] -- chore(deps): update golang.org/x/crypto commit hash to 78000ba @renovate [GH-481] -- chore(deps): update golang.org/x/crypto commit hash to 891825f @renovate [GH-556] -- chore(deps): update module fatih/color to v1.9.0 @renovate [GH-575] -- chore(deps): update module fsnotify/fsnotify to v1.4.9 @renovate [GH-539] -- chore(deps): update module go.etcd.io/bbolt to v1.3.4 @renovate [GH-557] -- chore(deps): update module go.opencensus.io to v0.22.3 @renovate [GH-483] -- chore(deps): update module golang/mock to v1.4.0 @renovate [GH-470] -- chore(deps): update module golang/mock to v1.4.3 @renovate [GH-540] -- chore(deps): update module golang/protobuf to v1.3.4 @renovate [GH-485] -- chore(deps): update module golang/protobuf to v1.3.5 @renovate [GH-541] -- chore(deps): update module google.golang.org/api to v0.20.0 @renovate [GH-495] -- chore(deps): update module google.golang.org/grpc to v1.27.1 @renovate [GH-496] -- chore(deps): update module gorilla/mux to v1.7.4 @renovate [GH-506] -- chore(deps): update module open-policy-agent/opa to v0.17.1 @renovate [GH-497] -- chore(deps): update module open-policy-agent/opa to v0.17.3 @renovate [GH-513] -- chore(deps): update module open-policy-agent/opa to v0.18.0 @renovate [GH-558] -- chore(deps): update module prometheus/client_golang to v1.4.1 @renovate [GH-498] -- chore(deps): update module prometheus/client_golang to v1.5.0 @renovate [GH-531] -- chore(deps): update module prometheus/client_golang to v1.5.1 @renovate [GH-543] -- chore(deps): update module rakyll/statik to v0.1.7 @renovate [GH-517] -- chore(deps): update module rs/zerolog to v1.18.0 @renovate [GH-507] -- chore(deps): update module yaml to v2.2.8 @renovate [GH-471] -- ci: Consolidate matrix build parameters @travisgroth [GH-521] -- dependency: use go mod redis @desimone [GH-528] -- deployment: throw away golanglint-ci defaults @desimone [GH-439] -- deployment: throw away golanglint-ci defaults @desimone [GH-439] -- deps: enable automerge and set labels on renovate PRs @travisgroth [GH-527] -- Roll back grpc to v1.25.1 @travisgroth [GH-484] - -## v0.6.0 - -### New - -- authenticate: support backend refresh @desimone [GH-438] -- cache: add cache service @desimone [GH-457] - -### Changed - -- authorize: consolidate gRPC packages @desimone [GH-443] -- config: added yaml tags to all options struct fields @travisgroth [GH-394],[gh-397] -- config: improved config validation for `shared_secret` @travisgroth [GH-427] -- config: Remove CookieRefresh [GH-428] @u5surf [GH-436] -- config: validate that `shared_key` does not contain whitespace @travisgroth [GH-427] -- httputil : wrap handlers for additional context @desimone [GH-413] -- forward-auth: validate using forwarded uri header @branchmispredictor [GH-600] - -### Fixed - -- proxy: fix unauthorized redirect loop for forward auth @desimone [GH-448] -- proxy: fixed regression preventing policy reload [GH-396](https://github.com/pomerium/pomerium/pull/396) - -### Documentation - -- add cookie settings @danderson [GH-429] -- fix typo in forward auth nginx example @travisgroth [GH-445] -- improved sentence flow and other stuff @Rio [GH-422] -- rename fwdauth to be forwardauth @desimone [GH-447] - -### Dependency - -- chore(deps): update golang.org/x/crypto commit hash to 61a8779 @renovate [GH-452] -- chore(deps): update golang.org/x/crypto commit hash to 530e935 @renovate [GH-458] -- chore(deps): update golang.org/x/crypto commit hash to 53104e6 @renovate [GH-431] -- chore(deps): update golang.org/x/crypto commit hash to e9b2fee @renovate [GH-414] -- chore(deps): update golang.org/x/oauth2 commit hash to 858c2ad @renovate [GH-415] -- chore(deps): update golang.org/x/oauth2 commit hash to bf48bf1 @renovate [GH-453] -- chore(deps): update module google.golang.org/grpc to v1.26.0 @renovate [GH-433] -- chore(deps): update module google/go-cmp to v0.4.0 @renovate [GH-454] -- chore(deps): update module spf13/viper to v1.6.1 @renovate [GH-423] -- chore(deps): update module spf13/viper to v1.6.2 @renovate [GH-459] -- chore(deps): update module square/go-jose to v2.4.1 @renovate [GH-435] - -## v0.5.0 - -### New - -- Session state is now route-scoped. Each managed route uses a transparent, signed JSON Web Token (JWT) to assert identity. -- Managed routes no longer need to be under the same subdomain! Access can be delegated to any route, on any domain. -- Programmatic access now also uses JWT tokens. Access tokens are now generated via a standard oauth2 token flow, and credentials can be refreshed for as long as is permitted by the underlying identity provider. -- User dashboard now pulls in additional user context fields (where supported) like the profile picture, first and last name, and so on. - -### Security - -- Some identity providers (Okta, Onelogin, and Azure) previously used mutable signifiers to set and assert group membership. Group membership for all providers now use globally unique and immutable identifiers when available. - -### Changed - -- Azure AD identity provider now uses globally unique and immutable `ID` for [group membership](https://docs.microsoft.com/en-us/graph/api/group-get?view=graph-rest-1.0&tabs=http). -- Okta no longer uses tokens to retrieve group membership. Group membership is now fetched using Okta's HTTP API. [Group membership](https://developer.okta.com/docs/reference/api/groups/) is now determined by the globally unique and immutable `ID` field. -- Okta now requires an additional set of credentials to be used to query for group membership set as a service account. -- URLs are no longer validated to be on the same domain-tree as the authenticate service. Managed routes can live on any domain. -- OneLogin no longer uses tokens to retrieve group membership. Group membership is now fetched using OneLogin's HTTP API. [Group membership](https://developers.onelogin.com/openid-connect/api/user-info/) is now determined by the globally unique and immutable `ID` field. - -### Removed - -- Force refresh has been removed from the dashboard. -- Previous programmatic authentication endpoints (`/api/v1/token`) has been removed and is no longer supported. - -### Fixed - -- Fixed an issue where cookie sessions would not clear on error.[GH-376] - -## v0.4.2 - -### Security - -- Fixes vulnerabilities fixed in [1.13.2](https://groups.google.com/forum/#!topic/golang-announce/lVEm7llp0w0) including CVE-2019-17596. - -## v0.4.1 - -### Fixed - -- Fixed an issue where requests handled by forward-auth would not be redirected back to the underlying route after successful authentication and authorization. [GH-363] -- Fixed an issue where requests handled by forward-auth would add an extraneous query-param following sign-in causing issues in some configurations. [GH-366] - -## v0.4.0 - -### New - -- Allow setting request headers on a per route basis in policy. [GH-308] -- Support "forward-auth" integration with third-party ingresses and proxies. [nginx](https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-subrequest-authentication/), [nginx-ingress](https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth/), and [Traefik](https://docs.traefik.io/middlewares/forwardauth/) are currently supported. [GH-324] -- Add insecure transport / TLS termination support. [GH-328] -- Add setting to override a route's TLS Server Name. [GH-297] -- Pomerium's session can now be passed as a [bearer-auth header](https://tools.ietf.org/html/rfc6750) or [query string](https://en.wikipedia.org/wiki/Query_string) in addition to as a session cookie. -- Add host to the main request logger middleware. [GH-308] -- Add AWS cognito identity provider settings. [GH-314] - -### Security - -- The user's original intended location before completing the authentication process is now encrypted and kept confidential from the identity provider. [GH-316] -- Under certain circumstances, where debug logging was enabled, pomerium's shared secret could be leaked to http access logs as a query param. [GH-338] - -### Fixed - -- Fixed an issue where CSRF would fail if multiple tabs were open. [GH-306] -- Fixed an issue where pomerium would clean double slashes from paths. [GH-262] -- Fixed a bug where the impersonate form would persist an empty string for groups value if none set. [GH-303] -- Fixed HTTP redirect server which was not redirecting the correct hostname. - -### Changed - -- The healthcheck endpoints (`/ping`) now returns the http status `405` StatusMethodNotAllowed for non-`GET` requests. -- Authenticate service no longer uses gRPC. -- The global request logger now captures the full array of proxies from `X-Forwarded-For`, in addition to just the client IP. -- Options code refactored to eliminate global Viper state. [GH-332] -- Pomerium will no longer default to looking for certificates in the root directory. [GH-328] -- Pomerium will validate that either `insecure_server`, or a valid certificate bundle is set. [GH-328] - -### Removed - -- Removed `AUTHENTICATE_INTERNAL_URL`/`authenticate_internal_url` which is no longer used. - -## v0.3.1 - -### Security - -- Fixes vulnerabilities fixed in [Go 1.13.1](https://groups.google.com/forum/m/#!msg/golang-announce/cszieYyuL9Q/g4Z7pKaqAgAJ) including CVE-2019-16276. - -## v0.3.0 - -### New - -- GRPC Improvements. [GH-261] / [GH-69] - - - Enable WaitForReady to allow background retries through transient failures - - Expose a configurable timeout for backend requests to Authorize and Authenticate - - Enable DNS round_robin load balancing to Authorize and Authenticate services by default - -- Add ability to set client certificates for downstream connections. [GH-259] - -### Fixed - -- Fixed non-`amd64` based docker images.[GH-284] -- Fixed an issue where stripped cookie headers would result in a cookie full of semi-colons (`Cookie: ;;;`). [GH-285] -- HTTP status codes now better adhere to [RFC7235](https://tools.ietf.org/html/rfc7235). In particular, authentication failures reply with [401 Unauthorized](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/401) while authorization failures reply with [403 Forbidden](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403). [GH-272] - -### Changed - -- Pomerium will now strip `_csrf` cookies in addition to session cookies. [GH-285] -- Disabled gRPC service config. [GH-280] -- A policy's custom certificate authority can set as a file or a base64 encoded blob(`tls_custom_ca`/`tls_custom_ca_file`). [GH-259] - -- Remove references to [service named ports](https://golang.org/src/net/lookup.go) and instead use their numeric equivalent. [GH-266] - -## v0.2.1 - -### Security - -- Fixes vulnerabilities fixed in [Go 1.12.8](https://groups.google.com/forum/#!topic/golang-nuts/fCQWxqxP8aA) including CVE-2019-9512, CVE-2019-9514 and CVE-2019-14809. - -## v0.2.0 - -### New - -### Telemetry [GH-35] - -- **Tracing** [GH-230] aka distributed tracing, provides insight into the full lifecycles, aka traces, of requests to the system, allowing you to pinpoint failures and performance issues. - - - Add [Jaeger](https://opencensus.io/exporters/supported-exporters/go/jaeger/) support. [GH-230] - -- **Metrics** provide quantitative information about processes running inside the system, including counters, gauges, and histograms. - - - Add informational metrics. [GH-227] - - GRPC Metrics Implementation. [GH-218] - - - Additional GRPC server metrics and request sizes - - Improved GRPC metrics implementation internals - - The GRPC method label is now 'grpc_method' and GRPC status is now `grpc_client_status` and `grpc_server_status` - - - HTTP Metrics Implementation. [GH-220] - - - Support HTTP request sizes on client and server side of proxy - - Improved HTTP metrics implementation internals - - The HTTP method label is now `http_method`, and HTTP status label is now `http_status` - -### Changed - -- GRPC version upgraded to v1.22 [GH-219] -- Add support for large cookie sessions by chunking. [GH-211] -- Prefer [curve](https://wiki.mozilla.org/Security/Server_Side_TLS) X25519 to P256 for TLS connections. [GH-233] -- Pomerium and its services will gracefully shutdown on [interrupt signal](http://man7.org/linux/man-pages/man7/signal.7.html). [GH-230] -- [Google](https://developers.google.com/identity/protocols/OpenIDConnect) now prompts the user to select a user account (by adding `select_account` to the sign in url). This allows a user who has multiple accounts at the authorization server to select amongst the multiple accounts that they may have current sessions for. - -### Fixed - -- Fixed potential race condition when signing requests. [GH-240] -- Fixed panic when reloading configuration in single service mode [GH-247] - -## v0.1.0 - -### New - -- Add programmatic authentication support. [GH-177] -- Add Prometheus format metrics endpoint. [GH-35] -- Add policy setting to enable self-signed certificate support. [GH-179] -- Add policy setting to skip tls certificate verification. [GH-179] - -### CHANGED - -- Policy `to` and `from` settings must be set to valid HTTP URLs including [schemes](https://en.wikipedia.org/wiki/Uniform_Resource_Identifier) and hostnames (e.g. `http.corp.domain.example` should now be `https://http.corp.domain.example`). -- Proxy's sign out handler `{}/.pomerium/sign_out` now accepts an optional `redirect_uri` parameter which can be used to specify a custom redirect page, so long as it is under the same top-level domain. [GH-183] -- Policy configuration can now be empty at startup. [GH-190] -- Websocket support is now set per-route instead of globally. [GH-204] -- Golint removed from amd64 container. [GH-215] -- Pomerium will error if a session cookie is over 4096 bytes, instead of failing silently. [GH-212] - -### Fixed - -- Fixed HEADERS environment variable parsing. [GH-188] -- Fixed Azure group lookups. [GH-190] -- If a session is too large (over 4096 bytes) Pomerium will no longer fail silently. [GH-211] -- Internal URLs like dashboard now start auth process to login a user if no session is found. [GH-205]. -- When set,`CookieDomain` lets a user set the scope of the user session. CSRF cookies will still always be scoped at the individual route level. [GH-181] - -## v0.0.5 - -### New - -- Add ability to detect changes and reload policy configuration files. [GH-150] -- Add user dashboard containing information about the current user's session. [GH-123] -- Add functionality allowing users to initiate manual refresh of their session. This is helpful when a user's access control details are updated but their session hasn't updated yet. To prevent abuse, manual refresh is gated by a cooldown (`REFRESH_COOLDOWN`) which defaults to five minutes. [GH-73] -- Add Administrator (super user) account support (`ADMINISTRATORS`). [GH-110] -- Add feature that allows Administrators to impersonate / sign-in as another user from the user dashboard. [GH-110] -- Add docker images and builds for ARM. [GH-95] -- Add support for public, unauthenticated routes. [GH-129] - -### CHANGED - -- Add Request ID to error pages. [GH-144] -- Refactor configuration handling to use spf13/viper bringing a variety of additional supported storage formats.[GH-115] -- Changed config `AUTHENTICATE_INTERNAL_URL` to be a URL containing both a valid hostname and schema. [GH-153] -- User state is now maintained and scoped at the domain level vs at the route level. [GH-128] -- Error pages contain a link to sign out from the current user session. [GH-100] -- Removed `LifetimeDeadline` from `sessions.SessionState`. -- Removed favicon specific request handling. [GH-131] -- Headers are now configurable via the `HEADERS` configuration variable. [GH-108] -- Refactored proxy and authenticate services to share the same session state cookie. [GH-131] -- Removed instances of extraneous session state saves. [GH-131] -- Changed default behavior when no session is found. Users are now redirected to login instead of being shown an error page.[GH-131] -- Updated routes such that all http handlers are now wrapped with a standard set of middleware. Headers, request id, loggers, and health checks middleware are now applied to all routes including 4xx and 5xx responses. [GH-116] -- Changed docker images to be built from [distroless](https://github.com/GoogleContainerTools/distroless). This fixed an issue with `nsswitch` [GH-97], includes `ca-certificates` and limits the attack surface area of our images. [GH-101] -- Changed HTTP to HTTPS redirect server to be user configurable via `HTTP_REDIRECT_ADDR`. [GH-103] -- `Content-Security-Policy` hash updated to match new UI assets. - -### Fixed - -- Fixed websocket support. [GH-151] -- Fixed an issue where policy and routes were being pre-processed incorrectly. [GH-132] -- Fixed an issue where `golint` was not being found in our docker image. [GH-121] - -## v0.0.4 - -### CHANGED - -- HTTP [Strict Transport Security](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security) is included by default and set to one year. [GH-92] -- HTTP now redirects to HTTPS. [GH-92] -- Removed extraneous `AUTHORIZE_INTERNAL_URL` config option since authorization has no public http handlers, only a gRPC service endpoint. [GH-93] -- Removed `PROXY_ROOT_DOMAIN` config option which is now inferred from `AUTHENTICATE_SERVICE_URL`. Only callback requests originating from a URL on the same sub-domain are permitted. [GH-83] -- Removed `REDIRECT_URL` config option which is now inferred from `AUTHENTICATE_SERVICE_URL` (e.g. `https://$AUTHENTICATE_SERVICE_URL/oauth2/callback`). [GH-83] - -### Fixed - -- Fixed a bug in the Google provider implementation where the `refresh_token`. Updated the google implementation to use the new `prompt=consent` oauth2 parameters. Reported and fixed by @chemhack [GH-81] - -### DOCUMENTATION - -- Added [synology tutorial]. [GH-96] -- Added [certificates documentation]. [GH-79] - -## v0.0.3 - -### FEATURES - -- **Authorization** : The authorization module adds support for per-route access policy. In this release we support the most common forms of identity based access policy: `allowed_users`, `allowed_groups`, and `allowed_domains`. In future versions, the authorization module will also support context and device based authorization policy and decisions. See website documentation for more details. -- **Group Support** : The authenticate service now retrieves a user's group membership information during authentication and refresh. This change may require additional identity provider configuration; all of which are described in the [updated docs](https://www.pomerium.com/docs/identity-providers.html). A brief summary of the requirements for each IdP are as follows: - - - Google requires the [Admin SDK](https://developers.google.com/admin-sdk/directory/) to enabled, a service account with properly delegated access, and `IDP_SERVICE_ACCOUNT` to be set to the base64 encoded value of the service account's key file. - - Okta requires a `groups` claim to be added to both the `id_token` and `access_token`. No additional API calls are made. - - Microsoft Azure Active Directory requires the application be given an [additional API permission](https://docs.microsoft.com/en-us/graph/api/user-list-memberof?view=graph-rest-1.0), `Directory.Read.All`. - - Onelogin requires the [groups](https://developers.onelogin.com/openid-connect/scopes) was supplied during authentication and that groups parameter has been mapped. Group membership is validated on refresh with the [user-info api endpoint](https://developers.onelogin.com/openid-connect/api/user-info). - -- **WebSocket Support** : With [Go 1.12](https://golang.org/doc/go1.12#net/http/httputil) pomerium automatically proxies WebSocket requests. - -### CHANGED - -- Added `LOG_LEVEL` config setting that allows for setting the desired minimum log level for an event to be logged. [GH-74] -- Changed `POMERIUM_DEBUG` config setting to just do console-pretty printing. No longer sets log level. [GH-74] -- Updated `generate_wildcard_cert.sh` to generate a elliptic curve 256 cert by default. -- Updated `env.example` to include a `POLICY` setting example. -- Added `IDP_SERVICE_ACCOUNT` to `env.example` . -- Removed `ALLOWED_DOMAINS` settings which has been replaced by `POLICY`. Authorization is now handled by the authorization service and is defined in the policy configuration files. -- Removed `ROUTES` settings which has been replaced by `POLICY`. -- Add refresh endpoint `${url}/.pomerium/refresh` which forces a token refresh and responds with the json result. -- Group membership added to proxy headers (`x-pomerium-authenticated-user-groups`) and (`x-pomerium-jwt-assertion`). -- Default Cookie lifetime (`COOKIE_EXPIRE`) changed from 7 days to 14 hours ~ roughly one business day. -- Moved identity (`authenticate/providers`) into its own internal identity package as third party identity providers are going to authorization details (group membership, user role, etc) in addition to just authentication attributes. -- Removed circuit breaker package. Calls that were previously wrapped with a circuit breaker fall under gRPC timeouts; which are gated by relatively short timeouts. -- Session expiration times are truncated at the second. -- **Removed gitlab provider**. We can't support groups until [this gitlab bug](https://gitlab.com/gitlab-org/gitlab-ce/issues/44435#note_88150387) is fixed. -- Request context is now maintained throughout request-flow via the [context package](https://golang.org/pkg/context/) enabling timeouts, request tracing, and cancellation. - -### Fixed - -- `http.Server` and `httputil.NewSingleHostReverseProxy` now uses pomerium's logging package instead of the standard library's built in one. [GH-58] - -[certificates documentation]: /docs/guides/certificates -[gh-1]: https://github.com/pomerium/pomerium/issues/1 -[gh-10]: https://github.com/pomerium/pomerium/issues/10 -[gh-100]: https://github.com/pomerium/pomerium/issues/100 -[gh-101]: https://github.com/pomerium/pomerium/issues/101 -[gh-102]: https://github.com/pomerium/pomerium/issues/102 -[gh-103]: https://github.com/pomerium/pomerium/issues/103 -[gh-104]: https://github.com/pomerium/pomerium/issues/104 -[gh-105]: https://github.com/pomerium/pomerium/issues/105 -[gh-106]: https://github.com/pomerium/pomerium/issues/106 -[gh-107]: https://github.com/pomerium/pomerium/issues/107 -[gh-108]: https://github.com/pomerium/pomerium/issues/108 -[gh-109]: https://github.com/pomerium/pomerium/issues/109 -[gh-11]: https://github.com/pomerium/pomerium/issues/11 -[gh-110]: https://github.com/pomerium/pomerium/issues/110 -[gh-111]: https://github.com/pomerium/pomerium/issues/111 -[gh-112]: https://github.com/pomerium/pomerium/issues/112 -[gh-113]: https://github.com/pomerium/pomerium/issues/113 -[gh-114]: https://github.com/pomerium/pomerium/issues/114 -[gh-115]: https://github.com/pomerium/pomerium/issues/115 -[gh-116]: https://github.com/pomerium/pomerium/issues/116 -[gh-117]: https://github.com/pomerium/pomerium/issues/117 -[gh-118]: https://github.com/pomerium/pomerium/issues/118 -[gh-119]: https://github.com/pomerium/pomerium/issues/119 -[gh-12]: https://github.com/pomerium/pomerium/issues/12 -[gh-120]: https://github.com/pomerium/pomerium/issues/120 -[gh-121]: https://github.com/pomerium/pomerium/issues/121 -[gh-122]: https://github.com/pomerium/pomerium/issues/122 -[gh-123]: https://github.com/pomerium/pomerium/issues/123 -[gh-124]: https://github.com/pomerium/pomerium/issues/124 -[gh-125]: https://github.com/pomerium/pomerium/issues/125 -[gh-126]: https://github.com/pomerium/pomerium/issues/126 -[gh-127]: https://github.com/pomerium/pomerium/issues/127 -[gh-128]: https://github.com/pomerium/pomerium/issues/128 -[gh-129]: https://github.com/pomerium/pomerium/issues/129 -[gh-13]: https://github.com/pomerium/pomerium/issues/13 -[gh-130]: https://github.com/pomerium/pomerium/issues/130 -[gh-131]: https://github.com/pomerium/pomerium/issues/131 -[gh-132]: https://github.com/pomerium/pomerium/issues/132 -[gh-133]: https://github.com/pomerium/pomerium/issues/133 -[gh-134]: https://github.com/pomerium/pomerium/issues/134 -[gh-135]: https://github.com/pomerium/pomerium/issues/135 -[gh-136]: https://github.com/pomerium/pomerium/issues/136 -[gh-137]: https://github.com/pomerium/pomerium/issues/137 -[gh-138]: https://github.com/pomerium/pomerium/issues/138 -[gh-139]: https://github.com/pomerium/pomerium/issues/139 -[gh-14]: https://github.com/pomerium/pomerium/issues/14 -[gh-140]: https://github.com/pomerium/pomerium/issues/140 -[gh-141]: https://github.com/pomerium/pomerium/issues/141 -[gh-142]: https://github.com/pomerium/pomerium/issues/142 -[gh-143]: https://github.com/pomerium/pomerium/issues/143 -[gh-144]: https://github.com/pomerium/pomerium/issues/144 -[gh-145]: https://github.com/pomerium/pomerium/issues/145 -[gh-146]: https://github.com/pomerium/pomerium/issues/146 -[gh-147]: https://github.com/pomerium/pomerium/issues/147 -[gh-148]: https://github.com/pomerium/pomerium/issues/148 -[gh-149]: https://github.com/pomerium/pomerium/issues/149 -[gh-15]: https://github.com/pomerium/pomerium/issues/15 -[gh-150]: https://github.com/pomerium/pomerium/issues/150 -[gh-151]: https://github.com/pomerium/pomerium/issues/151 -[gh-152]: https://github.com/pomerium/pomerium/issues/152 -[gh-153]: https://github.com/pomerium/pomerium/issues/153 -[gh-154]: https://github.com/pomerium/pomerium/issues/154 -[gh-155]: https://github.com/pomerium/pomerium/issues/155 -[gh-156]: https://github.com/pomerium/pomerium/issues/156 -[gh-157]: https://github.com/pomerium/pomerium/issues/157 -[gh-158]: https://github.com/pomerium/pomerium/issues/158 -[gh-159]: https://github.com/pomerium/pomerium/issues/159 -[gh-16]: https://github.com/pomerium/pomerium/issues/16 -[gh-160]: https://github.com/pomerium/pomerium/issues/160 -[gh-161]: https://github.com/pomerium/pomerium/issues/161 -[gh-162]: https://github.com/pomerium/pomerium/issues/162 -[gh-163]: https://github.com/pomerium/pomerium/issues/163 -[gh-164]: https://github.com/pomerium/pomerium/issues/164 -[gh-165]: https://github.com/pomerium/pomerium/issues/165 -[gh-166]: https://github.com/pomerium/pomerium/issues/166 -[gh-167]: https://github.com/pomerium/pomerium/issues/167 -[gh-168]: https://github.com/pomerium/pomerium/issues/168 -[gh-169]: https://github.com/pomerium/pomerium/issues/169 -[gh-17]: https://github.com/pomerium/pomerium/issues/17 -[gh-170]: https://github.com/pomerium/pomerium/issues/170 -[gh-171]: https://github.com/pomerium/pomerium/issues/171 -[gh-172]: https://github.com/pomerium/pomerium/issues/172 -[gh-173]: https://github.com/pomerium/pomerium/issues/173 -[gh-174]: https://github.com/pomerium/pomerium/issues/174 -[gh-175]: https://github.com/pomerium/pomerium/issues/175 -[gh-176]: https://github.com/pomerium/pomerium/issues/176 -[gh-177]: https://github.com/pomerium/pomerium/issues/177 -[gh-178]: https://github.com/pomerium/pomerium/issues/178 -[gh-179]: https://github.com/pomerium/pomerium/issues/179 -[gh-18]: https://github.com/pomerium/pomerium/issues/18 -[gh-180]: https://github.com/pomerium/pomerium/issues/180 -[gh-181]: https://github.com/pomerium/pomerium/issues/181 -[gh-182]: https://github.com/pomerium/pomerium/issues/182 -[gh-183]: https://github.com/pomerium/pomerium/issues/183 -[gh-184]: https://github.com/pomerium/pomerium/issues/184 -[gh-185]: https://github.com/pomerium/pomerium/issues/185 -[gh-186]: https://github.com/pomerium/pomerium/issues/186 -[gh-187]: https://github.com/pomerium/pomerium/issues/187 -[gh-188]: https://github.com/pomerium/pomerium/issues/188 -[gh-189]: https://github.com/pomerium/pomerium/issues/189 -[gh-19]: https://github.com/pomerium/pomerium/issues/19 -[gh-190]: https://github.com/pomerium/pomerium/issues/190 -[gh-191]: https://github.com/pomerium/pomerium/issues/191 -[gh-192]: https://github.com/pomerium/pomerium/issues/192 -[gh-193]: https://github.com/pomerium/pomerium/issues/193 -[gh-194]: https://github.com/pomerium/pomerium/issues/194 -[gh-195]: https://github.com/pomerium/pomerium/issues/195 -[gh-196]: https://github.com/pomerium/pomerium/issues/196 -[gh-197]: https://github.com/pomerium/pomerium/issues/197 -[gh-198]: https://github.com/pomerium/pomerium/issues/198 -[gh-199]: https://github.com/pomerium/pomerium/issues/199 -[gh-2]: https://github.com/pomerium/pomerium/issues/2 -[gh-20]: https://github.com/pomerium/pomerium/issues/20 -[gh-200]: https://github.com/pomerium/pomerium/issues/200 -[gh-201]: https://github.com/pomerium/pomerium/issues/201 -[gh-202]: https://github.com/pomerium/pomerium/issues/202 -[gh-203]: https://github.com/pomerium/pomerium/issues/203 -[gh-204]: https://github.com/pomerium/pomerium/issues/204 -[gh-205]: https://github.com/pomerium/pomerium/issues/205 -[gh-206]: https://github.com/pomerium/pomerium/issues/206 -[gh-207]: https://github.com/pomerium/pomerium/issues/207 -[gh-208]: https://github.com/pomerium/pomerium/issues/208 -[gh-209]: https://github.com/pomerium/pomerium/issues/209 -[gh-21]: https://github.com/pomerium/pomerium/issues/21 -[gh-210]: https://github.com/pomerium/pomerium/issues/210 -[gh-211]: https://github.com/pomerium/pomerium/issues/211 -[gh-212]: https://github.com/pomerium/pomerium/issues/212 -[gh-213]: https://github.com/pomerium/pomerium/issues/213 -[gh-214]: https://github.com/pomerium/pomerium/issues/214 -[gh-215]: https://github.com/pomerium/pomerium/issues/215 -[gh-216]: https://github.com/pomerium/pomerium/issues/216 -[gh-217]: https://github.com/pomerium/pomerium/issues/217 -[gh-218]: https://github.com/pomerium/pomerium/issues/218 -[gh-219]: https://github.com/pomerium/pomerium/issues/219 -[gh-22]: https://github.com/pomerium/pomerium/issues/22 -[gh-220]: https://github.com/pomerium/pomerium/issues/220 -[gh-221]: https://github.com/pomerium/pomerium/issues/221 -[gh-222]: https://github.com/pomerium/pomerium/issues/222 -[gh-223]: https://github.com/pomerium/pomerium/issues/223 -[gh-224]: https://github.com/pomerium/pomerium/issues/224 -[gh-225]: https://github.com/pomerium/pomerium/issues/225 -[gh-226]: https://github.com/pomerium/pomerium/issues/226 -[gh-227]: https://github.com/pomerium/pomerium/issues/227 -[gh-228]: https://github.com/pomerium/pomerium/issues/228 -[gh-229]: https://github.com/pomerium/pomerium/issues/229 -[gh-23]: https://github.com/pomerium/pomerium/issues/23 -[gh-230]: https://github.com/pomerium/pomerium/issues/230 -[gh-231]: https://github.com/pomerium/pomerium/issues/231 -[gh-232]: https://github.com/pomerium/pomerium/issues/232 -[gh-233]: https://github.com/pomerium/pomerium/issues/233 -[gh-234]: https://github.com/pomerium/pomerium/issues/234 -[gh-235]: https://github.com/pomerium/pomerium/issues/235 -[gh-236]: https://github.com/pomerium/pomerium/issues/236 -[gh-237]: https://github.com/pomerium/pomerium/issues/237 -[gh-238]: https://github.com/pomerium/pomerium/issues/238 -[gh-239]: https://github.com/pomerium/pomerium/issues/239 -[gh-24]: https://github.com/pomerium/pomerium/issues/24 -[gh-240]: https://github.com/pomerium/pomerium/issues/240 -[gh-241]: https://github.com/pomerium/pomerium/issues/241 -[gh-242]: https://github.com/pomerium/pomerium/issues/242 -[gh-243]: https://github.com/pomerium/pomerium/issues/243 -[gh-244]: https://github.com/pomerium/pomerium/issues/244 -[gh-245]: https://github.com/pomerium/pomerium/issues/245 -[gh-246]: https://github.com/pomerium/pomerium/issues/246 -[gh-247]: https://github.com/pomerium/pomerium/issues/247 -[gh-248]: https://github.com/pomerium/pomerium/issues/248 -[gh-249]: https://github.com/pomerium/pomerium/issues/249 -[gh-25]: https://github.com/pomerium/pomerium/issues/25 -[gh-250]: https://github.com/pomerium/pomerium/issues/250 -[gh-251]: https://github.com/pomerium/pomerium/issues/251 -[gh-252]: https://github.com/pomerium/pomerium/issues/252 -[gh-253]: https://github.com/pomerium/pomerium/issues/253 -[gh-254]: https://github.com/pomerium/pomerium/issues/254 -[gh-255]: https://github.com/pomerium/pomerium/issues/255 -[gh-256]: https://github.com/pomerium/pomerium/issues/256 -[gh-257]: https://github.com/pomerium/pomerium/issues/257 -[gh-258]: https://github.com/pomerium/pomerium/issues/258 -[gh-259]: https://github.com/pomerium/pomerium/issues/259 -[gh-26]: https://github.com/pomerium/pomerium/issues/26 -[gh-260]: https://github.com/pomerium/pomerium/issues/260 -[gh-261]: https://github.com/pomerium/pomerium/issues/261 -[gh-262]: https://github.com/pomerium/pomerium/issues/262 -[gh-263]: https://github.com/pomerium/pomerium/issues/263 -[gh-264]: https://github.com/pomerium/pomerium/issues/264 -[gh-265]: https://github.com/pomerium/pomerium/issues/265 -[gh-266]: https://github.com/pomerium/pomerium/issues/266 -[gh-267]: https://github.com/pomerium/pomerium/issues/267 -[gh-268]: https://github.com/pomerium/pomerium/issues/268 -[gh-269]: https://github.com/pomerium/pomerium/issues/269 -[gh-27]: https://github.com/pomerium/pomerium/issues/27 -[gh-270]: https://github.com/pomerium/pomerium/issues/270 -[gh-271]: https://github.com/pomerium/pomerium/issues/271 -[gh-272]: https://github.com/pomerium/pomerium/issues/272 -[gh-273]: https://github.com/pomerium/pomerium/issues/273 -[gh-274]: https://github.com/pomerium/pomerium/issues/274 -[gh-275]: https://github.com/pomerium/pomerium/issues/275 -[gh-276]: https://github.com/pomerium/pomerium/issues/276 -[gh-277]: https://github.com/pomerium/pomerium/issues/277 -[gh-278]: https://github.com/pomerium/pomerium/issues/278 -[gh-279]: https://github.com/pomerium/pomerium/issues/279 -[gh-28]: https://github.com/pomerium/pomerium/issues/28 -[gh-280]: https://github.com/pomerium/pomerium/issues/280 -[gh-281]: https://github.com/pomerium/pomerium/issues/281 -[gh-282]: https://github.com/pomerium/pomerium/issues/282 -[gh-283]: https://github.com/pomerium/pomerium/issues/283 -[gh-284]: https://github.com/pomerium/pomerium/issues/284 -[gh-285]: https://github.com/pomerium/pomerium/issues/285 -[gh-286]: https://github.com/pomerium/pomerium/issues/286 -[gh-287]: https://github.com/pomerium/pomerium/issues/287 -[gh-288]: https://github.com/pomerium/pomerium/issues/288 -[gh-289]: https://github.com/pomerium/pomerium/issues/289 -[gh-29]: https://github.com/pomerium/pomerium/issues/29 -[gh-290]: https://github.com/pomerium/pomerium/issues/290 -[gh-291]: https://github.com/pomerium/pomerium/issues/291 -[gh-292]: https://github.com/pomerium/pomerium/issues/292 -[gh-293]: https://github.com/pomerium/pomerium/issues/293 -[gh-294]: https://github.com/pomerium/pomerium/issues/294 -[gh-295]: https://github.com/pomerium/pomerium/issues/295 -[gh-296]: https://github.com/pomerium/pomerium/issues/296 -[gh-297]: https://github.com/pomerium/pomerium/issues/297 -[gh-298]: https://github.com/pomerium/pomerium/issues/298 -[gh-299]: https://github.com/pomerium/pomerium/issues/299 -[gh-3]: https://github.com/pomerium/pomerium/issues/3 -[gh-30]: https://github.com/pomerium/pomerium/issues/30 -[gh-300]: https://github.com/pomerium/pomerium/issues/300 -[gh-301]: https://github.com/pomerium/pomerium/issues/301 -[gh-302]: https://github.com/pomerium/pomerium/issues/302 -[gh-303]: https://github.com/pomerium/pomerium/issues/303 -[gh-304]: https://github.com/pomerium/pomerium/issues/304 -[gh-305]: https://github.com/pomerium/pomerium/issues/305 -[gh-306]: https://github.com/pomerium/pomerium/issues/306 -[gh-307]: https://github.com/pomerium/pomerium/issues/307 -[gh-308]: https://github.com/pomerium/pomerium/issues/308 -[gh-309]: https://github.com/pomerium/pomerium/issues/309 -[gh-31]: https://github.com/pomerium/pomerium/issues/31 -[gh-310]: https://github.com/pomerium/pomerium/issues/310 -[gh-311]: https://github.com/pomerium/pomerium/issues/311 -[gh-312]: https://github.com/pomerium/pomerium/issues/312 -[gh-313]: https://github.com/pomerium/pomerium/issues/313 -[gh-314]: https://github.com/pomerium/pomerium/issues/314 -[gh-315]: https://github.com/pomerium/pomerium/issues/315 -[gh-316]: https://github.com/pomerium/pomerium/issues/316 -[gh-317]: https://github.com/pomerium/pomerium/issues/317 -[gh-318]: https://github.com/pomerium/pomerium/issues/318 -[gh-319]: https://github.com/pomerium/pomerium/issues/319 -[gh-32]: https://github.com/pomerium/pomerium/issues/32 -[gh-320]: https://github.com/pomerium/pomerium/issues/320 -[gh-321]: https://github.com/pomerium/pomerium/issues/321 -[gh-322]: https://github.com/pomerium/pomerium/issues/322 -[gh-323]: https://github.com/pomerium/pomerium/issues/323 -[gh-324]: https://github.com/pomerium/pomerium/issues/324 -[gh-325]: https://github.com/pomerium/pomerium/issues/325 -[gh-326]: https://github.com/pomerium/pomerium/issues/326 -[gh-327]: https://github.com/pomerium/pomerium/issues/327 -[gh-328]: https://github.com/pomerium/pomerium/issues/328 -[gh-329]: https://github.com/pomerium/pomerium/issues/329 -[gh-33]: https://github.com/pomerium/pomerium/issues/33 -[gh-330]: https://github.com/pomerium/pomerium/issues/330 -[gh-331]: https://github.com/pomerium/pomerium/issues/331 -[gh-332]: https://github.com/pomerium/pomerium/issues/332 -[gh-333]: https://github.com/pomerium/pomerium/issues/333 -[gh-334]: https://github.com/pomerium/pomerium/issues/334 -[gh-335]: https://github.com/pomerium/pomerium/issues/335 -[gh-336]: https://github.com/pomerium/pomerium/issues/336 -[gh-337]: https://github.com/pomerium/pomerium/issues/337 -[gh-338]: https://github.com/pomerium/pomerium/issues/338 -[gh-339]: https://github.com/pomerium/pomerium/issues/339 -[gh-34]: https://github.com/pomerium/pomerium/issues/34 -[gh-340]: https://github.com/pomerium/pomerium/issues/340 -[gh-341]: https://github.com/pomerium/pomerium/issues/341 -[gh-342]: https://github.com/pomerium/pomerium/issues/342 -[gh-343]: https://github.com/pomerium/pomerium/issues/343 -[gh-344]: https://github.com/pomerium/pomerium/issues/344 -[gh-345]: https://github.com/pomerium/pomerium/issues/345 -[gh-346]: https://github.com/pomerium/pomerium/issues/346 -[gh-347]: https://github.com/pomerium/pomerium/issues/347 -[gh-348]: https://github.com/pomerium/pomerium/issues/348 -[gh-349]: https://github.com/pomerium/pomerium/issues/349 -[gh-35]: https://github.com/pomerium/pomerium/issues/35 -[gh-350]: https://github.com/pomerium/pomerium/issues/350 -[gh-351]: https://github.com/pomerium/pomerium/issues/351 -[gh-352]: https://github.com/pomerium/pomerium/issues/352 -[gh-353]: https://github.com/pomerium/pomerium/issues/353 -[gh-354]: https://github.com/pomerium/pomerium/issues/354 -[gh-355]: https://github.com/pomerium/pomerium/issues/355 -[gh-356]: https://github.com/pomerium/pomerium/issues/356 -[gh-357]: https://github.com/pomerium/pomerium/issues/357 -[gh-358]: https://github.com/pomerium/pomerium/issues/358 -[gh-359]: https://github.com/pomerium/pomerium/issues/359 -[gh-36]: https://github.com/pomerium/pomerium/issues/36 -[gh-360]: https://github.com/pomerium/pomerium/issues/360 -[gh-361]: https://github.com/pomerium/pomerium/issues/361 -[gh-362]: https://github.com/pomerium/pomerium/issues/362 -[gh-363]: https://github.com/pomerium/pomerium/issues/363 -[gh-364]: https://github.com/pomerium/pomerium/issues/364 -[gh-365]: https://github.com/pomerium/pomerium/issues/365 -[gh-366]: https://github.com/pomerium/pomerium/issues/366 -[gh-367]: https://github.com/pomerium/pomerium/issues/367 -[gh-368]: https://github.com/pomerium/pomerium/issues/368 -[gh-369]: https://github.com/pomerium/pomerium/issues/369 -[gh-37]: https://github.com/pomerium/pomerium/issues/37 -[gh-370]: https://github.com/pomerium/pomerium/issues/370 -[gh-371]: https://github.com/pomerium/pomerium/issues/371 -[gh-372]: https://github.com/pomerium/pomerium/issues/372 -[gh-373]: https://github.com/pomerium/pomerium/issues/373 -[gh-374]: https://github.com/pomerium/pomerium/issues/374 -[gh-375]: https://github.com/pomerium/pomerium/issues/375 -[gh-376]: https://github.com/pomerium/pomerium/issues/376 -[gh-377]: https://github.com/pomerium/pomerium/issues/377 -[gh-378]: https://github.com/pomerium/pomerium/issues/378 -[gh-379]: https://github.com/pomerium/pomerium/issues/379 -[gh-38]: https://github.com/pomerium/pomerium/issues/38 -[gh-380]: https://github.com/pomerium/pomerium/issues/380 -[gh-381]: https://github.com/pomerium/pomerium/issues/381 -[gh-382]: https://github.com/pomerium/pomerium/issues/382 -[gh-383]: https://github.com/pomerium/pomerium/issues/383 -[gh-384]: https://github.com/pomerium/pomerium/issues/384 -[gh-385]: https://github.com/pomerium/pomerium/issues/385 -[gh-386]: https://github.com/pomerium/pomerium/issues/386 -[gh-387]: https://github.com/pomerium/pomerium/issues/387 -[gh-388]: https://github.com/pomerium/pomerium/issues/388 -[gh-389]: https://github.com/pomerium/pomerium/issues/389 -[gh-39]: https://github.com/pomerium/pomerium/issues/39 -[gh-390]: https://github.com/pomerium/pomerium/issues/390 -[gh-391]: https://github.com/pomerium/pomerium/issues/391 -[gh-392]: https://github.com/pomerium/pomerium/issues/392 -[gh-393]: https://github.com/pomerium/pomerium/issues/393 -[gh-394]: https://github.com/pomerium/pomerium/issues/394 -[gh-395]: https://github.com/pomerium/pomerium/issues/395 -[gh-396]: https://github.com/pomerium/pomerium/issues/396 -[gh-397]: https://github.com/pomerium/pomerium/issues/397 -[gh-398]: https://github.com/pomerium/pomerium/issues/398 -[gh-399]: https://github.com/pomerium/pomerium/issues/399 -[gh-4]: https://github.com/pomerium/pomerium/issues/4 -[gh-40]: https://github.com/pomerium/pomerium/issues/40 -[gh-400]: https://github.com/pomerium/pomerium/issues/400 -[gh-401]: https://github.com/pomerium/pomerium/issues/401 -[gh-402]: https://github.com/pomerium/pomerium/issues/402 -[gh-403]: https://github.com/pomerium/pomerium/issues/403 -[gh-404]: https://github.com/pomerium/pomerium/issues/404 -[gh-405]: https://github.com/pomerium/pomerium/issues/405 -[gh-406]: https://github.com/pomerium/pomerium/issues/406 -[gh-407]: https://github.com/pomerium/pomerium/issues/407 -[gh-408]: https://github.com/pomerium/pomerium/issues/408 -[gh-409]: https://github.com/pomerium/pomerium/issues/409 -[gh-41]: https://github.com/pomerium/pomerium/issues/41 -[gh-410]: https://github.com/pomerium/pomerium/issues/410 -[gh-411]: https://github.com/pomerium/pomerium/issues/411 -[gh-412]: https://github.com/pomerium/pomerium/issues/412 -[gh-413]: https://github.com/pomerium/pomerium/issues/413 -[gh-414]: https://github.com/pomerium/pomerium/issues/414 -[gh-415]: https://github.com/pomerium/pomerium/issues/415 -[gh-416]: https://github.com/pomerium/pomerium/issues/416 -[gh-417]: https://github.com/pomerium/pomerium/issues/417 -[gh-418]: https://github.com/pomerium/pomerium/issues/418 -[gh-419]: https://github.com/pomerium/pomerium/issues/419 -[gh-42]: https://github.com/pomerium/pomerium/issues/42 -[gh-420]: https://github.com/pomerium/pomerium/issues/420 -[gh-421]: https://github.com/pomerium/pomerium/issues/421 -[gh-422]: https://github.com/pomerium/pomerium/issues/422 -[gh-423]: https://github.com/pomerium/pomerium/issues/423 -[gh-424]: https://github.com/pomerium/pomerium/issues/424 -[gh-425]: https://github.com/pomerium/pomerium/issues/425 -[gh-426]: https://github.com/pomerium/pomerium/issues/426 -[gh-427]: https://github.com/pomerium/pomerium/issues/427 -[gh-428]: https://github.com/pomerium/pomerium/issues/428 -[gh-429]: https://github.com/pomerium/pomerium/issues/429 -[gh-43]: https://github.com/pomerium/pomerium/issues/43 -[gh-430]: https://github.com/pomerium/pomerium/issues/430 -[gh-431]: https://github.com/pomerium/pomerium/issues/431 -[gh-432]: https://github.com/pomerium/pomerium/issues/432 -[gh-433]: https://github.com/pomerium/pomerium/issues/433 -[gh-434]: https://github.com/pomerium/pomerium/issues/434 -[gh-435]: https://github.com/pomerium/pomerium/issues/435 -[gh-436]: https://github.com/pomerium/pomerium/issues/436 -[gh-437]: https://github.com/pomerium/pomerium/issues/437 -[gh-438]: https://github.com/pomerium/pomerium/issues/438 -[gh-439]: https://github.com/pomerium/pomerium/issues/439 -[gh-44]: https://github.com/pomerium/pomerium/issues/44 -[gh-440]: https://github.com/pomerium/pomerium/issues/440 -[gh-441]: https://github.com/pomerium/pomerium/issues/441 -[gh-442]: https://github.com/pomerium/pomerium/issues/442 -[gh-443]: https://github.com/pomerium/pomerium/issues/443 -[gh-444]: https://github.com/pomerium/pomerium/issues/444 -[gh-445]: https://github.com/pomerium/pomerium/issues/445 -[gh-446]: https://github.com/pomerium/pomerium/issues/446 -[gh-447]: https://github.com/pomerium/pomerium/issues/447 -[gh-448]: https://github.com/pomerium/pomerium/issues/448 -[gh-449]: https://github.com/pomerium/pomerium/issues/449 -[gh-45]: https://github.com/pomerium/pomerium/issues/45 -[gh-450]: https://github.com/pomerium/pomerium/issues/450 -[gh-451]: https://github.com/pomerium/pomerium/issues/451 -[gh-452]: https://github.com/pomerium/pomerium/issues/452 -[gh-453]: https://github.com/pomerium/pomerium/issues/453 -[gh-454]: https://github.com/pomerium/pomerium/issues/454 -[gh-455]: https://github.com/pomerium/pomerium/issues/455 -[gh-456]: https://github.com/pomerium/pomerium/issues/456 -[gh-457]: https://github.com/pomerium/pomerium/issues/457 -[gh-458]: https://github.com/pomerium/pomerium/issues/458 -[gh-459]: https://github.com/pomerium/pomerium/issues/459 -[gh-46]: https://github.com/pomerium/pomerium/issues/46 -[gh-460]: https://github.com/pomerium/pomerium/issues/460 -[gh-461]: https://github.com/pomerium/pomerium/issues/461 -[gh-462]: https://github.com/pomerium/pomerium/issues/462 -[gh-463]: https://github.com/pomerium/pomerium/issues/463 -[gh-464]: https://github.com/pomerium/pomerium/issues/464 -[gh-465]: https://github.com/pomerium/pomerium/issues/465 -[gh-466]: https://github.com/pomerium/pomerium/issues/466 -[gh-467]: https://github.com/pomerium/pomerium/issues/467 -[gh-468]: https://github.com/pomerium/pomerium/issues/468 -[gh-469]: https://github.com/pomerium/pomerium/issues/469 -[gh-47]: https://github.com/pomerium/pomerium/issues/47 -[gh-470]: https://github.com/pomerium/pomerium/issues/470 -[gh-471]: https://github.com/pomerium/pomerium/issues/471 -[gh-472]: https://github.com/pomerium/pomerium/issues/472 -[gh-473]: https://github.com/pomerium/pomerium/issues/473 -[gh-474]: https://github.com/pomerium/pomerium/issues/474 -[gh-475]: https://github.com/pomerium/pomerium/issues/475 -[gh-476]: https://github.com/pomerium/pomerium/issues/476 -[gh-477]: https://github.com/pomerium/pomerium/issues/477 -[gh-478]: https://github.com/pomerium/pomerium/issues/478 -[gh-479]: https://github.com/pomerium/pomerium/issues/479 -[gh-48]: https://github.com/pomerium/pomerium/issues/48 -[gh-480]: https://github.com/pomerium/pomerium/issues/480 -[gh-481]: https://github.com/pomerium/pomerium/issues/481 -[gh-482]: https://github.com/pomerium/pomerium/issues/482 -[gh-483]: https://github.com/pomerium/pomerium/issues/483 -[gh-484]: https://github.com/pomerium/pomerium/issues/484 -[gh-485]: https://github.com/pomerium/pomerium/issues/485 -[gh-486]: https://github.com/pomerium/pomerium/issues/486 -[gh-487]: https://github.com/pomerium/pomerium/issues/487 -[gh-488]: https://github.com/pomerium/pomerium/issues/488 -[gh-489]: https://github.com/pomerium/pomerium/issues/489 -[gh-49]: https://github.com/pomerium/pomerium/issues/49 -[gh-490]: https://github.com/pomerium/pomerium/issues/490 -[gh-491]: https://github.com/pomerium/pomerium/issues/491 -[gh-492]: https://github.com/pomerium/pomerium/issues/492 -[gh-493]: https://github.com/pomerium/pomerium/issues/493 -[gh-494]: https://github.com/pomerium/pomerium/issues/494 -[gh-495]: https://github.com/pomerium/pomerium/issues/495 -[gh-496]: https://github.com/pomerium/pomerium/issues/496 -[gh-497]: https://github.com/pomerium/pomerium/issues/497 -[gh-498]: https://github.com/pomerium/pomerium/issues/498 -[gh-499]: https://github.com/pomerium/pomerium/issues/499 -[gh-5]: https://github.com/pomerium/pomerium/issues/5 -[gh-50]: https://github.com/pomerium/pomerium/issues/50 -[gh-500]: https://github.com/pomerium/pomerium/issues/500 -[gh-501]: https://github.com/pomerium/pomerium/issues/501 -[gh-502]: https://github.com/pomerium/pomerium/issues/502 -[gh-503]: https://github.com/pomerium/pomerium/issues/503 -[gh-504]: https://github.com/pomerium/pomerium/issues/504 -[gh-505]: https://github.com/pomerium/pomerium/issues/505 -[gh-506]: https://github.com/pomerium/pomerium/issues/506 -[gh-507]: https://github.com/pomerium/pomerium/issues/507 -[gh-508]: https://github.com/pomerium/pomerium/issues/508 -[gh-509]: https://github.com/pomerium/pomerium/issues/509 -[gh-51]: https://github.com/pomerium/pomerium/issues/51 -[gh-510]: https://github.com/pomerium/pomerium/issues/510 -[gh-511]: https://github.com/pomerium/pomerium/issues/511 -[gh-512]: https://github.com/pomerium/pomerium/issues/512 -[gh-513]: https://github.com/pomerium/pomerium/issues/513 -[gh-514]: https://github.com/pomerium/pomerium/issues/514 -[gh-515]: https://github.com/pomerium/pomerium/issues/515 -[gh-516]: https://github.com/pomerium/pomerium/issues/516 -[gh-517]: https://github.com/pomerium/pomerium/issues/517 -[gh-518]: https://github.com/pomerium/pomerium/issues/518 -[gh-519]: https://github.com/pomerium/pomerium/issues/519 -[gh-52]: https://github.com/pomerium/pomerium/issues/52 -[gh-520]: https://github.com/pomerium/pomerium/issues/520 -[gh-521]: https://github.com/pomerium/pomerium/issues/521 -[gh-522]: https://github.com/pomerium/pomerium/issues/522 -[gh-523]: https://github.com/pomerium/pomerium/issues/523 -[gh-524]: https://github.com/pomerium/pomerium/issues/524 -[gh-525]: https://github.com/pomerium/pomerium/issues/525 -[gh-526]: https://github.com/pomerium/pomerium/issues/526 -[gh-527]: https://github.com/pomerium/pomerium/issues/527 -[gh-528]: https://github.com/pomerium/pomerium/issues/528 -[gh-529]: https://github.com/pomerium/pomerium/issues/529 -[gh-53]: https://github.com/pomerium/pomerium/issues/53 -[gh-530]: https://github.com/pomerium/pomerium/issues/530 -[gh-531]: https://github.com/pomerium/pomerium/issues/531 -[gh-532]: https://github.com/pomerium/pomerium/issues/532 -[gh-533]: https://github.com/pomerium/pomerium/issues/533 -[gh-534]: https://github.com/pomerium/pomerium/issues/534 -[gh-535]: https://github.com/pomerium/pomerium/issues/535 -[gh-536]: https://github.com/pomerium/pomerium/issues/536 -[gh-537]: https://github.com/pomerium/pomerium/issues/537 -[gh-538]: https://github.com/pomerium/pomerium/issues/538 -[gh-539]: https://github.com/pomerium/pomerium/issues/539 -[gh-54]: https://github.com/pomerium/pomerium/issues/54 -[gh-540]: https://github.com/pomerium/pomerium/issues/540 -[gh-541]: https://github.com/pomerium/pomerium/issues/541 -[gh-542]: https://github.com/pomerium/pomerium/issues/542 -[gh-543]: https://github.com/pomerium/pomerium/issues/543 -[gh-544]: https://github.com/pomerium/pomerium/issues/544 -[gh-545]: https://github.com/pomerium/pomerium/issues/545 -[gh-546]: https://github.com/pomerium/pomerium/issues/546 -[gh-547]: https://github.com/pomerium/pomerium/issues/547 -[gh-548]: https://github.com/pomerium/pomerium/issues/548 -[gh-549]: https://github.com/pomerium/pomerium/issues/549 -[gh-55]: https://github.com/pomerium/pomerium/issues/55 -[gh-550]: https://github.com/pomerium/pomerium/issues/550 -[gh-551]: https://github.com/pomerium/pomerium/issues/551 -[gh-552]: https://github.com/pomerium/pomerium/issues/552 -[gh-553]: https://github.com/pomerium/pomerium/issues/553 -[gh-554]: https://github.com/pomerium/pomerium/issues/554 -[gh-555]: https://github.com/pomerium/pomerium/issues/555 -[gh-556]: https://github.com/pomerium/pomerium/issues/556 -[gh-557]: https://github.com/pomerium/pomerium/issues/557 -[gh-558]: https://github.com/pomerium/pomerium/issues/558 -[gh-559]: https://github.com/pomerium/pomerium/issues/559 -[gh-56]: https://github.com/pomerium/pomerium/issues/56 -[gh-560]: https://github.com/pomerium/pomerium/issues/560 -[gh-561]: https://github.com/pomerium/pomerium/issues/561 -[gh-562]: https://github.com/pomerium/pomerium/issues/562 -[gh-563]: https://github.com/pomerium/pomerium/issues/563 -[gh-564]: https://github.com/pomerium/pomerium/issues/564 -[gh-565]: https://github.com/pomerium/pomerium/issues/565 -[gh-566]: https://github.com/pomerium/pomerium/issues/566 -[gh-567]: https://github.com/pomerium/pomerium/issues/567 -[gh-568]: https://github.com/pomerium/pomerium/issues/568 -[gh-569]: https://github.com/pomerium/pomerium/issues/569 -[gh-57]: https://github.com/pomerium/pomerium/issues/57 -[gh-570]: https://github.com/pomerium/pomerium/issues/570 -[gh-571]: https://github.com/pomerium/pomerium/issues/571 -[gh-572]: https://github.com/pomerium/pomerium/issues/572 -[gh-573]: https://github.com/pomerium/pomerium/issues/573 -[gh-574]: https://github.com/pomerium/pomerium/issues/574 -[gh-575]: https://github.com/pomerium/pomerium/issues/575 -[gh-576]: https://github.com/pomerium/pomerium/issues/576 -[gh-577]: https://github.com/pomerium/pomerium/issues/577 -[gh-578]: https://github.com/pomerium/pomerium/issues/578 -[gh-579]: https://github.com/pomerium/pomerium/issues/579 -[gh-58]: https://github.com/pomerium/pomerium/issues/58 -[gh-580]: https://github.com/pomerium/pomerium/issues/580 -[gh-581]: https://github.com/pomerium/pomerium/issues/581 -[gh-582]: https://github.com/pomerium/pomerium/issues/582 -[gh-583]: https://github.com/pomerium/pomerium/issues/583 -[gh-584]: https://github.com/pomerium/pomerium/issues/584 -[gh-585]: https://github.com/pomerium/pomerium/issues/585 -[gh-586]: https://github.com/pomerium/pomerium/issues/586 -[gh-587]: https://github.com/pomerium/pomerium/issues/587 -[gh-588]: https://github.com/pomerium/pomerium/issues/588 -[gh-589]: https://github.com/pomerium/pomerium/issues/589 -[gh-59]: https://github.com/pomerium/pomerium/issues/59 -[gh-590]: https://github.com/pomerium/pomerium/issues/590 -[gh-591]: https://github.com/pomerium/pomerium/issues/591 -[gh-592]: https://github.com/pomerium/pomerium/issues/592 -[gh-593]: https://github.com/pomerium/pomerium/issues/593 -[gh-594]: https://github.com/pomerium/pomerium/issues/594 -[gh-595]: https://github.com/pomerium/pomerium/issues/595 -[gh-596]: https://github.com/pomerium/pomerium/issues/596 -[gh-597]: https://github.com/pomerium/pomerium/issues/597 -[gh-598]: https://github.com/pomerium/pomerium/issues/598 -[gh-599]: https://github.com/pomerium/pomerium/issues/599 -[gh-6]: https://github.com/pomerium/pomerium/issues/6 -[gh-60]: https://github.com/pomerium/pomerium/issues/60 -[gh-600]: https://github.com/pomerium/pomerium/issues/600 -[gh-601]: https://github.com/pomerium/pomerium/issues/601 -[gh-602]: https://github.com/pomerium/pomerium/issues/602 -[gh-603]: https://github.com/pomerium/pomerium/issues/603 -[gh-604]: https://github.com/pomerium/pomerium/issues/604 -[gh-605]: https://github.com/pomerium/pomerium/issues/605 -[gh-606]: https://github.com/pomerium/pomerium/issues/606 -[gh-607]: https://github.com/pomerium/pomerium/issues/607 -[gh-608]: https://github.com/pomerium/pomerium/issues/608 -[gh-609]: https://github.com/pomerium/pomerium/issues/609 -[gh-61]: https://github.com/pomerium/pomerium/issues/61 -[gh-610]: https://github.com/pomerium/pomerium/issues/610 -[gh-611]: https://github.com/pomerium/pomerium/issues/611 -[gh-612]: https://github.com/pomerium/pomerium/issues/612 -[gh-613]: https://github.com/pomerium/pomerium/issues/613 -[gh-614]: https://github.com/pomerium/pomerium/issues/614 -[gh-615]: https://github.com/pomerium/pomerium/issues/615 -[gh-616]: https://github.com/pomerium/pomerium/issues/616 -[gh-617]: https://github.com/pomerium/pomerium/issues/617 -[gh-618]: https://github.com/pomerium/pomerium/issues/618 -[gh-619]: https://github.com/pomerium/pomerium/issues/619 -[gh-62]: https://github.com/pomerium/pomerium/issues/62 -[gh-620]: https://github.com/pomerium/pomerium/issues/620 -[gh-621]: https://github.com/pomerium/pomerium/issues/621 -[gh-622]: https://github.com/pomerium/pomerium/issues/622 -[gh-623]: https://github.com/pomerium/pomerium/issues/623 -[gh-624]: https://github.com/pomerium/pomerium/issues/624 -[gh-625]: https://github.com/pomerium/pomerium/issues/625 -[gh-626]: https://github.com/pomerium/pomerium/issues/626 -[gh-627]: https://github.com/pomerium/pomerium/issues/627 -[gh-628]: https://github.com/pomerium/pomerium/issues/628 -[gh-629]: https://github.com/pomerium/pomerium/issues/629 -[gh-63]: https://github.com/pomerium/pomerium/issues/63 -[gh-630]: https://github.com/pomerium/pomerium/issues/630 -[gh-631]: https://github.com/pomerium/pomerium/issues/631 -[gh-632]: https://github.com/pomerium/pomerium/issues/632 -[gh-633]: https://github.com/pomerium/pomerium/issues/633 -[gh-634]: https://github.com/pomerium/pomerium/issues/634 -[gh-635]: https://github.com/pomerium/pomerium/issues/635 -[gh-636]: https://github.com/pomerium/pomerium/issues/636 -[gh-637]: https://github.com/pomerium/pomerium/issues/637 -[gh-638]: https://github.com/pomerium/pomerium/issues/638 -[gh-639]: https://github.com/pomerium/pomerium/issues/639 -[gh-64]: https://github.com/pomerium/pomerium/issues/64 -[gh-640]: https://github.com/pomerium/pomerium/issues/640 -[gh-641]: https://github.com/pomerium/pomerium/issues/641 -[gh-642]: https://github.com/pomerium/pomerium/issues/642 -[gh-643]: https://github.com/pomerium/pomerium/issues/643 -[gh-644]: https://github.com/pomerium/pomerium/issues/644 -[gh-645]: https://github.com/pomerium/pomerium/issues/645 -[gh-646]: https://github.com/pomerium/pomerium/issues/646 -[gh-647]: https://github.com/pomerium/pomerium/issues/647 -[gh-648]: https://github.com/pomerium/pomerium/issues/648 -[gh-649]: https://github.com/pomerium/pomerium/issues/649 -[gh-65]: https://github.com/pomerium/pomerium/issues/65 -[gh-650]: https://github.com/pomerium/pomerium/issues/650 -[gh-651]: https://github.com/pomerium/pomerium/issues/651 -[gh-652]: https://github.com/pomerium/pomerium/issues/652 -[gh-653]: https://github.com/pomerium/pomerium/issues/653 -[gh-654]: https://github.com/pomerium/pomerium/issues/654 -[gh-655]: https://github.com/pomerium/pomerium/issues/655 -[gh-656]: https://github.com/pomerium/pomerium/issues/656 -[gh-657]: https://github.com/pomerium/pomerium/issues/657 -[gh-658]: https://github.com/pomerium/pomerium/issues/658 -[gh-659]: https://github.com/pomerium/pomerium/issues/659 -[gh-66]: https://github.com/pomerium/pomerium/issues/66 -[gh-660]: https://github.com/pomerium/pomerium/issues/660 -[gh-661]: https://github.com/pomerium/pomerium/issues/661 -[gh-662]: https://github.com/pomerium/pomerium/issues/662 -[gh-663]: https://github.com/pomerium/pomerium/issues/663 -[gh-664]: https://github.com/pomerium/pomerium/issues/664 -[gh-665]: https://github.com/pomerium/pomerium/issues/665 -[gh-666]: https://github.com/pomerium/pomerium/issues/666 -[gh-667]: https://github.com/pomerium/pomerium/issues/667 -[gh-668]: https://github.com/pomerium/pomerium/issues/668 -[gh-669]: https://github.com/pomerium/pomerium/issues/669 -[gh-67]: https://github.com/pomerium/pomerium/issues/67 -[gh-670]: https://github.com/pomerium/pomerium/issues/670 -[gh-671]: https://github.com/pomerium/pomerium/issues/671 -[gh-672]: https://github.com/pomerium/pomerium/issues/672 -[gh-673]: https://github.com/pomerium/pomerium/issues/673 -[gh-674]: https://github.com/pomerium/pomerium/issues/674 -[gh-675]: https://github.com/pomerium/pomerium/issues/675 -[gh-676]: https://github.com/pomerium/pomerium/issues/676 -[gh-677]: https://github.com/pomerium/pomerium/issues/677 -[gh-678]: https://github.com/pomerium/pomerium/issues/678 -[gh-679]: https://github.com/pomerium/pomerium/issues/679 -[gh-68]: https://github.com/pomerium/pomerium/issues/68 -[gh-69]: https://github.com/pomerium/pomerium/issues/69 -[gh-7]: https://github.com/pomerium/pomerium/issues/7 -[gh-70]: https://github.com/pomerium/pomerium/issues/70 -[gh-71]: https://github.com/pomerium/pomerium/issues/71 -[gh-72]: https://github.com/pomerium/pomerium/issues/72 -[gh-73]: https://github.com/pomerium/pomerium/issues/73 -[gh-74]: https://github.com/pomerium/pomerium/issues/74 -[gh-75]: https://github.com/pomerium/pomerium/issues/75 -[gh-76]: https://github.com/pomerium/pomerium/issues/76 -[gh-77]: https://github.com/pomerium/pomerium/issues/77 -[gh-78]: https://github.com/pomerium/pomerium/issues/78 -[gh-79]: https://github.com/pomerium/pomerium/issues/79 -[gh-8]: https://github.com/pomerium/pomerium/issues/8 -[gh-80]: https://github.com/pomerium/pomerium/issues/80 -[gh-81]: https://github.com/pomerium/pomerium/issues/81 -[gh-82]: https://github.com/pomerium/pomerium/issues/82 -[gh-83]: https://github.com/pomerium/pomerium/issues/83 -[gh-84]: https://github.com/pomerium/pomerium/issues/84 -[gh-85]: https://github.com/pomerium/pomerium/issues/85 -[gh-86]: https://github.com/pomerium/pomerium/issues/86 -[gh-87]: https://github.com/pomerium/pomerium/issues/87 -[gh-88]: https://github.com/pomerium/pomerium/issues/88 -[gh-89]: https://github.com/pomerium/pomerium/issues/89 -[gh-9]: https://github.com/pomerium/pomerium/issues/9 -[gh-90]: https://github.com/pomerium/pomerium/issues/90 -[gh-91]: https://github.com/pomerium/pomerium/issues/91 -[gh-92]: https://github.com/pomerium/pomerium/issues/92 -[gh-93]: https://github.com/pomerium/pomerium/issues/93 -[gh-94]: https://github.com/pomerium/pomerium/issues/94 -[gh-95]: https://github.com/pomerium/pomerium/issues/95 -[gh-96]: https://github.com/pomerium/pomerium/issues/96 -[gh-97]: https://github.com/pomerium/pomerium/issues/97 -[gh-98]: https://github.com/pomerium/pomerium/issues/98 -[gh-99]: https://github.com/pomerium/pomerium/issues/99 -[synology tutorial]: /docs/guides/synology.md diff --git a/content/docs/core/from-source.mdx b/content/docs/core/from-source.mdx deleted file mode 100644 index bdec2aa88..000000000 --- a/content/docs/core/from-source.mdx +++ /dev/null @@ -1,88 +0,0 @@ ---- -# cSpell:ignore filippo - -title: From Source -lang: en-US -keywords: - [ - pomerium, - identity access proxy, - oidc, - reverse proxy, - from source, - identity aware proxy, - ] -sidebar_label: From Source -sidebar_position: 4 ---- - -import ConfigMinimal from '@site/content/examples/config/config.minimal.yaml.md'; - -# Building Pomerium From Source - -This document covers how to retrieve and build Pomerium from its source code as well as how to run Pomerium using a minimal but complete configuration. - -## Prerequisites - -- [git](https://git-scm.com/) -- [go](https://golang.org/doc/install) programming language -- A configured [identity provider] - -## Download - -Retrieve the latest copy of Pomerium's source code by cloning the repository. - -```bash -git clone https://github.com/pomerium/pomerium.git $HOME/pomerium -``` - -## Create local certs - -In production, we'd use a public certificate authority such as LetsEncrypt. For local development, we can use [mkcert](https://mkcert.dev/) to make locally trusted development certificates with any names you'd like. - -```bash -# Install mkcert. -go install filippo.io/mkcert@latest -# Bootstrap mkcert's root certificate into your operating system's trust store. -mkcert -install -# Create your wildcard domain. -# *.localhost.pomerium.io is helper domain we've hard-coded to route to localhost -mkcert "*.localhost.pomerium.io" -``` - -## Build - -Build Pomerium from source in a single step using make. - -```bash -cd $HOME/pomerium -make -``` - -[Make] will run all the tests, some code linters, then build the binary. If all is good, you should now have a freshly built Pomerium binary for your architecture and operating system in the `pomerium/bin` directory. - -If you don't have the prerequisites for the tests (Docker, Redis, etc) locally, you can instead run `make build` to just create the binary. - -## Configure - -Pomerium supports setting [configuration variables] using both environmental variables and using a configuration file. Here, we'll use a file. - -Create a config file (`config.yaml`). This file will be use to determine Pomerium's configuration settings, routes, and access-policies. Consider the following example: - - - -## Run - -Finally, run Pomerium specifying the configuration file `config.yaml`. - -```bash -./bin/pomerium -config config.yaml -``` - -Browse to `verify.localhost.pomerium.io`. Connections between you and [verify] will now be proxied and managed by Pomerium. - -[configuration variables]: /docs/reference -[verify]: https://verify.pomerium.com/ -[identity provider]: /docs/identity-providers -[make]: https://en.wikipedia.org/wiki/Make_(software) -[tls certificates]: /docs/guides/certificates diff --git a/content/docs/core/img/verify-service.png b/content/docs/core/img/verify-service.png deleted file mode 100644 index 91153015c..000000000 Binary files a/content/docs/core/img/verify-service.png and /dev/null differ diff --git a/content/docs/core/quickstart.md b/content/docs/core/quickstart.md deleted file mode 100644 index 7c8295dc7..000000000 --- a/content/docs/core/quickstart.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -# cSpell:ignore thisisunsafe, genkey, noout - -title: Run Pomerium Core With Docker -lang: en-US -sidebar_label: Quickstart -sidebar_position: 1 -pagination_prev: null -pagination_next: null -description: Get Pomerium up and running quickly with Docker. -keywords: - [ - pomerium, - identity access proxy, - oidc, - docker, - reverse proxy, - containers, - identity aware proxy, - quickstart pomerium, - docker, - docker-compose, - ] ---- - -import ConfigDocker from '@site/content/examples/config/config.docker.yaml.md'; import DockerCompose from '@site/content/examples/docker/basic.docker-compose.yml.md'; - -# Run Pomerium Core With Docker - -Run Pomerium Core with Docker containers in **under 5 minutes**. - -The Core quickstart uses Pomerium's [**Hosted Authenticate Service**](/docs/capabilities/hosted-authenticate-service), but you can also configure a [**self-hosted authenticate service**](/docs/capabilities/self-hosted-authenticate-service) to integrate with Pomerium. - -## Prerequisites - -[Docker] and [Docker Compose] - -## Configure Pomerium - -Create a `config.yaml` file in the root of your project. - -Add the configuration below to `config.yaml`: - - - -Replace `user@example.com` with your email address. - -## Configure Docker - -Create a `docker-compose.yaml` file in the root of your project. - -Add the configuration below to `docker-compose.yaml`: - - - -## Run Docker Compose - -```bash -docker compose up -``` - -Access the **verify route** you built in your policy: `https://verify.localhost.pomerium.io` - -If you get a self-signed certificate warning, see [Handle Self-Signed Certificate Warning](/docs/troubleshooting#handle-self-signed-certificate-warning) to bypass it. - -You should be redirected to the **verify** service. You'll see a page like this: - -![Verify page](./img/verify-service.png) - -Although identity verification failed, you successfully integrated Pomerium with the upstream verify service. - -:::tip - -Because this guide doesn't include a [signing key](/docs/reference/signing-key) in the configuration, identity verification will fail. - -See [Identity Verification](/docs/capabilities/getting-users-identity) for more information on how Pomerium can use JWTs for authentication. - -::: - -## Next Steps - -If you want to [try Enterprise](https://www.pomerium.com/enterprise-sales/), check out the [Enterprise with Docker quickstart](/docs/enterprise/quickstart). - -If you want to try connecting Pomerium with other services, see some of our [Guides](/docs/guides). - -**Did you finish this quickstart guide?** We'd love to hear what you think. Get in touch with us on our [Discuss forum](https://discuss.pomerium.com/), message us on [Twitter](https://twitter.com/pomerium_io), [LinkedIn](https://www.linkedin.com/company/pomerium-inc), or check out our [Community](https://www.pomerium.com/docs/community) page. - -:::caution - -This is a test environment! If you followed all the steps in this doc your Pomerium environment is not using trusted certificates. Remember to use a valid certificate solution before moving this configuration to a production environment. See [Certificates](/docs/reference/certificates) for more information. - -::: - -[configuration file]: /docs/reference -[container images]: https://hub.docker.com/r/pomerium/pomerium -[docker]: https://docs.docker.com/install/ -[docker compose]: https://docs.docker.com/compose/install/ diff --git a/content/docs/core/upgrading.mdx b/content/docs/core/upgrading.mdx deleted file mode 100644 index 9b62c6467..000000000 --- a/content/docs/core/upgrading.mdx +++ /dev/null @@ -1,911 +0,0 @@ ---- -# cSpell:ignore privkey cooldown certbot httpchk autocache forwardauth signin healthcheck GITHASH statefulset - -title: Upgrading -description: >- - This page contains the list of deprecations and important or breaking changes for Pomerium. Please read it carefully. - - -pagination_prev: null -pagination_next: null -sidebar_position: 3 ---- - -# Upgrade guide - -## 0.28.0 - -There are no breaking changes in v0.28. - -## 0.27.0 - -### Breaking - -#### Deprecated JWT endpoint - -The /.pomerium/jwt endpoint is now deprecated and disabled by default. (To temporarily opt out of this deprecation, set the runtime flag [`pomerium_jwt_endpoint`](/docs/reference/runtime-flags) to true. This flag will be removed in a future release.) - -This endpoint was originally added for single-page web apps to get information about the currently signed-in user, but for this use case it is not necessary to receive this information as a signed JWT. - -Furthermore, this endpoint is incompatible with the desired security properties for the Pomerium JWT. We intend for the Pomerium JWT to represent that a specific request to an upstream service was duly authorized by Pomerium. The JWTs issued by the /.pomerium/jwt endpoint do not satisfy this property. - -There is a new /.pomerium/user endpoint to provide the same user data, but as a plaintext JSON response. If you are using the Pomerium [JavaScript SDK](https://github.com/pomerium/js-sdk), version 1.1.0 includes a new `getBrowserUser()` method to replace the existing `verifyBrowserUser()` method. - -#### Upgrading Pomerium Zero deployments in Kubernetes - -For Pomerium Zero deployments in Kubernetes, we updated the Kubernetes manifest to use a [Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) instead of a StatefulSet. Before you upgrade, you need to delete your existing StatefulSet with a command like: - -```bash -kubectl delete statefulset/pomerium -n pomerium-zero -``` - -Once you’ve removed your StatefulSet, run the following command to update Pomerium in Kubernetes: - -```bash -kubectl apply -k github.com/pomerium/pomerium/k8s/zero -``` - -## 0.26.0 - -#### Routes port matching - -Pomerium’s route matching behavior has changed with regards to port numbers in incoming requests. Previously, when matching an incoming request against the defined routes, Pomerium would require that the request’s `Host` (or `:authority`) header match the route’s `from` URL including any port number. This can cause problems in deployments with a NAT with port mapping in front of Pomerium. - -As of v0.26, if a Pomerium route’s `from` URL does not include an explicit port number, the matching behavior is more lenient: the route will match an incoming request with any port number. For example, take a route with the `from` URL `https://app.example.com`. Incoming requests with a host header of `app.example.com` , `app.example.com:443`, and `app.example.com:1234` would all match this route. - -However, if you specify a port number explicitly in the `from` URL, then incoming requests must include the same port number in the host header in order to match that route. - -You can temporarily revert this change in behavior by setting the [runtime flag](https://www.pomerium.com/docs/reference/runtime-flags) `match_any_incoming_port` to false. - -#### Host header rewrite behavior - -Pomerium will now consistently rewrite the host header of an incoming request to match the host and port specified in the route `to` URL. (Previously Pomerium would never include a port number even if specified, and Pomerium would not rewrite the host header for any `to` URLs with a host of `localhost` or an IP address.) The new behavior is intended to be more consistent and predictable. - -Please set the [Preserve Host Header](https://www.pomerium.com/docs/reference/routes/headers#1-preserve-host-header) option for any routes where Pomerium should not rewrite the host header. - -#### Improved session refresh reliability - -We’ve updated the way Pomerium refreshes OAuth access tokens in order to improve reliability. Previously, Pomerium could fall behind on access token refresh, leading to users being prompted to sign in again before their Pomerium session should have expired. This may result in a higher rate of requests to your configured identity provider. - -If you suspect this is causing any problems for your deployment, you can temporarily revert to the previous implementation by setting the runtime flag `legacy_identity_manager` to true. - -#### Deprecations - -Support for the deprecated `client_ca` config file key (and `CLIENT_CA` environment variable) is now removed. Please update any remaining usage to `downstream_mtls.ca` or the `DOWNSTREAM_MTLS_CA` environment variable. See [https://www.pomerium.com/docs/reference/downstream-mtls-settings#ca](https://www.pomerium.com/docs/reference/downstream-mtls-settings#ca) for more information about this option. - -## 0.25.0 - -### Breaking - -#### Base64-encoded Certificates - -Previously, the `certificates` key supported base64-encoded certificates as a value (this option was not documented). We've removed support for base64-encoded certificates for this setting and now require that you only use the certificate file location. To avoid incompatibilities between versions, please update these values accordingly. - -**Note:** The `certificates` key is distinct from the `certificate` key. The `certificate` key setting still supports base64-encoded certificates; the `certificates` _list_ does not. - -#### Remove Debug Option - -We've removed support for the Debug setting, which changed the format of logs from JSON to a pretty-print format. If you prefer to review logs in a pretty-print format, you can use a command-line processing tool like `jq`. - -### New - -#### Authentication Flows - -In v0.21, we modified the Core authentication flow to support the [Hosted Authenticate](https://www.pomerium.com/docs/capabilities/hosted-authenticate-service) service. However, this flow posed some limitations for self-hosted deployments (see [#4819](https://github.com/pomerium/pomerium/issues/4819) for more details). In v0.25, we’ve updated the Core authentication flow so that it’s more versatile: Deployments configured to use the Hosted Authenticate service will use the newer authentication flow introduced in v0.21, while self-hosted deployments will use the older flow. - -## 0.24.0 - -### Breaking - -#### Set Authorization Header - -The deprecated `set_authorization_header` configuration setting has been removed. You can use the [Set Request Headers](/docs/reference/routes/headers#set-request-headers) setting to pass IdP tokens to upstream services in any header. - -#### Base64-encoded Certificates - -Previously, the `certificates` key supported base64-encoded certificates as a value (this option was not documented). We've removed support for base64-encoded certificates for this setting and now require that you only use the relative file location. - -**Note:** The `certificates` key is distinct from the `certificate` key. The `certificate` key setting still supports base64-encoded certificates; the `certificates` _list_ does not. - -See [Certificates](/docs/reference/certificates#certificates) for more information. - -#### Redis Storage Backend - -PostgreSQL has been the recommended databroker storage backend since v0.18. Support for Redis has now been removed. - -See [Persistence](/docs/internals/data-storage#postgres) for more information. - -### Performance - -v0.24.0 includes several performance enhancements for Pomerium Core. See the sections below for more information. - -#### Policy evaluator reuse - -The authorize service maintains one policy evaluator object for each route, which is responsible for all authorization decisions for that route. - -Previously, the authorize service would recreate all policy evaluator objects in response to a configuration change. - -Now, it will avoid recreating policy evaluator objects for any policies that have not changed, provided that the overall settings are compatible between the old and new configuration. (Some settings affect all routes, e.g. the [downstream_mtls](https://www.pomerium.com/docs/reference/downstream-mtls-settings) options, and changes to these options will still require all policy evaluators to be recreated.) - -#### Parallelization - -Core will now build route configuration objects and policy evaluator objects in parallel, each using up to half the number of available CPU cores. - -## 0.23.0 - -### New - -#### Logging Configurations - -The new [Access Log Fields](/docs/reference/access-log-fields) and [Authorize Log Fields](/docs/reference/authorize-log-fields) settings allow you to customize the fields logged in the access and authorize logs. You can now opt to log ID tokens or specific ID token claims, custom request headers, and the request query params. See the linked reference pages for details. - -
- How the new Logging Configurations work -
- -**1. Configure logs**
Specify which fields you want to log (omitting the setting will display all the default fields): - -```yaml -# Access logs from Proxy service -access_log_fields: - - authority - - path - -# Authorize logs from Authorize service -authorize_log_fields: - - request-id - - method - - path -``` - -**2. Access a route**
For example, Pomerium’s Verify service: - -```yaml -routes: - - from: https://verify.localhost.pomerium.io - to: http://verify:8000 -``` - -**3. Find logs**
After you access a route, filter your logs by searching for `“http-request”` and `“authorize check”`: - -```json -// Search for “message”: “http-request” -{ - "level": "info", - "service": "envoy", - "authority": "verify.pomerium.com", - "path": "/img/json.svg", - "time": "2023-08-04T12:12:35-04:00", - "message": "http-request" -} -// Search for “message”: “authorize check” -{ - "level": "info", - "service": "authorize", - "request-id": "c9afae5a-ec5a-4242-864f-df4189f20e99", - "method": "GET", - "path": "/index.css", - "allow": true, - "allow-why-true": ["domain-ok"], - "deny": false, - "deny-why-false": [], - "time": "2023-08-07T10:26:33-04:00", - "message": "authorize check" -} -``` - -
-
- -#### New Downstream mTLS Settings - -Downstream mTLS refers to the requirement that end users connecting to Pomerium-managed routes must present a trusted client certificate. The options for configuring downstream mTLS have been expanded and moved to a new settings group, under a new `downstream_mtls` configuration file key. - -The existing [Certificate Authority](/docs/reference/downstream-mtls-settings#ca) setting has moved from `client_ca` to `downstream_mtls.ca`. The `client_ca` configuration file key will continue to function as an alias for the new setting (but will be removed in a future release). - -Support for certificate revocation via CRLs is newly introduced. Please see the [CRL](/docs/reference/downstream-mtls-settings#crl) reference for more information and some important limitations. - -A new [Enforcement Mode](/docs/reference/downstream-mtls-settings#enforcement-mode) option has been added, to control the behavior when a client does not present a trusted certificate. The default setting preserves the behavior of previous Pomerium releases: client certificates are required only for user-configured Pomerium routes, and Pomerium will serve an HTML error page for requests without a trusted certificate. The new `reject_connection` setting allows for stricter client certificate enforcement: in this mode any attempt to make a TLS connection without a trusted client certificate will be rejected. Naturally, this means that client certificates will be required not only for user-configured Pomerium routes, but also for internal Pomerium routes. This mode allows you to use mTLS as an isolated security layer, entirely separate from Pomerium policy enforcement. Please review the [reference page](/docs/reference/downstream-mtls-settings#enforcement-mode) carefully before enabling this mode. - -To give further control over which specific client certificates are allowed, Pomerium now also offers a [Match Subject Alt Names](/docs/reference/downstream-mtls-settings#match-sans) setting. This allows you to trust only those client certificates containing a Subject Alternative Name (SAN) of a specific type, matching a particular regular expression. - -When the new [Max Verify Depth](/docs/reference/downstream-mtls-settings#max-verify-depth) option is set, Pomerium will consider client-supplied intermediate CA certificates when verifying a client certificate. The default setting preserves the behavior of previous Pomerium releases: all client certificates must be issued directly by a certificate authority included in the CA setting (no client-supplied intermediate CA certificates are allowed). This default behavior may change in a future release. - -#### Certificate Matcher PPL Criteria (beta) - -The new [Certificate Matcher](/docs/capabilities/ppl#certificate-matcher) can be used with the new PPL criterion `client_certificate` to build policies that grant or deny access based on the client certificate’s fingerprint or Subject Public Key Info (SPKI) hash. Both of these options allow you to create an allowlist or denylist of specific certificates. - -See the [Certificate Matcher](/docs/capabilities/ppl#certificate-matcher) policy page for more information and examples. - -#### Set Request Headers options - -You can configure the [Set Request Headers](/docs/reference/routes/headers#pass-dynamic-tokens-in-headers) setting to send the client certificate fingerprint (downstream mTLS must be enabled) to the upstream application or service. The fingerprint can be built into your authorization policy with the new Certificate Matcher (beta) PPL criteria to grant or deny users based on the fingerprint’s value. - -See the [Set Request Headers](/docs/reference/routes/headers#pass-dynamic-tokens-in-headers) settings page for more information and examples. - -### Deprecated - -#### Set Authorization Header - -The [Set Authorization Header](/docs/reference/routes/headers#set-request-headers) option is deprecated in favor of the new variable substitution support in the Set Request Headers option. This new support allows you to pass IdP tokens to upstream services in any header, not just the `Authorization` header. - -The Set Authorization Header option will be removed in a future release. - -#### TLS Downstream Client Certificate Authority - -The [TLS Downstream Client Certificate Authority](/docs/reference/routes/tls#tls-downstream-client-certificate-authority) option is deprecated, and will be removed in a future release. - -If you previously used this setting to require client certificates only on certain routes, you can achieve this same behavior by setting the new downstream mTLS [Enforcement Mode](/docs/reference/downstream-mtls-settings#enforcement-mode) option to the value `policy` and adding a policy deny rule with the `invalid_client_certificate` criterion on all routes that should require client certificates. - -If you want to enforce an allowlist or denylist of specific certificates on a particular route, you can use the new [`client_certificate`](/docs/capabilities/ppl#certificate-matcher) policy criterion. - -If you do need to set completely different trusted client CAs for different routes, we recommend running separate Pomerium clusters for each set of trusted client CAs. - -### Breaking - -#### Set Request Headers options - -To prevent a ‘$’ character from being treated as the start of a variable substitution, you may need to replace it with ‘$$’. - -## 0.22.0 - -### New - -#### Hosted Authenticate Service - -- [Hosted Authenticate Service](/docs/capabilities/hosted-authenticate-service.md) will now be used by default to handle single-sign-on. Pomerium hosts this service as a convenience to its users; no identity provider configuration or authenticate service URL needs to be specified if the hosted authenticate service is used. The [Self-Hosted Authenticate Service](/docs/capabilities/self-hosted-authenticate-service), which requires a self-hosted authenticate service URL and identity provider, is still supported for users that prefer to host these services themselves. - -#### Wildcard From Routes - -- [Wildcard From Routes](/docs/reference/routes/from#wildcard-from-routes) is a Beta support feature that allows you to define a wildcard route that points matching external routes to a single destination. - -#### Better Memory performance - -- Internal [RDS changes](https://github.com/pomerium/pomerium/pull/4098) reduce memory consumption, especially for environments where configuration changes rapidly. - -## 0.21.0 - -### Upgrading - -There are several data model changes in this release that are not backward compatible. Please make sure you back up your Postgres database before performing an upgrade. - -### Breaking - -#### Devices need to be re-enrolled - -The [Device Identity (beta)](/docs/capabilities/device-identity) data model had an internal change that is not forward compatible. Your enrolled devices will need be re-registered. Your existing policies may need to be updated. - -#### Forward Auth (deprecated, removed in this release) - -Forward auth was introduced in early versions of Pomerium to provide a gradual migration path for users of other reverse proxies to Pomerium. Since then, Pomerium has come a long way - it is now based around first class reverse proxy core (Envoy) and has been battle tested for many years. Unfortunately, supporting forward authentication mode provides a subpar experience in security (cookies cannot be stripped from upstream requests), configuration (misconfiguration issues are common and hard to troubleshoot), and it is not compatible with many of Pomerium's newer features and deployment scenarios. - -### New - -#### Bastion Host support for TCP routes - -See [Bastion Host](/docs/capabilities/tcp#bastion-host) - -#### Internal TLS by default - -If you run Pomerium Enterprise, you may set up a secure HTTPS connection between Pomerium Core and Enterprise without need to explicitly supply certificates. See [`tls_derive`](/docs/reference/tls-derive) - -## 0.20.0 - -### Breaking - -#### IdP Groups Policy - -A deprecated `routes.allowed_groups` and `groups` PPL criteria were removed. - -For Open Source, please use IdP Claims passed by your IdP. - -- Please visit your IdP provider admin console to adjust group membership propagation to Claims. - - [Okta](https://developer.okta.com/docs/guides/customize-tokens-groups-claim/main) - - [Auth0](https://auth0.com/docs/customize/extensions/authorization-extension/configure-authorization-extension#add-authorization-information-to-the-token-issued) - - [Azure](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-group-claims) - - [Cognito](/docs/identity-providers/cognito#getting-groups) -- You may need adjust requested scopes via `idp_scopes` config option. -- visit your authenticate endpoint `/.pomerium` route to check the group claims are passed by your IdP. -- use `claim/` [PPL criteria](/docs/capabilities/ppl#criteria) - -```yaml -routes: - - from: https://httpbin.localhost.pomerium.io - to: https://httpbin.org - pass_identity_headers: true - policy: - allow: - and: - - claim/groups: admins -``` - -For Enterprise, use PPL Builder ![policy_groups_enterprise](../enterprise/img/upgrading/policy_groups_enterprise.png) - -### IdP Directory Sync - -IdP directory sync has been moved to https://github.com/pomerium/datasource and becomes part of the [External Data Sources integration](/docs/capabilities/integrations/), in order to provide unification with other external data sources, consolidate job scheduling and monitoring. - -Setting the below options in Pomerium config file would now result in an error. In Pomerium Enterprise Console, please navigate to Settings > Identity Provider and configure directory sync there. - -- `idp_service_account`: use IdP provider specific options in the UI. -- `idp_refresh_directory_timeout`: use [Polling Min Delay](/docs/reference/identity-provider-settings#identity-provider-polling-minmax-delay). -- `idp_refresh_directory_interval`: replaced by [Polling Max Delay](/docs/reference/identity-provider-settings#identity-provider-polling-minmax-delay). -- `idp_qps`: not required, IdP providers adjust their qps rate. - -Pomerium Core would only perform user authentication and session refresh with the IdP provider, and would not try to synchronize user details and groups, which is now part of [External Data Sources](/docs/capabilities/integrations/). - -![idp_enterprise](../enterprise/img/upgrading/policy_groups_enterprise.png) - -## 0.19.0 - -### No changes required to upgrade - -- This release has no breaking changes. Review the [v19 Changelog](/docs/core/changelog#v0190-2022-09-01) for more information. - -## 0.18.0 - -### No changes required to upgrade - -- This release has no breaking changes. Review the [v18 Changelog](/docs/core/changelog#v0180-2022-07-27) for more information. - -## 0.17.0 - -### New - -#### Per Route OIDC Credentials - -This release of Pomerium adds the ability to bind a route to unique OIDC credentials. This allows Identity Provider administrators to view Pomerium protected applications individually rather than as a single shared application. - -See [idp_client_id](/docs/reference/routes/identity-provider-client-id-per-route) and [idp_client_secret](/docs/reference/routes/identity-provider-client-secret-per-route) for configuration details. - -#### Updated User Info Page - -The `.pomerium` user info page has been redesigned to better structure data around user identity, group, and device information. - -#### External Google Groups - -Pomerium policy now supports group members from outside of your organization. - -## 0.16.0 - -### New - -#### Policy for Device Identity - -This release of Pomerium adds the ability to set policy based on system registration via [WebAuthN](https://en.wikipedia.org/wiki/WebAuthn). - -See [Device Identity](/docs/concepts/device-identity) for more details. - -#### HTTP PPL Criteria - -`http_path` and `http_method` are now supported for matching HTTP requests in policies. See [Pomerium Policy Language](/docs/capabilities/ppl#criteria) for more details. - -### Breaking - -#### Self-signed fallback certificates - -When selecting a TLS certificate for a listener, Pomerium attempts to locate one by iterating through the provided certs and searching for a SAN match. This applies to all listeners, including internal service URLs like `databroker_service_url` and public endpoints like `authenticate.example.com`. - -Previously, when no match was found, Pomerium would select the "first" certificate in the list. However, the definition of "first" might change based on runtime configuration, so the certificate selection was non-deterministic. - -Starting in v0.16, Pomerium will instead generate a self-signed certificate if it cannot locate an appropriate certificate from the provided configuration or system key/trust store. If you discover that you are receiving a self-signed certificate rather than a certificate from [`certificate`/`certificates`/`certificate_file`](/docs/reference/certificates) or the trust store, you have a mismatch between your service URL and the names covered in your certificates. - -#### OIDC flow no longer sets default uri params - -Previously, Pomerium would default to setting the uri param `access_type` to `offline` for all OpenID Connect based identity providers. However, using uri params to ensure offline access (e.g. `refresh_tokens` used to keep user's sessions alive) [is unique to Google](https://developers.google.com/identity/protocols/oauth2/web-server#offline). Those query params will now only be set for Google. Other OIDC based IdP's should continue to work using [OIDC's](https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess) `offline_access` scope. - -#### Removed options - -The deprecated `headers` option has been removed. Use [`set_response_headers`](/docs/reference/set-response-headers) instead. - -The `signing_key_algorithm` option has been removed and will now be inferred from `signing_key`. - -#### Changed GitHub Team IDs - -To improve performance, IdP directory synchronization for GitHub now uses the GraphQL API. This API returns the same information as the REST API, except that the GraphQL node IDs are different. Where we previously used the team integer ID from the REST API, we now use the team slug instead. Most policies should already use the team slug for group based rules, which should continue to work. However, if the integer ID is used it will no longer work. Update those policies to use the team slug instead. - -#### CLI Source and Packaging Update - -`pomerium-cli` has been factored out of the core repository and now resides at [https://github.com/pomerium/cli](https://github.com/pomerium/cli). If you currently install the CLI tool from [Packages](/docs/clients/pomerium-cli#packages) or [Homebrew](/docs/clients/pomerium-cli#homebrew), no changes should be required to your process. However, users of docker images or direct github release downloads will need to update their references. - -Please see the [updated install instructions](/docs/clients/pomerium-cli) for additional details. - -## 0.15.0 - -### Breaking - -#### Removed options - -The unused `grpc_server_max_connection_age`, `grpc_server_max_connection_age_grace` and `refresh_cooldown` options were removed. - -#### Removed support for Ed25519 Signing Keys - -Ed25519 is no longer supported for `signing_key` since OPA Rego only supports ECDSA and RSA. - -### New - -#### Updated and expanded policy syntax - -Routes and policies may now be configured under a new top level key - `routes` - -- This more closely aligns to how policies and routes are conceptually related -- The `routes` block supports a more powerful syntax for defining policies with conditionals and various criteria - -#### Support environmental proxy settings - -`pomerium-cli` now respects proxy related environmental variables. - -## 0.14.0 - -### New - -#### Ping Identity - -[Ping Identity](https://www.pingidentity.com/) is supported as a directory provider. See [the documentation](https://www.pomerium.com/docs/identity-providers/ping.html) for details. - -#### Customized Identity Headers - -With the v0.14 release, the names of `X-Pomerium-Claim-{Name}` headers can now be [customized](https://www.pomerium.com/reference/#jwt-claim-headers). This enables broader 3rd party application support for Pomerium's identity headers. - -#### Redis High Availability - -Databroker now supports redis [sentinel](https://redis.io/topics/sentinel) and [cluster](https://redis.io/topics/cluster-spec) for increased availability. See the databroker [documentation](https://www.pomerium.com/reference/#data-broker-storage-connection-string) for details. - -#### Rewrite Response Headers - -Policies may now [rewrite response headers](https://www.pomerium.com/reference/#rewrite-response-headers) from upstream services. This can be especially useful when upstream servers attempt to redirect users to unreachable internal host names. - -### Breaking - -#### Programmatic login domain whitelist - -Programmatic login now restricts the allowed redirect URL domains. By default this is set to `localhost`, but can be changed via the `programmatic_redirect_domain_whitelist` option. - -#### `allowed_users` ID format - -When specifying `allowed_users` by ID, the identity provider is no longer part of the ID format. This does not impact users specified by e-mail. - -To update your policies for v0.14, please remove any identity provider prefix. Example: `okta/00usi7mc8XC8SwFxT4x6` becomes `00usi7mc8XC8SwFxT4x6`. - -## 0.13.0 - -### New - -#### Upstream load balancing - -With the v0.13 release, routes may contain [multiple `to` URLs](/docs/reference/routes/to), and Pomerium will load balance between the endpoints. This allows Pomerium to fill the role of an edge proxy without the need for additional HTTP load balancers. - -- Active [health checks](/docs/reference/routes/load-balancing#health-checks) and passive [outlier detection](/docs/reference/routes/outlier-detection) -- Configurable [load balancing policies](/docs/reference/routes/load-balancing#load-balancing-policy) -- Configurable [load balancing weight](/docs/reference/routes/to) - -See [Load Balancing](/docs/capabilities/load-balancing) for more information on using this feature set. - -#### Dynamic certificate updates - -With the v0.13 release, all TLS files referenced from Pomerium's configuration are reloaded automatically when updating. This improves availability in environments which automate short lived TLS certificate rotation via [certbot](https://certbot.eff.org/) or similar tools. - -#### Proxy Protocol support - -The Pomerium HTTP listener now [supports](/docs/reference/use-proxy-protocol) HAPROXY's [proxy protocol](https://www.haproxy.org/download/1.9/doc/proxy-protocol.txt) to update `X-Forwarded-For` accurately when behind another proxy service. - -### Breaking - -#### Sign-out endpoint requires CSRF Token - -The frontchannel-logout endpoint will now require a CSRF token for both `GET` and `POST` requests. - -#### User impersonation removed - -Prior to the v0.13 release, it was possible for an administrative user to temporarily impersonate another user. This was done by adding an additional set of claims to that user's session token. Having additional identity state stored client-side significantly expands the attack surface of Pomerium and complicates policy enforcement by having multiple sources of truth for identity. User impersonation was removed from Pomerium Core to shrink that attack surface and simplify policy enforcement. Pomerium now stores all identity state server-side and encrypted in the databroker. - -Pomerium Enterprise customers can still impersonate users with Service Accounts and the web interface. See the [Management API](/docs/capabilities/enterprise-api#create-a-service-account) and [Service Accounts](/docs/capabilities/service-accounts) capabilities pages for more information on impersonating users with Service Accounts. - -#### Client-side service accounts removed - -Prior to the v0.13 release, it was possible to create service accounts via Pomerium's CLI tool. These service accounts were signed with Pomerium's shared secret key. As with user impersonation, having session state stored client-side significantly expands the attack surface of Pomerium and complicates policy enforcement. Client side service accounts were removed to shrink that attack surface area, and to simplify policy enforcement. - -#### Administrators option removed - -The `administrators` configuration option has been removed. - -## 0.12.0 - -### New - -#### TCP Proxying - -Pomerium can now be used for non-HTTP services. See [documentation](/docs/capabilities/tcp) for more details. - -#### Datadog Tracing - -Datadog has been added as a natively supported [tracing backend](/docs/reference/tracing#datadog) - -## 0.11.0 - -### Breaking - -#### User impersonation disabled by default - -With the v0.11.0 release, the ability to do user user impersonation is **disabled by default**. To enable user impersonation, set `enable_user_impersonation` to true in the configuration options. - -#### `cache_service_url` has been renamed to `databroker_service_url` - -The `cache_service_url` parameter has been deprecated since v0.10.0 and is now removed. Please replace it with `databroker_service_url` in your yaml configuration, or `DATABROKER_SERVICE_URL` as an environment variable. - -### New - -#### Docker Multi-Arch Images - -With the v0.11.0 release, Pomerium docker images are multi-arch for `arm64` and `amd64`. Individual images for each architecture will continue to be published. - -## 0.10.0 - -### Breaking - -#### Service accounts required for groups and directory data - -With the v0.10.0 release, Pomerium now queries group information asynchronously using a service account. While a service account was already required for a few identity providers like Google's GSuite, an Identity Provider Service Account is now required for all other providers as well. The format of this field varies and is specified in each identity provider's documentation. - -:::warning - -If no Identity Provider Service Account is supplied, policies using groups (e.g. `allowed_groups` will not work). - -::: - -#### Cache service builds stateful context - -With the v0.10 release, Pomerium now asynchronously fetches associated authorization context (e.g. identity provider directory context, groups, user-data, session data, etc) in the `cache` service. In previous versions, Pomerium used session cookies to associated identity state which authorization policy was evaluated against. While using session tokens had the advantage of making Pomerium a relatively stateless application, that approach has many shortcomings which is more extensively covered in the [data storage docs](/docs/internals/data-storage). - -There are two [storage backend types] available: `memory` or `redis`. You can see the existing [storage backend configuration settings in the docs][cache service docs]. - -#### Memory Storage Backend - -For `memory` storage, restarting the cache service will result in all users having to re-login. Code for the in-memory database used by the cache service can be found here: [internal/databroker/memory](https://github.com/pomerium/pomerium/tree/main/internal/databroker/memory). - -:::warning - -Running more than one instance of the `memory` type cache service is not supported. - -::: - -#### Redis Storage Backend - -In production deployments, we recommend using the `redis` storage backend. Unlike the `memory` backend, `redis` can be used for persistent data. - -#### Implementing your own storage backend - -Please see the following interfaces for reference to implement your storage backend interface. - -- [databroker gRPC interface](https://github.com/pomerium/pomerium/blob/main/pkg/grpc/databroker/databroker.proto) -- [storage backend interface](https://github.com/pomerium/pomerium/blob/main/pkg/storage/storage.go) - -### Identity headers - -With this release, pomerium will not insert identity headers (X-Pomerium-Jwt-Assertion/X-Pomerium-Claim-\*) by default. To get pre 0.9.0 behavior, you can set `pass_identity_headers` to true on a per-policy basis. - -## 0.9.0 - -### Breaking - -#### Default log level - -With this release, default log level has been changed to INFO. - -#### HTTP 1.0 - -HTTP 1.0 (not to be confused with HTTP 1.1) is not supported anymore. If you relied on it make sure to upgrade to HTTP 1.1 or higher. - -Example for HAProxy health check, in pre `0.9.0`: - -```sh -shell script option httpchk GET /ping -``` - -In `0.9.0`: - -```sh -option httpchk GET /ping HTTP/1.1\r\nHost:pomerium -``` - -#### `preserve_host_header` option - -With this release, Pomerium uses an embedded envoy proxy instead hand-written one. Thus, we defer the preserve host header functionality to [envoys auto_host_rewrite](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-field-config-route-v3-routeaction-auto-host-rewrite), which does not affect if the policy routes to a static IP. - -To preserve 0.8.x behavior, you can use the `set_request_headers` option to explicitly set the Host header. - -#### Unsupported platforms - -- With this release we now use an embedded [envoy](https://www.envoyproxy.io/) binary as our proxy server. Due to this change we now only build and support Linux and MacOS binaries with the AMD64 architecture. We plan on supporting more platforms and architectures in future releases. - -#### Observability - -- The `service` label on metrics and tracing no longer reflects the `Services` configuration option directly. `pomerium` will be used for all-in-one mode, and `pomerium-[service]` will be used for distributed services - -#### Tracing - -- Jaeger tracing support is no longer end-to-end in the Proxy service. We recommend updating to the Zipkin provider for proper tracing support. Jaeger will continue to work but will not have coverage in the data plane. -- Option `tracing_debug` is no longer supported. Use `tracing_sampling_rate` instead. [Details](/docs/reference/tracing#shared-tracing-settings). - -#### Metrics - -With this release we now use an embedded [envoy](https://www.envoyproxy.io/) binary as our proxy server. - -- Due to this change, data plane metric names and labels have changed to adopt envoy's internal data model. [Details](https://www.pomerium.io/configuration/#envoy-proxy-metrics) - -## 0.8.0 - -### Breaking - -#### Using paths in from URLs - -Although it's unlikely anyone ever used it, prior to 0.8.0 the policy configuration allowed you to specify a `from` field with a path component: - -```yaml -policy: - - from: 'https://example.com/some/path' -``` - -The proxy and authorization server would simply ignore the path and route/authorize based on the host name. - -With the introduction of `prefix`, `path` and `regex` fields to the policy route configuration, we decided not to support using a path in the `from` url, since the behavior was somewhat ambiguous and better handled by the explicit fields. - -To avoid future confusion, the application will now declare any configuration which contains a `from` field with a path as invalid, with this error message: - -``` -config: policy source url (%s) contains a path, but it should be set using the path field instead -``` - -If you see this error you can fix it by simply removing the path from the `from` field and moving it to a `prefix` field. - -In other words, this configuration: - -```yaml -policy: - - from: 'http://example.com/some/path' -``` - -Should be written like this: - -```yaml -policy: - - from: 'http://example.com' - prefix: '/some/path' -``` - -## 0.7.0 - -### Breaking - -#### Getting user's identity - -:::warning - -This changed was partially reverted in v0.7.2\. Session details like `user`, `email`, and `groups` can still be explicitly extracted by setting the [jwt_claims_header](/docs/reference/jwt-claim-headers) configuration option. - -::: - -User detail headers ( `x-pomerium-authenticated-user-id` / `x-pomerium-authenticated-user-email` / `x-pomerium-authenticated-user-groups`) have been removed in favor of using the more secure, more data rich attestation jwt header (`x-pomerium-jwt-assertion`). - -If you still rely on individual claim headers, please see the `jwt_claims_headers` option [here](https://www.pomerium.io/configuration/#jwt-claim-headers). - -#### Non-standard port users - -Non-standard port users (e.g. those not using `443`/`80` where the port _would_ be part of the client's request) will have to clear their user's session before upgrading. Starting with version v0.7.0, audience (`aud`) and issuer (`iss`) claims will be port specific. - -## 0.6.0 - -### Breaking - -#### New cache service - -A back-end cache service was added to support session refreshing from [single-page-apps](https://en.wikipedia.org/wiki/Single-page_application). - -- For all-in-one deployments, _no changes are required_. The cache will be embedded in the binary. By default, autocache an in-memory LRU cache will be used to temporarily store user session data. If you wish to persist session data, it's also possible to use bolt or redis. -- For split-service deployments, you will need to deploy an additional service called cache. By default, pomerium will use autocache as a distributed, automatically managed cache. It is also possible to use redis as backend in this mode. - -For a concrete example of the required changes, consider the following changes for those running split service mode,: - -```diff -... - pomerium-authenticate: - environment: - - SERVICES=authenticate -+ - CACHE_SERVICE_URL=http://pomerium-cache:443 -... -+ pomerium-cache: -+ image: pomerium/pomerium -+ environment: -+ - SERVICES=cache -+ volumes: -+ - .config/config.example.yaml:/pomerium/config.yaml:ro -+ expose: -+ - 443 -``` - -Please see the updated examples, and [cache service docs] as a reference and for the available cache stores. For more details as to why this was necessary, please see [PR438](https://github.com/pomerium/pomerium/pull/438) and [PR457](https://github.com/pomerium/pomerium/pull/457). - -## Since 0.5.0 - -### Breaking - -#### Subdomain requirement dropped - -- Pomerium services and managed routes are no longer required to be on the same domain-tree root. Access can be delegated to any route, on any domain (that you have access to, of course). - -#### Azure AD - -- Azure Active Directory now uses the globally unique and immutable`ID` instead of `group name` to attest a user's [group membership](https://docs.microsoft.com/en-us/graph/api/group-get?view=graph-rest-1.0&tabs=http). Please update your policies to use group `ID` instead of group name. - -#### Okta - -- Okta no longer uses tokens to retrieve group membership. [Group membership](https://developer.okta.com/docs/reference/api/groups/) is now fetched using Okta's API. -- Okta's group membership is now determined by the globally unique and immutable ID field. Please update your policies to use group `ID` instead of group name. -- Okta now requires an additional set of credentials to be used to query for group membership set as a service account. - -#### OneLogin - -- OneLogin [group membership](https://developers.onelogin.com/openid-connect/api/user-info) is now determined by the globally unique and immutable ID field. Please update your policies to use group `ID` instead of group name. - -#### Force Refresh Removed - -Force refresh has been removed from the dashboard. Logging out and back in again should have the equivalent desired effect. - -#### Programmatic Access API changed - -Previous programmatic authentication endpoints (`/api/v1/token`) has been removed and has been replaced by a per-route, oauth2 based auth flow. Please see updated [programmatic documentation](/docs/capabilities/programmatic-access) how to use the new programmatic access api. - -#### Forward-auth route change - -Previously, routes were verified by taking the downstream applications hostname in the form of a path `(e.g. ${forwardauth}/.pomerium/verify/verify.some.example`) variable. The new method for verifying a route using forward authentication is to pass the entire requested url in the form of a query string `(e.g. ${forwardauth}/.pomerium/verify?url=https://verify.some.example)` where the routed domain is the value of the `uri` key. - -Note that the verification URL is no longer nested under the `.pomerium` endpoint. - -For example, in nginx this would look like: - -```diff -- nginx.ingress.kubernetes.io/auth-url: https://forwardauth.corp.example.com/.pomerium/verify/verify.corp.example.com?no_redirect=true -- nginx.ingress.kubernetes.io/auth-signin: https://forwardauth.corp.example.com/.pomerium/verify/verify.corp.example.com -+ nginx.ingress.kubernetes.io/auth-url: https://forwardauth.corp.example.com/verify?uri=$scheme://$host$request_uri -+ nginx.ingress.kubernetes.io/auth-signin: https://forwardauth.corp.example.com?uri=$scheme://$host$request_uri -``` - -## 0.4.0 - -### Breaking - -#### Authorize Service URL no longer used in all-in-one mode - -Pomerium no longer handles both gRPC and HTTPS traffic from the same network listener (port). As a result, all-in-one mode configurations will default to serving gRPC traffic over loopback on port `5443` and will serve HTTPS traffic as before on port `443`. In previous versions, it was recommended to configure authorize in this mode which will now break. The error will typically look something like: - -``` -rpc error: code = DeadlineExceeded desc = latest connection error: connection closed -``` - -To upgrade, simply remove the `AUTHORIZE_SERVICE_URL` setting. - -#### Removed Authenticate Internal URL - -The authenticate service no longer uses gRPC to do back channel communication. As a result, `AUTHENTICATE_INTERNAL_URL`/`authenticate_internal_url` is no longer required. - -#### No default certificate location - -In previous versions, if no explicit certificate pair (in base64 or file form) was set, Pomerium would make a last ditch effort to check for certificate files (`cert.key`/`privkey.pem`) in the root directory. With the introduction of insecure server configuration, we've removed that functionality. If there settings for certificates and insecure server mode are unset, pomerium will give a appropriate error instead of a failed to find/open certificate error. - -#### Authorize service health-check is non-http - -The Authorize service will no longer respond to `HTTP`-based healthcheck queries when run as a distinct service (vs all-in-one). As an alternative, you can used on TCP based checks. For example, if using [Kubernetes](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-a-tcp-liveness-probe): - -```yaml ---- -readinessProbe: - tcpSocket: - port: 443 - initialDelaySeconds: 5 - periodSeconds: 10 -livenessProbe: - tcpSocket: - port: 443 - initialDelaySeconds: 15 - periodSeconds: 20 -``` - -### Non-breaking changes - -#### All-in-one - -If service mode (`SERVICES`/`services`) is set to `all`, gRPC communication with the Authorize service will by default occur over localhost, on port `:5443`. - -## 0.3.0 - -Pomerium `v0.3.0` has no known breaking changes compared to `v0.2.0`. - -## 0.2.0 - -Pomerium `v0.2.0` has no known breaking changes compared to `v0.1.0`. - -## 0.1.0 - -This page contains the list of deprecations and important or breaking changes for pomerium `v0.1.0` compared to `v0.0.5`. Please read it carefully. - -### Semantic versioning changes - -Starting with `v0.1.0` we've changed our [releases](https://semver.org/) are versioned (`MAJOR.MINOR.PATCH+GITHASH`). Planned, monthly releases will now bump `MINOR` and any security or stability releases required prior will bump `PATCH`. - -Please note however that we are still pre `1.0.0` so breaking changes can and will happen at any release though we will do our best to document them. - -### Breaking: Policy must be valid URLs - -Previously, it was allowable to define a policy without a schema (e.g. `http`/`https`). Starting with version `v0.1.0` all `to` and `from` [policy] URLS must contain valid schema and host-names. For example: - -```yaml -policy: - - from: verify.corp.domain.example - to: http://verify - allowed_domains: - - pomerium.io - - from: external-verify.corp.domain.example - to: https://verify.pomerium.com - allow_public_unauthenticated_access: true -``` - -Should now be: - -```yaml -policy: - - from: https://verify.corp.domain.example - to: http://verify - allowed_domains: - - pomerium.io - - from: https://external-verify.corp.domain.example - to: https://verify.pomerium.com - allow_public_unauthenticated_access: true -``` - -## 0.0.5 - -This page contains the list of deprecations and important or breaking changes for pomerium `v0.0.5` compared to `v0.0.4`. Please read it carefully. - -### Breaking: POLICY_FILE removed - -Usage of the POLICY_FILE envvar is no longer supported. Support for file based policy configuration has been shifted into the new unified config file. - -### Important: Configuration file support added - -- Pomerium now supports an optional -config flag. This flag specifies a file from which to read all configuration options. It supports yaml, json, toml and properties formats. -- All options which can be specified via MY_SETTING style envvars can now be specified within your configuration file as key/value. The key is generally the same as the envvar name, but lower cased. See Reference Documentation for exact names. -- Options precedence is `environmental variables` > `configuration file` > `defaults` -- The options file supports a policy key, which contains policy in the same format as `POLICY_FILE`. To convert an existing policy.yaml into a config.yaml, just move your policy under a policy key. - - Old: - - ```yaml - - from: verify.localhost.pomerium.io - to: http://verify - allowed_domains: - - pomerium.io - cors_allow_preflight: true - timeout: 30s - ``` - - New: - - ```yaml - policy: - - from: verify.localhost.pomerium.io - to: http://verify - allowed_domains: - - pomerium.io - cors_allow_preflight: true - timeout: 30s - ``` - -### Authenticate Internal Service Address - -The configuration variable [Authenticate Internal Service URL] must now be a valid [URL](https://golang.org/pkg/net/url/#URL) type and contain both a hostname and valid `https` schema. - -[authenticate internal service url]: /docs/reference/service-urls#authenticate-service-url -[cache service docs]: /docs/reference/databroker -[policy]: /docs/reference/routes/policy -[storage backend configuration here]: /docs/reference/databroker -[storage backend types]: /docs/reference/databroker diff --git a/content/docs/courses.mdx b/content/docs/courses.mdx index b4c79674e..7f9b2f09e 100644 --- a/content/docs/courses.mdx +++ b/content/docs/courses.mdx @@ -11,6 +11,6 @@ description: Welcome to Pomerium Fundamentals, a series of courses designed to t We'll cover routing, policies, TLS certificates, identity verification, and more. -To get started, complete the [**Quickstart guide**](/docs/quickstart) first. +To get started, complete the [**Quickstart guide**](/docs/get-started/quickstart) first. -When you're finished, learn how to [**Build Routes**](/docs/courses/fundamentals/zero-build-routes.mdx) in Pomerium Zero. +When you're finished, learn how to [**Build Routes**](/docs/get-started/fundamentals/zero/zero-build-routes.mdx) in Pomerium Zero. diff --git a/content/docs/courses/fundamentals/_category_.json b/content/docs/courses/fundamentals/_category_.json deleted file mode 100644 index 3d3a48f26..000000000 --- a/content/docs/courses/fundamentals/_category_.json +++ /dev/null @@ -1,3 +0,0 @@ -{ - "label": "Fundamentals" -} diff --git a/content/docs/courses/fundamentals/img/advanced-routes/httpbin-jwt-claims-headers.png b/content/docs/courses/fundamentals/img/advanced-routes/httpbin-jwt-claims-headers.png deleted file mode 100644 index 691e2654c..000000000 Binary files a/content/docs/courses/fundamentals/img/advanced-routes/httpbin-jwt-claims-headers.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/advanced-routes/node-admin-only.png b/content/docs/courses/fundamentals/img/advanced-routes/node-admin-only.png deleted file mode 100644 index 8521af43a..000000000 Binary files a/content/docs/courses/fundamentals/img/advanced-routes/node-admin-only.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/advanced-routes/node-hello-world.png b/content/docs/courses/fundamentals/img/advanced-routes/node-hello-world.png deleted file mode 100644 index a11d83396..000000000 Binary files a/content/docs/courses/fundamentals/img/advanced-routes/node-hello-world.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/advanced-routes/response-header.png b/content/docs/courses/fundamentals/img/advanced-routes/response-header.png deleted file mode 100644 index e53acb4cf..000000000 Binary files a/content/docs/courses/fundamentals/img/advanced-routes/response-header.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/build-routes/grafana-login-screen.png b/content/docs/courses/fundamentals/img/build-routes/grafana-login-screen.png deleted file mode 100644 index 90f30458f..000000000 Binary files a/content/docs/courses/fundamentals/img/build-routes/grafana-login-screen.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/get-started/pomerium-file-structure.png b/content/docs/courses/fundamentals/img/get-started/pomerium-file-structure.png deleted file mode 100644 index 0e39f4580..000000000 Binary files a/content/docs/courses/fundamentals/img/get-started/pomerium-file-structure.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/get-started/verify-state.png b/content/docs/courses/fundamentals/img/get-started/verify-state.png deleted file mode 100644 index dc1035afe..000000000 Binary files a/content/docs/courses/fundamentals/img/get-started/verify-state.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/jwt-verification/00-root-project-files.png b/content/docs/courses/fundamentals/img/jwt-verification/00-root-project-files.png deleted file mode 100644 index ffea3fe8c..000000000 Binary files a/content/docs/courses/fundamentals/img/jwt-verification/00-root-project-files.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/jwt-verification/01-jwt-claims.png b/content/docs/courses/fundamentals/img/jwt-verification/01-jwt-claims.png deleted file mode 100644 index 1cf97ea2d..000000000 Binary files a/content/docs/courses/fundamentals/img/jwt-verification/01-jwt-claims.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/jwt-verification/02-jwt-payload.png b/content/docs/courses/fundamentals/img/jwt-verification/02-jwt-payload.png deleted file mode 100644 index 6842dbe71..000000000 Binary files a/content/docs/courses/fundamentals/img/jwt-verification/02-jwt-payload.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/jwt-verification/03-jwt-decoded.png b/content/docs/courses/fundamentals/img/jwt-verification/03-jwt-decoded.png deleted file mode 100644 index 8be315da6..000000000 Binary files a/content/docs/courses/fundamentals/img/jwt-verification/03-jwt-decoded.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/jwt-verification/04-jwt-signature-verified.png b/content/docs/courses/fundamentals/img/jwt-verification/04-jwt-signature-verified.png deleted file mode 100644 index ff65f2d80..000000000 Binary files a/content/docs/courses/fundamentals/img/jwt-verification/04-jwt-signature-verified.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/production-certificates/autocert-certificate.png b/content/docs/courses/fundamentals/img/production-certificates/autocert-certificate.png deleted file mode 100644 index 2cf177bd2..000000000 Binary files a/content/docs/courses/fundamentals/img/production-certificates/autocert-certificate.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/self-hosted-pomerium/user-details-page.png b/content/docs/courses/fundamentals/img/self-hosted-pomerium/user-details-page.png deleted file mode 100644 index e2d93847b..000000000 Binary files a/content/docs/courses/fundamentals/img/self-hosted-pomerium/user-details-page.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-advanced-policies/change-and-to-or-operator.gif b/content/docs/courses/fundamentals/img/zero-advanced-policies/change-and-to-or-operator.gif deleted file mode 100644 index cc0bcf5ff..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-advanced-policies/change-and-to-or-operator.gif and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-advanced-policies/email-allowlist.png b/content/docs/courses/fundamentals/img/zero-advanced-policies/email-allowlist.png deleted file mode 100644 index 6bc858c5a..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-advanced-policies/email-allowlist.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-advanced-policies/email-claim.png b/content/docs/courses/fundamentals/img/zero-advanced-policies/email-claim.png deleted file mode 100644 index c8b0dc728..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-advanced-policies/email-claim.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-advanced-policies/matching-domain.png b/content/docs/courses/fundamentals/img/zero-advanced-policies/matching-domain.png deleted file mode 100644 index 0386be18e..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-advanced-policies/matching-domain.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-advanced-policies/multiple-deny-blocks.png b/content/docs/courses/fundamentals/img/zero-advanced-policies/multiple-deny-blocks.png deleted file mode 100644 index 706f6b501..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-advanced-policies/multiple-deny-blocks.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-advanced-policies/multiple-policies.png b/content/docs/courses/fundamentals/img/zero-advanced-policies/multiple-policies.png deleted file mode 100644 index 0a87ab26c..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-advanced-policies/multiple-policies.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-advanced-policies/user-data.png b/content/docs/courses/fundamentals/img/zero-advanced-policies/user-data.png deleted file mode 100644 index 3f93fdb45..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-advanced-policies/user-data.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/add-redirects-in-zero-console.png b/content/docs/courses/fundamentals/img/zero-advanced-routes/add-redirects-in-zero-console.png deleted file mode 100644 index 92b17f5c0..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/add-redirects-in-zero-console.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/host-rewrite-to-literal-value.png b/content/docs/courses/fundamentals/img/zero-advanced-routes/host-rewrite-to-literal-value.png deleted file mode 100644 index 10b675323..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/host-rewrite-to-literal-value.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/jwt-assertion-header.png b/content/docs/courses/fundamentals/img/zero-advanced-routes/jwt-assertion-header.png deleted file mode 100644 index 088008e9f..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/jwt-assertion-header.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/jwt-claim-headers.png b/content/docs/courses/fundamentals/img/zero-advanced-routes/jwt-claim-headers.png deleted file mode 100644 index 1f8fdf8ae..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/jwt-claim-headers.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/jwt-claims-response.png b/content/docs/courses/fundamentals/img/zero-advanced-routes/jwt-claims-response.png deleted file mode 100644 index b6e4a5923..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/jwt-claims-response.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/node-server-route.png b/content/docs/courses/fundamentals/img/zero-advanced-routes/node-server-route.png deleted file mode 100644 index 4b50d7d69..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/node-server-route.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/nodeserver-prefix-rewrite-setting.gif b/content/docs/courses/fundamentals/img/zero-advanced-routes/nodeserver-prefix-rewrite-setting.gif deleted file mode 100644 index aa2178d9e..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/nodeserver-prefix-rewrite-setting.gif and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/nodeserver-prefix-setting.gif b/content/docs/courses/fundamentals/img/zero-advanced-routes/nodeserver-prefix-setting.gif deleted file mode 100644 index 1e2b9fa8e..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/nodeserver-prefix-setting.gif and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/pz-redirect.gif b/content/docs/courses/fundamentals/img/zero-advanced-routes/pz-redirect.gif deleted file mode 100644 index 8230462ae..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/pz-redirect.gif and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/server-endpoints.gif b/content/docs/courses/fundamentals/img/zero-advanced-routes/server-endpoints.gif deleted file mode 100644 index 795cc4912..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/server-endpoints.gif and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/set-and-remove-headers-response-body.png b/content/docs/courses/fundamentals/img/zero-advanced-routes/set-and-remove-headers-response-body.png deleted file mode 100644 index aba9b68b3..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/set-and-remove-headers-response-body.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/set-and-remove-request-headers.png b/content/docs/courses/fundamentals/img/zero-advanced-routes/set-and-remove-request-headers.png deleted file mode 100644 index b82edf367..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/set-and-remove-request-headers.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-idp/idp-flow.gif b/content/docs/courses/fundamentals/img/zero-idp/idp-flow.gif deleted file mode 100644 index 5e6b696d7..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-idp/idp-flow.gif and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-idp/zero-idp-settings.png b/content/docs/courses/fundamentals/img/zero-idp/zero-idp-settings.png deleted file mode 100644 index 84763f2fd..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-idp/zero-idp-settings.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-policies/pz-courses-ppl-editor.png b/content/docs/courses/fundamentals/img/zero-policies/pz-courses-ppl-editor.png deleted file mode 100644 index 953e669bb..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-policies/pz-courses-ppl-editor.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-policies/pz-courses-ppl-example-1.png b/content/docs/courses/fundamentals/img/zero-policies/pz-courses-ppl-example-1.png deleted file mode 100644 index d38dd0a17..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-policies/pz-courses-ppl-example-1.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-policies/pz-courses-ppl-example-2.png b/content/docs/courses/fundamentals/img/zero-policies/pz-courses-ppl-example-2.png deleted file mode 100644 index fceebdb75..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-policies/pz-courses-ppl-example-2.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-routes/from-and-to-urls.png b/content/docs/courses/fundamentals/img/zero-routes/from-and-to-urls.png deleted file mode 100644 index d362630aa..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-routes/from-and-to-urls.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-routes/pz-courses-first-route.png b/content/docs/courses/fundamentals/img/zero-routes/pz-courses-first-route.png deleted file mode 100644 index 5b2d3e977..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-routes/pz-courses-first-route.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-routes/pz-courses-route-details.png b/content/docs/courses/fundamentals/img/zero-routes/pz-courses-route-details.png deleted file mode 100644 index bb7bf5b43..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-routes/pz-courses-route-details.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-sso/jwt-flow.svg b/content/docs/courses/fundamentals/img/zero-sso/jwt-flow.svg deleted file mode 100644 index 0028bd114..000000000 --- a/content/docs/courses/fundamentals/img/zero-sso/jwt-flow.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/content/docs/courses/fundamentals/img/zero-sso/pz-courses-apply-pass-id-headers.gif b/content/docs/courses/fundamentals/img/zero-sso/pz-courses-apply-pass-id-headers.gif deleted file mode 100644 index d1b0b9c54..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-sso/pz-courses-apply-pass-id-headers.gif and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-sso/pz-courses-jwt-synced.png b/content/docs/courses/fundamentals/img/zero-sso/pz-courses-jwt-synced.png deleted file mode 100644 index 509fe967c..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-sso/pz-courses-jwt-synced.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-tcp/redis-service.png b/content/docs/courses/fundamentals/img/zero-tcp/redis-service.png deleted file mode 100644 index 6663299e9..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-tcp/redis-service.png and /dev/null differ diff --git a/content/docs/courses/fundamentals/img/zero-tcp/ssh-server.png b/content/docs/courses/fundamentals/img/zero-tcp/ssh-server.png deleted file mode 100644 index 36388be52..000000000 Binary files a/content/docs/courses/fundamentals/img/zero-tcp/ssh-server.png and /dev/null differ diff --git a/content/docs/deploy/clients/clients.mdx b/content/docs/deploy/clients/clients.mdx new file mode 100644 index 000000000..cde65ae36 --- /dev/null +++ b/content/docs/deploy/clients/clients.mdx @@ -0,0 +1,442 @@ +--- +description: 'Consolidated guide to installing Pomerium CLI/Desktop and configuring TCP+UDP routes in Pomerium.' +sidebar_label: 'Clients for TCP & UDP' +title: 'Pomerium Clients for Tunneling Non-HTTP Protocols' +keywords: + [ + pomerium, + tcp, + udp, + connect, + connect-udp, + non-http, + identity access proxy, + zero trust, + cli, + desktop, + rdp, + ssh, + database, + redis, + mysql, + dns, + bastion, + policy, + ] +lang: en-US +--- + +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; +import LongLivedConnections from '@site/content/docs/admonitions/_long-lived-connections.mdx'; + +# Pomerium Clients for Tunneling Non-HTTP Protocols + +Pomerium can secure non-HTTP protocols such as SSH, RDP, MySQL, Redis, or DNS with the same identity-aware policy enforcement used for HTTP. This document merges several references to provide a comprehensive guide covering: + +- **TCP Over HTTP** and **UDP Over HTTP** capabilities +- How to configure **routes** for TCP and UDP +- **Pomerium CLI** and **Desktop** usage and installation details +- Advanced configurations, best practices, and enterprise considerations + + + +Pomerium's non-HTTP proxying allows you to secure SSH, MySQL, DNS, or any other TCP/UDP-based service behind Pomerium's identity-aware access control. When a user connects through **Pomerium CLI** or **Pomerium Desktop**, they: + +1. Are redirected to the IdP to authenticate (if they aren't already). +2. Receive an authorized tunnel for the requested port/protocol. +3. Enjoy zero trust-style security without needing a separate VPN or dedicated tunnels. + +### Why Use Pomerium for TCP and UDP? + +- **Single Sign-On (SSO)**: Unified authentication with your existing IdP. +- **Granular Authorization**: Leverage Pomerium's policies (e.g. allow by email, group membership). +- **Audit & Visibility**: Centralize logs and control for non-HTTP traffic. +- **Consistent Security**: Enforce the same policies for both HTTP and non-HTTP connections. + +## Install Pomerium CLI and Desktop + +Pomerium offers a command-line interface (CLI) and a graphical Desktop client for connecting to non-HTTP routes. + +### CLI Installation + + + + +```bash +ARCH=[your-arch] +OS=[your-os] +VERSION=[desired-version] +curl -L https://github.com/pomerium/cli/releases/download/${VERSION}/pomerium-cli-${OS}-${ARCH}.tar.gz \ + | tar -z -x +``` + +See [GitHub Releases](https://github.com/pomerium/cli/releases) for a full list. + + + + + +Install from [Cloudsmith](https://cloudsmith.io/~pomerium/repos/pomerium/packages/) or GitHub: + +```abnf title="/etc/yum.repos.d/pomerium-cli.repo" +[pomerium-pomerium] +name=pomerium-pomerium +baseurl=https://dl.cloudsmith.io/public/pomerium/pomerium/rpm/el/$releasever/$basearch +repo_gpgcheck=1 +enabled=1 +gpgkey=https://dl.cloudsmith.io/public/pomerium/pomerium/gpg.6E388440B94E1407.key +gpgcheck=1 +sslverify=1 +pkg_gpgcheck=1 +``` + + + + + +```bash +brew tap pomerium/tap +brew install pomerium-cli +``` + + + + + +```bash +docker run pomerium.com/pomerium/cli:latest --version +``` + + + + + +```bash +git clone https://github.com/pomerium/cli.git +cd cli +make build +./bin/pomerium-cli --help +``` + + + + +### Desktop Installation + + + + +Download the `.exe` from [Desktop Releases](https://github.com/pomerium/desktop-client/releases). +Run the installer. Right-click the tray icon to manage connections. + + + + +```bash +brew tap pomerium/tap +brew install pomerium-desktop +``` + +Or download the `.dmg` and drag it into Applications. Interact with it via the menu bar icon. + + + + +Download the `.AppImage` from [Desktop Releases](https://github.com/pomerium/desktop-client/releases). +Execute it in place or use [AppImageLauncher](https://github.com/TheAssassin/AppImageLauncher). Manage connections from the system tray icon. + + + + +## Create TCP Routes + + + +Use `tcp+https://` in the route **From** field and `tcp://` in **To**. Example: + +```yaml +routes: + - from: tcp+https://redis.corp.example.com:6379 + to: tcp://redis.internal.example.com:6379 + policy: + - allow: + or: + - email: + is: contractor@notexample.com + - claim/groups: 'datascience@example.com' +``` + +Points to remember: + +- HTTP-specific settings (like `regex_rewrite_pattern`) do not apply to TCP routes. +- Pomerium encrypts traffic from user to proxy. If you want full end-to-end encryption, ensure the upstream also runs TLS or mTLS. +- The port in **From** (e.g., `:6379`) differentiates multiple routes on the same domain, even though requests typically arrive on port `443`. + + + + +Create a **New Route** and select **TCP**. Fill in **From** (for example, `tcp+https://ssh.example.com:22`) and **To** (`tcp://127.0.0.1:22`), then define policy. Click **Publish** to apply changes. + +![Example TCP route for SSH](./img/tcp-ssh-route.png) + + + + +Set **From** = `tcp+https://`..., define a port (e.g. `:22`). +![Creating a TCP route in the Zero Console](./img/desktop/zero-ssh-route-example.png) + + + + +```yaml +- from: tcp+https://ssh.localhost.pomerium.io:22 + to: tcp://127.0.0.1:22 + policy: + - allow: + or: + - email: + is: user@yourcompany.com +``` + + + + +:::info + +Long-lived + +connections + + +::: + +### Advanced TCP Usage + + + +#### Listen configuration + +When using the CLI, specify `--listen` to set a custom local address/port. If you use `-`, the CLI pipes STDIN/STDOUT directly (useful for `ssh -o ProxyCommand`). + +#### Bastion host style + +If the route is not publicly resolvable or Pomerium is on a non-standard port: + +```yaml +from: tcp+https://proxy.corp.example.com:8443/redis.internal.example.com:6379 +``` + +Then: + +```bash +pomerium-cli tcp tcp+https://proxy.corp.example.com:8443/redis.internal.example.com:6379 +``` + +#### Proxy chaining + +If you want Pomerium to send an HTTP CONNECT to another proxy, use an HTTP scheme in **To**: + +```yaml +routes: + - from: tcp+https://example.corp.com:10002 + to: http://another-proxy.corp.com:10003 +``` + +## Create UDP Routes + +Starting with v0.29, Pomerium supports UDP. Use `udp+https://` in **From** and `udp://` in **To**: + +```yaml +routes: + - from: udp+https://time.corp.example.com:13 + to: udp://time.internal.example.com:13 + policy: + - allow: + or: + - email: + is: contractor@notexample.com + - claim/groups: 'datascience@example.com' +``` + +- `CONNECT-UDP` is used internally, so no HTTP-specific settings apply. +- The port in **From** (e.g. `:13`) is for route selection; inbound traffic is usually on `443`. +- Latency can matter for DNS or real-time apps. Keep Pomerium near users to minimize round-trip times. + +## Connecting via Pomerium CLI + +### TCP Example + +```bash +pomerium-cli tcp ssh.example.com:22 +# listening on 127.0.0.1:52672 +ssh 127.0.0.1 -p 52672 +``` + +Or set your own local port: + +```bash +pomerium-cli tcp ssh.example.com:22 --listen :2222 +ssh 127.0.0.1 -p 2222 +``` + +If you are not logged in yet, your browser opens for IdP authentication. + +#### SSH ProxyCommand + +```bash +ssh -o ProxyCommand='pomerium-cli tcp --listen - %h:%p' ssh.example.com +``` + +### UDP Example + +```bash +pomerium-cli udp dns.example.com:53 +# listening on 127.0.0.1:52544 +dig @127.0.0.1 -p 52544 google.com +``` + +```shell +pomerium-cli tcp [destination] [flags] +``` + +### Flags + +| Flags | Description | Type | +| :-- | :-- | --- | +| #--alternate-ca-path | Path to CA certificate to use for HTTP requests. | string | +| #--browser-cmd | Custom browser command to run when opening a URL. | string | +| #--ca-cert | Path to CA certificate to use for HTTP requests. | string | +| #--client-cert | (optional) PEM-encoded client certificate. | string | +| # --client-key | (optional) PEM-encoded client certificate key. | string | +| # --client-cert-from-store | (optional) If provided, pomerium-cli will attempt to use a client certificate from the system trust store (macOS and Windows only), searching for a certificate based on the trusted CA names advertised by Pomerium in the TLS handshake. | none | +| # --client-cert-issuer | (optional) When used in combination with --client-cert-from-store, restricts the client certificate search based on a particular attribute of the certificate's [Issuer name](#certificate-name-filters). | string | +| # --client-cert-subject | (optional) When used in combination with --client-cert-from-store, restricts the client certificate search based on a particular attribute of the certificate's [Subject name](#certificate-name-filters). | string | +| #--disable-tls-verification | Disables TLS verification. | none | +| #-h, --help | Help for tcp. | none | +| #--listen | Local address to start a listener on (default "127.0.0.1:0"). | string | +| #--pomerium-url | The URL of the Pomerium server to connect to. | string | +| #-v, --version | Version for pomerium-cli. | none | + +#### Certificate name filters + +The certificate name filter syntax is `attribute=value`. A name filter can accept only one name attribute. The value must be an exact match (not a substring match). Make sure to quote name filters as appropriate for your shell. + +For example, `--client-cert-issuer "CN=My Trusted CA"` would filter for a certificate directly issued by a CA with the Common Name "My Trusted CA". + +Or, `--client-cert-subject "OU=My Department"` would filter for a certificate whose Subject name contains the Organizational Unit Name "My Department". + +The supported name attributes are: + +- commonName (CN) +- countryName (C) +- localityName (L) +- organizationName (O) +- organizationalUnitName (OU) +- postalCode +- serialNumber +- stateOrProvinceName (ST) +- streetAddress (STREET) + +Either the long or abbreviated attribute name may be used (for example, `localityName=New York` or `L=New York`). + +Values are case sensitive: `L=new york` will not match the Locality Name "New York". + +### Desktop client steps + +If you haven't, install [Pomerium Desktop](/docs/deploy/clients). + +Then, add a connection by filling in the fields defined below: + +- **Name**: A local name for the route +- **Destination**: Matches the [From](/docs/reference/routes/from) value of the route, without the protocol. Always include the port specified in the route, and do not include the `https://` protocol. +- **Local Address**: The local address and port number from which to access the service locally. If left blank, the client will choose a random port to listen to on the loopback address. +- **Tags**: Customizable tags to sort and organize TCP routes + +![Adding a new connection in the Pomerium Desktop client](./img/desktop/desktop-new-connection.png) + +#### Advanced Settings + +- **Pomerium URL**: The Pomerium Proxy service address. This is required if the **Destination URL** can't be resolved from DNS or a local `hosts` entry, or if the Proxy service uses a non-standard port. +- **Disable TLS Verification**: Allows untrusted certificates from the Pomerium gateway +- **Client Certificates**: For routes that enforce [mTLS](/docs/internals/mutual-auth), you can **set a client certificate manually** or automatically [**search the OS certificate store**](/docs/capabilities/non-http#client-certificates) for a trusted certificate (note: macOS and Windows only). + +![Reviewing the Advanced Settings in the Pomerium Desktop client](./img/desktop/advanced-settings.png) + +### Pomerium CLI steps + +If you haven't, install [Pomerium CLI](/docs/deploy/clients). + +Then, connect to a TCP route: + +1. Invoke `pomerium-cli` with the `tcp` option, and provide the route to your service (as defined in [`from`](/docs/reference/routes/from) in your Route specification). + + ```shell-session + $ pomerium-cli tcp ssh.localhost.pomerium.io:22 + 2023/10/02 11:29:22 listening on 127.0.0.1:53656 + ``` + + You can optionally supply an address and/or port to the `listen` flag: + + ```shell-session + $ pomerium-cli tcp ssh.localhost.pomerium.io:22 --listen :2222 + 2023/10/02 11:30:03 listening on [::]:2222 + ``` + +1. Connect to your service using the local address and port specified in the output of `pomerium-cli`: + + ```bash + ssh 127.0.0.1 -p 2222 + ``` + +1. When the connection starts, the CLI will open your browser and direct you to your Identity Provider to authenticate your session. Once authenticated, the connection will continue and you can close the browser window. + +1. In this example, since we are using SSH we can consolidate the TCP and SSH connections into a single command: + + ```bash + ssh -o ProxyCommand='pomerium-cli tcp --listen - %h:%p' ssh.localhost.pomerium.io + ``` + +## Best Practices + +- **mTLS** + If the upstream requires mutual TLS, both CLI and Desktop can supply client certs. +- **Multiple services on one domain** + Use different ports in **From** (e.g. `:22`, `:6379`, `:3306`, `:53`). +- **Performance** + For latency-sensitive protocols (like DNS over UDP), minimize round trips by placing Pomerium near users. +- **Logging and Audit** + Pomerium logs each connection attempt, including identity. This provides an audit trail. +- **Long-lived sessions** + Non-HTTP connections remain open as long as your Pomerium session is valid. + +## Further Reading + +- [TCP Non-HTTP Reference](/docs/capabilities/non-http/tcp) +- [UDP Non-HTTP Reference](/docs/capabilities/non-http/udp) +- [Mutual Authentication](/docs/internals/mutual-auth) +- [CLI Releases](https://github.com/pomerium/cli/releases) +- [Desktop Releases](https://github.com/pomerium/desktop-client/releases) + +Pomerium unifies access for HTTP, TCP, and UDP behind a single identity-based control plane. This gives you SSO, granular authorization, and consistent security logs for all your applications and services, without needing a separate VPN or manual tunnels. diff --git a/content/docs/deploy/clients/img/desktop/advanced-settings.png b/content/docs/deploy/clients/img/desktop/advanced-settings.png new file mode 100644 index 000000000..3a73e16f7 Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/advanced-settings.png differ diff --git a/content/docs/deploy/clients/img/desktop/desktop-new-connection.png b/content/docs/deploy/clients/img/desktop/desktop-new-connection.png new file mode 100644 index 000000000..51d8b9fe0 Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/desktop-new-connection.png differ diff --git a/content/docs/deploy/clients/img/desktop/example-git-connection.png b/content/docs/deploy/clients/img/desktop/example-git-connection.png new file mode 100644 index 000000000..c90001813 Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/example-git-connection.png differ diff --git a/content/docs/deploy/clients/img/desktop/example-mssql-connection.png b/content/docs/deploy/clients/img/desktop/example-mssql-connection.png new file mode 100644 index 000000000..80718a4de Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/example-mssql-connection.png differ diff --git a/content/docs/deploy/clients/img/desktop/example-mysql-connection.png b/content/docs/deploy/clients/img/desktop/example-mysql-connection.png new file mode 100644 index 000000000..44b37363b Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/example-mysql-connection.png differ diff --git a/content/docs/deploy/clients/img/desktop/example-rdp-connection.png b/content/docs/deploy/clients/img/desktop/example-rdp-connection.png new file mode 100644 index 000000000..b140df34e Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/example-rdp-connection.png differ diff --git a/content/docs/deploy/clients/img/desktop/example-redis-connection.png b/content/docs/deploy/clients/img/desktop/example-redis-connection.png new file mode 100644 index 000000000..9801ba477 Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/example-redis-connection.png differ diff --git a/content/docs/deploy/clients/img/desktop/example-ssh-connection.png b/content/docs/deploy/clients/img/desktop/example-ssh-connection.png new file mode 100644 index 000000000..24a867b77 Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/example-ssh-connection.png differ diff --git a/content/docs/deploy/clients/img/desktop/new-ssh-connection.png b/content/docs/deploy/clients/img/desktop/new-ssh-connection.png new file mode 100644 index 000000000..85ec26998 Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/new-ssh-connection.png differ diff --git a/content/docs/deploy/clients/img/desktop/pomerium-desktop-postgres.png b/content/docs/deploy/clients/img/desktop/pomerium-desktop-postgres.png new file mode 100644 index 000000000..8c3084793 Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/pomerium-desktop-postgres.png differ diff --git a/content/docs/deploy/clients/img/desktop/zero-ssh-route-example.png b/content/docs/deploy/clients/img/desktop/zero-ssh-route-example.png new file mode 100644 index 000000000..c77967d23 Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/zero-ssh-route-example.png differ diff --git a/content/docs/deploy/clients/img/tcp-ssh-route.png b/content/docs/deploy/clients/img/tcp-ssh-route.png new file mode 100644 index 000000000..88562a3a3 Binary files /dev/null and b/content/docs/deploy/clients/img/tcp-ssh-route.png differ diff --git a/content/docs/zero/billing.md b/content/docs/deploy/cloud/billing.md similarity index 90% rename from content/docs/zero/billing.md rename to content/docs/deploy/cloud/billing.md index 17af1d3e0..8190eac45 100644 --- a/content/docs/zero/billing.md +++ b/content/docs/deploy/cloud/billing.md @@ -75,9 +75,9 @@ See the [Pricing page](https://www.pomerium.com/pricing) for a thorough breakdow At some point, you may require higher quotas to accommodate your use case. -If you’re using a professional account and you need to increase the quota for a given entity, [contact us](/docs/community). We will increase quotas on an as-needed basis. +If you're using a professional account and you need to increase the quota for a given entity contact us. We will increase quotas on an as-needed basis. -If you’re using a personal account, you must upgrade to increase quotas. +If you're using a personal account, you must upgrade to increase quotas. ## How billing works @@ -150,10 +150,10 @@ Upgrading does not replace your personal account. It creates an additional profe ### Downgrade subscription -You can downgrade your subscription from a Business plan to a Free plan. If you do, you’ll be charged at the end of the billing period for any usage up to the time you downgraded. +You can downgrade your subscription from a Business plan to a Free plan. If you do, you'll be charged at the end of the billing period for any usage up to the time you downgraded. ### Missed payments -If you can’t pay your bill for any reason, your subscription will lapse and Pomerium Zero will switch into read-only mode. In read-only mode, your clusters will continue to work, but you won’t be able to make changes to your configuration. +If you can't pay your bill for any reason, your subscription will lapse and Pomerium Zero will switch into read-only mode. In read-only mode, your clusters will continue to work, but you won't be able to make changes to your configuration. When Pomerium receives full payment for any outstanding bills under your account, you can resume using Pomerium Zero as normal. diff --git a/content/docs/deploy/cloud/img/billing/billing-org-dropdown.png b/content/docs/deploy/cloud/img/billing/billing-org-dropdown.png new file mode 100644 index 000000000..738a7ac71 Binary files /dev/null and b/content/docs/deploy/cloud/img/billing/billing-org-dropdown.png differ diff --git a/content/docs/deploy/cloud/img/billing/zero-pay-wall.png b/content/docs/deploy/cloud/img/billing/zero-pay-wall.png new file mode 100644 index 000000000..8e67f21a2 Binary files /dev/null and b/content/docs/deploy/cloud/img/billing/zero-pay-wall.png differ diff --git a/content/docs/deploy/cloud/img/billing/zero-usage-dash.png b/content/docs/deploy/cloud/img/billing/zero-usage-dash.png new file mode 100644 index 000000000..6e4769d30 Binary files /dev/null and b/content/docs/deploy/cloud/img/billing/zero-usage-dash.png differ diff --git a/content/docs/deploy/cloud/img/core-to-zero/add-cluster.png b/content/docs/deploy/cloud/img/core-to-zero/add-cluster.png new file mode 100644 index 000000000..57afe3c8b Binary files /dev/null and b/content/docs/deploy/cloud/img/core-to-zero/add-cluster.png differ diff --git a/content/docs/deploy/cloud/img/core-to-zero/docker-import-command.png b/content/docs/deploy/cloud/img/core-to-zero/docker-import-command.png new file mode 100644 index 000000000..7958f7e31 Binary files /dev/null and b/content/docs/deploy/cloud/img/core-to-zero/docker-import-command.png differ diff --git a/content/docs/deploy/cloud/img/core-to-zero/import-existing-config-button.png b/content/docs/deploy/cloud/img/core-to-zero/import-existing-config-button.png new file mode 100644 index 000000000..deebd524b Binary files /dev/null and b/content/docs/deploy/cloud/img/core-to-zero/import-existing-config-button.png differ diff --git a/content/docs/deploy/cloud/img/core-to-zero/import-successful.png b/content/docs/deploy/cloud/img/core-to-zero/import-successful.png new file mode 100644 index 000000000..08c650dd0 Binary files /dev/null and b/content/docs/deploy/cloud/img/core-to-zero/import-successful.png differ diff --git a/content/docs/deploy/cloud/img/core-to-zero/import-terminal-command.png b/content/docs/deploy/cloud/img/core-to-zero/import-terminal-command.png new file mode 100644 index 000000000..044d33ba5 Binary files /dev/null and b/content/docs/deploy/cloud/img/core-to-zero/import-terminal-command.png differ diff --git a/content/docs/deploy/cloud/img/core-to-zero/zero-onboarding-import-ui.png b/content/docs/deploy/cloud/img/core-to-zero/zero-onboarding-import-ui.png new file mode 100644 index 000000000..1c0a5ddd1 Binary files /dev/null and b/content/docs/deploy/cloud/img/core-to-zero/zero-onboarding-import-ui.png differ diff --git a/content/docs/zero/import.mdx b/content/docs/deploy/cloud/import.mdx similarity index 98% rename from content/docs/zero/import.mdx rename to content/docs/deploy/cloud/import.mdx index fa7fd9673..ad99158be 100644 --- a/content/docs/zero/import.mdx +++ b/content/docs/deploy/cloud/import.mdx @@ -40,7 +40,7 @@ This guide shows you how to import an existing Core configuration to Pomerium Ze To complete this guide, you need a: - [Pomerium Zero](https://console.pomerium.app/create-account) account -- [Pomerium Core](/docs/core/quickstart) configuration +- [Pomerium Core](/docs/get-started/fundamentals/core/get-started) configuration :::note diff --git a/content/docs/zero/install.mdx b/content/docs/deploy/cloud/install.mdx similarity index 94% rename from content/docs/zero/install.mdx rename to content/docs/deploy/cloud/install.mdx index a7611c819..0914a6112 100644 --- a/content/docs/zero/install.mdx +++ b/content/docs/deploy/cloud/install.mdx @@ -68,7 +68,7 @@ Save the following configuration as `compose.yaml`: ```yaml title="compose.yaml" services: pomerium: - image: pomerium/pomerium:v0.28.0 + image: pomerium/pomerium:latest ports: - 443:443 restart: always @@ -82,7 +82,7 @@ services: aliases: - verify..pomerium.app verify: - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest networks: main: aliases: @@ -137,7 +137,7 @@ helm upgrade pomerium-zero oci://docker.io/pomerium/pomerium-zero \ :::note -In v0.27, we updated the Kubernetes installation manifest to use a Deployment instead of a StatefulSet. Before upgrading, you must remove your existing StatefulSet. See the [v0.27 Upgrade guide](/docs/core/upgrading#upgrading-pomerium-zero-deployments-in-kubernetes) for specific instructions. +In v0.27, we updated the Kubernetes installation manifest to use a Deployment instead of a StatefulSet. Before upgrading, you must remove your existing StatefulSet. See the [v0.27 Upgrade guide](/docs/deploy/upgrading.mdx#upgrading-pomerium-zero-deployments-in-kubernetes) for specific instructions. ::: @@ -156,7 +156,7 @@ To update Pomerium in Docker: ```yaml pomerium: - image: pomerium/pomerium:v0.28.0 + image: pomerium/pomerium:latest ``` 1. Run the following command: @@ -168,7 +168,7 @@ $ docker compose up -d Docker should automatically pull the new image of Pomerium before running the container. If for some reason Docker doesn't pull the image, you can manually run: ```bash -$ docker pull pomerium/pomerium:v0.28.0 +$ docker pull pomerium/pomerium:latest ```
diff --git a/content/docs/deploy/core.mdx b/content/docs/deploy/core.mdx new file mode 100644 index 000000000..9c715d8ae --- /dev/null +++ b/content/docs/deploy/core.mdx @@ -0,0 +1,192 @@ +--- +title: 'Pomerium Core (Self-managed)' +description: 'Learn how to obtain, configure, and run the open-source Pomerium server through pre-built binaries, Linux packages, Docker images, or building from source.' +sidebar_label: 'Pomerium Core' +lang: en-US +keywords: + - pomerium + - server + - proxy + - context-aware proxy + - open source + - identity aware proxy + - deployment + - pre-built binaries + - from source + - reverse proxy +sidebar_position: 1 +pagination_prev: null +pagination_next: null +--- + +# Pomerium Core (Self-managed) + +Pomerium Core (often referred to as _Pomerium Open Source_) is the primary server component in a self-hosted environment. All other Pomerium products build upon it. This document describes several ways to install and run Pomerium Core: + +1. **Pre-Built Binaries** (manual or OS-package installations) +2. **Docker Images** +3. **Building from Source** + +## Pre-Built Binaries + +We publish official binaries for Linux and macOS on our [GitHub Releases](https://github.com/pomerium/pomerium/releases) page, as well as OS packages (`deb` and `rpm`) via [Cloudsmith](https://cloudsmith.io/~pomerium/repos/pomerium/packages/). + +### Standalone Binary + +1. **Download** + Go to [GitHub Releases](https://github.com/pomerium/pomerium/releases) and look for the tarball corresponding to your operating system and architecture. For example: + + ```bash + ARCH=[amd64 or arm64] + OS=[linux or darwin] + VERSION=[desired version] + curl -L https://github.com/pomerium/pomerium/releases/download/${VERSION}/pomerium-${OS}-${ARCH}.tar.gz \ + | tar -z -x + ``` + +2. **Run** + Once extracted, you have a `pomerium` binary. Supply configuration via environment variables or a config file: + + ```bash + ./pomerium -config config.yaml + ``` + +### Linux Packages + +We provide OS packages via [Cloudsmith](https://cloudsmith.io/~pomerium/repos/pomerium/setup/). Supported formats: + +- `rpm` (Yum, DNF) +- `deb` (Apt) + +For example, to add a Yum repo (`rpm`-based): + +```abnf title="/etc/yum.repos.d/pomerium-pomerium.repo" +[pomerium-pomerium] +name=pomerium-pomerium +baseurl=https://dl.cloudsmith.io/public/pomerium/pomerium/rpm/el/$releasever/$basearch +repo_gpgcheck=1 +enabled=1 +gpgkey=https://dl.cloudsmith.io/public/pomerium/pomerium/gpg.6E388440B94E1407.key +gpgcheck=1 +sslverify=1 +pkg_gpgcheck=1 +``` + +Or for Debian/Ubuntu (`deb`-based): + +```bash +curl -1sLf 'https://dl.cloudsmith.io/public/pomerium/pomerium/gpg.6E388440B94E1407.key' | apt-key add - +echo "deb https://dl.cloudsmith.io/public/pomerium/pomerium/deb/debian buster main" > /etc/apt/sources.list.d/pomerium-pomerium.list +``` + +Then install Pomerium via your package manager: + +```bash +# For yum-based systems: +yum install pomerium + +# For apt-based systems: +apt-get update && apt-get install pomerium +``` + +## Docker Images + +We also provide container images on [Docker Hub](https://hub.docker.com/r/pomerium/pomerium) and [GitHub Packages](https://github.com/pomerium/pomerium/pkgs/container/pomerium). Common tags: + +- **`:latest`** → The most recent stable release +- **`:vX.Y.Z`** → A specific release +- **`:main`** → Nightly builds from the main branch +- **`:nonroot-*`** → Variants that run Pomerium as a `nonroot` user +- **`:debug-*`** → Variants that include extra debugging utilities + +Example usage: + +```bash +docker pull pomerium/pomerium:latest +docker run --rm -it -p 443:443 pomerium/pomerium:latest --version +``` + +If you plan to run on port 443 in a rootless environment, you may need extra [capabilities](https://linux-audit.com/linux-capabilities-hardening-linux-binaries-by-removing-setuid/) or choose a non-privileged port. + +## Building From Source (~~Hard~~ Fun mode!) + +If you prefer building from source: + +1. **Clone the Repository** + ```bash + git clone https://github.com/pomerium/pomerium.git $HOME/pomerium + cd $HOME/pomerium + ``` +2. **(Optional) Generate Local Certs** + For local development, use [mkcert](https://mkcert.dev/): + ```bash + go install filippo.io/mkcert@latest + mkcert -install + mkcert '*.localhost.pomerium.io' + ``` +3. **Build** + ```bash + make + ``` + This compiles the `pomerium` binary under `./bin`. If you don't have test prerequisites installed (Docker, Redis, etc.), run `make build` to skip them. +4. **Run** + ```bash + ./bin/pomerium -config config.yaml + ``` + +## Configuration + +Pomerium is configured via [configuration variables](/docs/reference) (environment variables) or a YAML file (`config.yaml`). Below is a minimal example referencing a single route and an identity provider: + +```yaml title="config.yaml" +# Minimal example route +shared_secret: REPLACE_ME +cookie_secret: REPLACE_ME +idp_provider: google +idp_client_id: REPLACE_ME +idp_client_secret: REPLACE_ME +address: :443 + +routes: + - from: https://verify.localhost.pomerium.io + to: https://verify.pomerium.com + policy: + - allow: + or: + - domain: + is: myorg.com +``` + +:::info + +For local testing, specify the `certificate_file` and `certificate_key_file` if using mkcert or other local certs. In production, you may rely on Let's Encrypt or external cert manager. See [TLS certificates](/docs/internals/certificates-and-tls) for details. + +::: + +## Running Pomerium + +### Systemd Service (OS Packages) + +If you installed via `rpm` or `deb`, we ship a systemd service unit: + +1. **Bind to Port 443** + Allow the `pomerium` service to listen on a privileged port: + ```bash + echo -e "[Service]\nAmbientCapabilities=CAP_NET_BIND_SERVICE" | sudo SYSTEMD_EDITOR=tee systemctl edit pomerium + ``` +2. **Enable & Start** + ```bash + sudo systemctl enable --now pomerium.service + ``` + +### Manual Launch + +If using the standalone binary (or building from source): + +```bash +./pomerium -config config.yaml +``` + +Any environment variables or custom settings can be set before this command. + +Once deployed and configured, you can verify that Pomerium is running by accessing the domain of one of your routes. If your logs show successful user authentication, you're ready to protect more apps with Pomerium Core. diff --git a/content/docs/enterprise/_category_.json b/content/docs/deploy/enterprise/_category_.json similarity index 100% rename from content/docs/enterprise/_category_.json rename to content/docs/deploy/enterprise/_category_.json diff --git a/content/docs/enterprise/configure-metrics.mdx b/content/docs/deploy/enterprise/configure-metrics.mdx similarity index 88% rename from content/docs/enterprise/configure-metrics.mdx rename to content/docs/deploy/enterprise/configure-metrics.mdx index ad3d69d33..c9025ad5c 100644 --- a/content/docs/enterprise/configure-metrics.mdx +++ b/content/docs/deploy/enterprise/configure-metrics.mdx @@ -20,8 +20,8 @@ This guide explains what the [external](#external-prometheus) and [embedded](#em To complete this guide, you need: -- [Pomerium Enterprise](/docs/enterprise) -- [Pomerium Core](/docs/core) +- [Pomerium Enterprise](/docs/deploy/enterprise) +- [Pomerium Core](/docs/deploy/core) This guide runs both Pomerium instances on localhost (`127.0.0.1`). @@ -71,7 +71,7 @@ For production deployments, we suggest using a dedicated Prometheus instance. curl -i -XPOST path.to.prometheus:port/-/reload ``` -1. In your Pomerium Enterprise configuration file, define the [`prometheus_url`](/docs/enterprise/configure#prometheus-url) key to point to your Prometheus instance. The example below uses port 9090, the default [Prometheus port](https://prometheus.io/docs/introduction/first_steps/). +1. In your Pomerium Enterprise configuration file, define the [`prometheus_url`](/docs/deploy/enterprise/configure#prometheus-url) key to point to your Prometheus instance. The example below uses port 9090, the default [Prometheus port](https://prometheus.io/docs/introduction/first_steps/). ```yaml title="pomerium-enterprise.yaml" prometheus_url: http://192.168.122.50:9090 @@ -95,7 +95,7 @@ For production deployments, we suggest using a dedicated Prometheus instance. Pomerium Enterprise supports an embedded Prometheus instance that you configure only in Pomerium. Use this option if you don't want to maintain an external Prometheus instance, or if you're testing metrics. -To configure an embedded Prometheus instance, add the [`prometheus_data_dir`](/docs/enterprise/configure#prometheus-data-dir) key and file path in your Pomerium Enterprise configuration file: +To configure an embedded Prometheus instance, add the [`prometheus_data_dir`](/docs/deploy/enterprise/configure#prometheus-data-dir) key and file path in your Pomerium Enterprise configuration file: ```yaml title="pomerium-enterprise.yaml" prometheus_data_dir: /var/lib/pomerium-console/tsdb @@ -103,7 +103,7 @@ prometheus_data_dir: /var/lib/pomerium-console/tsdb :::note -The directory path can be any location that you have permissions to write to. This example uses the default location created if you install Pomerium Enterprise with the [OS Packages](/docs/enterprise/install#install-pomerium-enterprise) option. +The directory path can be any location that you have permissions to write to. This example uses the default location created if you install Pomerium Enterprise with the [OS Packages](/docs/deploy/enterprise/install#install-pomerium-enterprise) option. ::: diff --git a/content/docs/enterprise/configure.mdx b/content/docs/deploy/enterprise/configure.mdx similarity index 100% rename from content/docs/enterprise/configure.mdx rename to content/docs/deploy/enterprise/configure.mdx diff --git a/content/docs/deploy/enterprise/enterprise.md b/content/docs/deploy/enterprise/enterprise.md new file mode 100644 index 000000000..2e3e0880c --- /dev/null +++ b/content/docs/deploy/enterprise/enterprise.md @@ -0,0 +1,107 @@ +--- +title: Pomerium Enterprise +description: Learn what features come with Pomerium Enterprise, including a Console GUI where you can manage your policies, namespaces, groups, routes, and more. +keywords: + [ + Pomerium Enterprise, + PPL Builder, + Console GUI, + namespaces, + directory sync, + device management, + groups, + programmatic api, + branding, + ] +--- + +import ClearIcon from '@mui/icons-material/Clear'; + +# Pomerium Enterprise + +Pomerium Enterprise is built on our open-source Pomerium Core offering. Pomerium Enterprise makes Pomerium easier to manage at scale, and adds additional functionality aimed at organizations with auditing, compliance, governance, and risk management needs. + +## Pomerium Enterprise Features + +Pomerium Enterprise comes with all the capabilities in Pomerium Core, plus the following features: + +### Enterprise Console + +The **Enterprise Console** provides a dashboard where you can view traffic and logs, manage routes and policies, import external data, configure global and namespaced settings, and more. + +![An overview animation of the Pomerium Enterprise Console](./img/enterprise-console-overview.gif) + +### Enterprise API + +The **Enterprise API** helps you manage your configuration with your preferred programming language or infrastructure management tool. + +Everything that is manageable in the Enterprise Console can also be driven programmatically through the [Enterprise API](/docs/internals/management-api-enterprise). + +### Session Management + +The **Sessions** dashboard allows you to view and manage sessions within your organization. Admin members can export session data and revoke sessions in real time. + +![View and manage sessions in the Enterprise Console's Sessions dashboard](./img/manage-sessions.png) + +:::enterprise + +Ready to upgrade to Pomerium Enterprise? [**Contact us**](https://www.pomerium.com/enterprise-sales/) today to get started. + +::: + +### Namespaces and Self-Service + +The **Namespaces** dashboard is where you configure user roles and permissions for routes, policies, and the Enterprise Console itself. Once you've configured a [Namespace](/docs/internals/namespacing), members of that namespace can self-manage access to the infrastructure they build from or depend on. + +Pomerium Enterprise allows you to import groups defined by your identity provider. This allows you to build stable policies that don't require adjustments as your company changes. + +![Manage Namespaces in the Enterprise Console's Namespaces dashboard](./img/manage-namespaces.gif) + +### Deployment History and Audit Logs + +The **Deployments** dashboard allows you to view and export change logs from the Enterprise Console. Select a change to review which user applied it and when. + +![View deployments in the Enterprise Console's Deployments dashboard](./img/deployments-dashboard.gif) + +### Directory Sync + +Pomerium Enterprise's [**Directory Sync**](/docs/integrations/user-standing/directory-sync) feature allows you to import your identity provider's directory data. After a successful sync, you can use your internal groups and teams data when building policies. ![Viewing the Identity Providers settings for a directory sync in the Enterprise Console](./img/directory-sync-2.png) + +### External Data Sources + +In the **External Data** dashboard, you can import, view, and manage [external data sources](/docs/capabilities/integrations). After a successful sync, you can use data unique to your organization to serve as context in your authorization policies. ![Using the External Data Source Record type in a policy](./img/external-data-as-context.gif) + +## Pomerium Enterprise features comparison + +| Features | Pomerium Core | Pomerium Enterprise | +| :-- | :-- | :-- | +| Identity-based Access | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | +| SSO Support | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | +| Declarative Authorization Policy | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | +| TCP Support | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | +| Enterprise Console | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | +| [Enterprise API](/docs/internals/management-api-enterprise) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | +| [Session Management](/docs/internals/metrics#sessions) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | +| [Namespaces](/docs/internals/namespacing) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | +| [Directory Sync](/docs/integrations/user-standing/directory-sync) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | +| [User Impersonation](/docs/capabilities/impersonation) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | +| [Deployment History](/docs/internals/metrics#changesets-and-deployments) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | +| [Device Identity](/docs/integrations/device-context/device-identity) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | +| [Custom Branding](/docs/capabilities/branding) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | +| [Service Accounts](/docs/capabilities/service-accounts) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | +| [Metrics](/docs/internals/metrics) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | +| [External Data Sources](/docs/capabilities/integrations) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | + +## Next Steps + +:::enterprise + +Already upgraded to Pomerium Enterprise, but need some help setting up the Enterprise Console? + +The following docs can help: + +- [**Install Pomerium Enterprise**](/docs/deploy/enterprise/install) +- [**Pomerium Enterprise Configuration**](/docs/deploy/enterprise/configure) +- [**Pomerium Enterprise Quickstart**](/docs/deploy/enterprise/quickstart) + +::: diff --git a/content/docs/deploy/enterprise/img/auth-flow-diagram.svg b/content/docs/deploy/enterprise/img/auth-flow-diagram.svg new file mode 100644 index 000000000..5c15ae073 --- /dev/null +++ b/content/docs/deploy/enterprise/img/auth-flow-diagram.svg @@ -0,0 +1 @@ +BrowserIdentity ProviderIngressPomeriumPomerium AuthNPomerium AuthZappGET /app/verify/appAuthenticated?No!HTTP 301 sign in callback urlHTTP 301: Oauth2 callback endpointSave sessionHTTP 301 app/verify/appAuthenticated?Yes!Authorized?Yes?HTTP 200OK!BrowserIdentity ProviderIngressPomeriumPomerium AuthNPomerium AuthZapp \ No newline at end of file diff --git a/content/docs/enterprise/img/certificates-ssl-report.png b/content/docs/deploy/enterprise/img/certificates-ssl-report.png similarity index 100% rename from content/docs/enterprise/img/certificates-ssl-report.png rename to content/docs/deploy/enterprise/img/certificates-ssl-report.png diff --git a/content/docs/deploy/enterprise/img/certificates-valid-secure-certificate.png b/content/docs/deploy/enterprise/img/certificates-valid-secure-certificate.png new file mode 100644 index 000000000..2b248e73c Binary files /dev/null and b/content/docs/deploy/enterprise/img/certificates-valid-secure-certificate.png differ diff --git a/content/docs/deploy/enterprise/img/cluster-cert-details.png b/content/docs/deploy/enterprise/img/cluster-cert-details.png new file mode 100644 index 000000000..42b61a331 Binary files /dev/null and b/content/docs/deploy/enterprise/img/cluster-cert-details.png differ diff --git a/content/docs/deploy/enterprise/img/compare-changes.png b/content/docs/deploy/enterprise/img/compare-changes.png new file mode 100644 index 000000000..22183db76 Binary files /dev/null and b/content/docs/deploy/enterprise/img/compare-changes.png differ diff --git a/content/docs/deploy/enterprise/img/console-route-traffic.png b/content/docs/deploy/enterprise/img/console-route-traffic.png new file mode 100644 index 000000000..b7c386f5d Binary files /dev/null and b/content/docs/deploy/enterprise/img/console-route-traffic.png differ diff --git a/content/docs/deploy/enterprise/img/create-external-data-source.png b/content/docs/deploy/enterprise/img/create-external-data-source.png new file mode 100644 index 000000000..bcb9ba220 Binary files /dev/null and b/content/docs/deploy/enterprise/img/create-external-data-source.png differ diff --git a/content/docs/deploy/enterprise/img/deployments-dashboard.gif b/content/docs/deploy/enterprise/img/deployments-dashboard.gif new file mode 100644 index 000000000..31cacf758 Binary files /dev/null and b/content/docs/deploy/enterprise/img/deployments-dashboard.gif differ diff --git a/content/docs/deploy/enterprise/img/directory-sync-2.png b/content/docs/deploy/enterprise/img/directory-sync-2.png new file mode 100644 index 000000000..87285a801 Binary files /dev/null and b/content/docs/deploy/enterprise/img/directory-sync-2.png differ diff --git a/content/docs/deploy/enterprise/img/directory-sync.png b/content/docs/deploy/enterprise/img/directory-sync.png new file mode 100644 index 000000000..3fdbd5493 Binary files /dev/null and b/content/docs/deploy/enterprise/img/directory-sync.png differ diff --git a/content/docs/deploy/enterprise/img/enterprise-console-overview.gif b/content/docs/deploy/enterprise/img/enterprise-console-overview.gif new file mode 100644 index 000000000..b7e7c8279 Binary files /dev/null and b/content/docs/deploy/enterprise/img/enterprise-console-overview.gif differ diff --git a/content/docs/deploy/enterprise/img/external-data-as-context.gif b/content/docs/deploy/enterprise/img/external-data-as-context.gif new file mode 100644 index 000000000..256618d6a Binary files /dev/null and b/content/docs/deploy/enterprise/img/external-data-as-context.gif differ diff --git a/content/docs/deploy/enterprise/img/jaeger.png b/content/docs/deploy/enterprise/img/jaeger.png new file mode 100644 index 000000000..9ab8dbb6e Binary files /dev/null and b/content/docs/deploy/enterprise/img/jaeger.png differ diff --git a/content/docs/deploy/enterprise/img/manage-namespaces.gif b/content/docs/deploy/enterprise/img/manage-namespaces.gif new file mode 100644 index 000000000..cc37293f2 Binary files /dev/null and b/content/docs/deploy/enterprise/img/manage-namespaces.gif differ diff --git a/content/docs/deploy/enterprise/img/manage-sessions.png b/content/docs/deploy/enterprise/img/manage-sessions.png new file mode 100644 index 000000000..5339b01b8 Binary files /dev/null and b/content/docs/deploy/enterprise/img/manage-sessions.png differ diff --git a/content/docs/deploy/enterprise/img/metrics/external-data-sources-dashboard.png b/content/docs/deploy/enterprise/img/metrics/external-data-sources-dashboard.png new file mode 100644 index 000000000..7dd0bf5e9 Binary files /dev/null and b/content/docs/deploy/enterprise/img/metrics/external-data-sources-dashboard.png differ diff --git a/content/docs/deploy/enterprise/img/metrics/traffic-dashboard.png b/content/docs/deploy/enterprise/img/metrics/traffic-dashboard.png new file mode 100644 index 000000000..af977ccb8 Binary files /dev/null and b/content/docs/deploy/enterprise/img/metrics/traffic-dashboard.png differ diff --git a/content/docs/deploy/enterprise/img/new-enrollment.png b/content/docs/deploy/enterprise/img/new-enrollment.png new file mode 100644 index 000000000..83a716958 Binary files /dev/null and b/content/docs/deploy/enterprise/img/new-enrollment.png differ diff --git a/content/docs/deploy/enterprise/img/pomerium-checkmark.svg b/content/docs/deploy/enterprise/img/pomerium-checkmark.svg new file mode 100644 index 000000000..948b1fd3c --- /dev/null +++ b/content/docs/deploy/enterprise/img/pomerium-checkmark.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/content/docs/enterprise/img/security-headers.png b/content/docs/deploy/enterprise/img/security-headers.png similarity index 100% rename from content/docs/enterprise/img/security-headers.png rename to content/docs/deploy/enterprise/img/security-headers.png diff --git a/content/docs/deploy/enterprise/img/upgrading/idp_enterprise.png b/content/docs/deploy/enterprise/img/upgrading/idp_enterprise.png new file mode 100644 index 000000000..4acc69bd7 Binary files /dev/null and b/content/docs/deploy/enterprise/img/upgrading/idp_enterprise.png differ diff --git a/content/docs/deploy/enterprise/img/upgrading/policy_groups_enterprise.png b/content/docs/deploy/enterprise/img/upgrading/policy_groups_enterprise.png new file mode 100644 index 000000000..f69678bc4 Binary files /dev/null and b/content/docs/deploy/enterprise/img/upgrading/policy_groups_enterprise.png differ diff --git a/content/docs/deploy/enterprise/img/upgrading/v23/cookie-samesite.gif b/content/docs/deploy/enterprise/img/upgrading/v23/cookie-samesite.gif new file mode 100644 index 000000000..fc84889d7 Binary files /dev/null and b/content/docs/deploy/enterprise/img/upgrading/v23/cookie-samesite.gif differ diff --git a/content/docs/deploy/enterprise/img/upgrading/v23/logging-configs.gif b/content/docs/deploy/enterprise/img/upgrading/v23/logging-configs.gif new file mode 100644 index 000000000..df63053a3 Binary files /dev/null and b/content/docs/deploy/enterprise/img/upgrading/v23/logging-configs.gif differ diff --git a/content/docs/deploy/enterprise/img/upgrading/v23/set-request-headers-fingerprint.png b/content/docs/deploy/enterprise/img/upgrading/v23/set-request-headers-fingerprint.png new file mode 100644 index 000000000..9e7139e2a Binary files /dev/null and b/content/docs/deploy/enterprise/img/upgrading/v23/set-request-headers-fingerprint.png differ diff --git a/content/docs/deploy/enterprise/img/user-id.png b/content/docs/deploy/enterprise/img/user-id.png new file mode 100644 index 000000000..3b02e8cce Binary files /dev/null and b/content/docs/deploy/enterprise/img/user-id.png differ diff --git a/content/docs/deploy/enterprise/img/view-deployments.png b/content/docs/deploy/enterprise/img/view-deployments.png new file mode 100644 index 000000000..6f7d5b3e7 Binary files /dev/null and b/content/docs/deploy/enterprise/img/view-deployments.png differ diff --git a/content/docs/enterprise/install.mdx b/content/docs/deploy/enterprise/install.mdx similarity index 95% rename from content/docs/enterprise/install.mdx rename to content/docs/deploy/enterprise/install.mdx index ab3cbb8f0..b7d696985 100644 --- a/content/docs/enterprise/install.mdx +++ b/content/docs/deploy/enterprise/install.mdx @@ -59,7 +59,7 @@ Password: docker pull docker.cloudsmith.io/pomerium/enterprise/pomerium-console:${vX.X.X} ``` -See the [Enterprise Quickstart](/docs/enterprise/quickstart) for instructions to run and deploy the Enterprise Console with Docker Compose. +See the [Enterprise Quickstart](/docs/deploy/enterprise/quickstart) for instructions to run and deploy the Enterprise Console with Docker Compose.
@@ -207,9 +207,9 @@ kubectl apply -k ./config ``` -[pomerium kustomize]: /docs/k8s/install -[environment variables]: /docs/enterprise/configure -[ingress]: /docs/k8s/ingress +[pomerium kustomize]: /docs/deploy/k8s/install +[environment variables]: /docs/deploy/enterprise/configure +[ingress]: /docs/deploy/k8s/ingress
diff --git a/content/docs/enterprise/quickstart.mdx b/content/docs/deploy/enterprise/quickstart.mdx similarity index 86% rename from content/docs/enterprise/quickstart.mdx rename to content/docs/deploy/enterprise/quickstart.mdx index 301524dc6..5c979fc5e 100644 --- a/content/docs/enterprise/quickstart.mdx +++ b/content/docs/deploy/enterprise/quickstart.mdx @@ -9,22 +9,22 @@ sidebar_position: 1 import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem'; -import HostedConfig from '../../examples/enterprise/hosted-auth-config.yaml.md'; -import HostedCompose from '../../examples/enterprise/hosted-auth-docker.yaml.md'; +import HostedConfig from '/content/examples/enterprise/hosted-auth-config.yaml.md'; +import HostedCompose from '/content/examples/enterprise/hosted-auth-docker.yaml.md'; # Run Pomerium Enterprise With Docker Run Pomerium Enterprise with Docker containers and connect to the Console. -This guide uses our [**Hosted Authenticate Service**](/docs/capabilities/hosted-authenticate-service). If you use our hosted service and have a license key, you can complete this guide in **under 5 minutes**. +This guide uses our [**Hosted Authenticate Service**](/docs/capabilities/authentication). If you use our hosted service and have a license key, you can complete this guide in **under 5 minutes**. -See the [Self-Hosted Authenticate Service](/docs/capabilities/self-hosted-authenticate-service) page if you want to self-host Pomerium. +See the [Self-Hosted Authenticate Service](/docs/capabilities/authentication) page if you want to self-host Pomerium. ## Prerequisites To complete this guide, you need: -- [Pomerium Core](/docs/quickstart) +- [Pomerium Core](/docs/get-started/quickstart) - [Docker](https://docs.docker.com/get-docker/) and [Docker Compose](https://docs.docker.com/compose/install/) :::note @@ -101,4 +101,4 @@ Go to `https://console.localhost.pomerium.io` to access your Console. If you want to try connecting Pomerium with other services, see some of our [Guides](/docs/guides). -**Did you finish this quickstart guide?** We'd love to hear what you think. Get in touch with us on our [Discuss forum](https://discuss.pomerium.com/), message us on [Twitter](https://twitter.com/pomerium_io), [LinkedIn](https://www.linkedin.com/company/pomerium-inc), or check out our [Community](https://www.pomerium.com/docs/community) page. +**Did you finish this quickstart guide?** We'd love to hear what you think. Get in touch with us on our [Discuss forum](https://discuss.pomerium.com/), message us on [Twitter](https://twitter.com/pomerium_io), [LinkedIn](https://www.linkedin.com/company/pomerium-inc), or check out our [Community](https://discuss.pomerium.com/) page. diff --git a/content/docs/k8s/_category_.json b/content/docs/deploy/k8s/_category_.json similarity index 100% rename from content/docs/k8s/_category_.json rename to content/docs/deploy/k8s/_category_.json diff --git a/content/docs/k8s/configure.md b/content/docs/deploy/k8s/configure.md similarity index 88% rename from content/docs/k8s/configure.md rename to content/docs/deploy/k8s/configure.md index 5f1c9fce3..3fee2fc5b 100644 --- a/content/docs/k8s/configure.md +++ b/content/docs/deploy/k8s/configure.md @@ -40,15 +40,15 @@ spec: ### Bootstrap Secrets -Bootstrap secrets are provisioned via `secrets` property of the [CRD](/docs/k8s/ingress#tls-certificates). The default installation would run a one-off Job that would generate them and store into `bootstrap` Secret of the `pomerium` namespace. +Bootstrap secrets are provisioned via `secrets` property of the [CRD](/docs/deploy/k8s/ingress#tls-certificates). The default installation would run a one-off Job that would generate them and store into `bootstrap` Secret of the `pomerium` namespace. ### Identity Provider -Integration with your Identity Provider is configured using [`identityProvider`](/docs/identity-providers) parameter. +Integration with your Identity Provider is configured using [`identityProvider`](/docs/integrations/user-identity/identity-providers) parameter. ### Authenticate endpoint -Each Pomerium installation has a special route that unauthenticated users are redirected to that handles sign-in via your Identity Provider. It is configured via the [`authenticate`](/docs/k8s/reference#authenticate) parameter of the [CRD](./reference#authenticate). +Each Pomerium installation has a special route that unauthenticated users are redirected to that handles sign-in via your Identity Provider. It is configured via the [`authenticate`](/docs/deploy/k8s/reference#authenticate) parameter of the [CRD](./reference#authenticate). The authenticate endpoint DNS address should resolve to an external IP address assigned by your Kubernetes Load Balancer to the `pomerium-proxy` service. If you use `external-dns`, that may be [done automatically](#external-dns). @@ -72,7 +72,7 @@ See [Configuration Reference](./reference) for full description of all CRD confi ## Status -Pomerium posts updates about its internal state to the [`/status` section of the `Pomerium CRD`](/docs/k8s/ingress#view-event-history). +Pomerium posts updates about its internal state to the [`/status` section of the `Pomerium CRD`](/docs/deploy/k8s/ingress#view-event-history). ```console Name: global diff --git a/content/docs/k8s/gateway-api.mdx b/content/docs/deploy/k8s/gateway-api.mdx similarity index 97% rename from content/docs/k8s/gateway-api.mdx rename to content/docs/deploy/k8s/gateway-api.mdx index 1400ab66f..5703f2586 100644 --- a/content/docs/k8s/gateway-api.mdx +++ b/content/docs/deploy/k8s/gateway-api.mdx @@ -48,7 +48,7 @@ spec: is: your-company-domain.com ``` -See [Pomerium Policy Language](/docs/capabilities/ppl) for complete details about policy syntax. +See [Pomerium Policy Language](/docs/internals/ppl) for complete details about policy syntax. :::caution @@ -74,7 +74,7 @@ To install the Pomerium Ingress Controller with support for Gateway API: This installs and configures the Ingress Controller, and adds a [GatewayClass](https://gateway-api.sigs.k8s.io/concepts/api-overview/#gatewayclass) named `pomerium-gateway` for use with the Gateway API. -1. You will also need to set up a [global Pomerium configuration](/docs/k8s/configure). This is a minimal example for use with Gateway API: +1. You will also need to set up a [global Pomerium configuration](/docs/deploy/k8s/configure). This is a minimal example for use with Gateway API: ```yaml title="pomerium-global.yaml" apiVersion: ingress.pomerium.io/v1 diff --git a/content/docs/deploy/k8s/img/httpbin.png b/content/docs/deploy/k8s/img/httpbin.png new file mode 100644 index 000000000..c3adda593 Binary files /dev/null and b/content/docs/deploy/k8s/img/httpbin.png differ diff --git a/content/docs/k8s/img/kubernetes-gke.png b/content/docs/deploy/k8s/img/kubernetes-gke.png similarity index 100% rename from content/docs/k8s/img/kubernetes-gke.png rename to content/docs/deploy/k8s/img/kubernetes-gke.png diff --git a/content/docs/deploy/k8s/img/logged-in-as.png b/content/docs/deploy/k8s/img/logged-in-as.png new file mode 100644 index 000000000..3eef6af88 Binary files /dev/null and b/content/docs/deploy/k8s/img/logged-in-as.png differ diff --git a/content/docs/deploy/k8s/img/verify-app.png b/content/docs/deploy/k8s/img/verify-app.png new file mode 100644 index 000000000..c9bde05c8 Binary files /dev/null and b/content/docs/deploy/k8s/img/verify-app.png differ diff --git a/content/docs/k8s/ingress.md b/content/docs/deploy/k8s/ingress.md similarity index 93% rename from content/docs/k8s/ingress.md rename to content/docs/deploy/k8s/ingress.md index 598b8d060..4ac19b2ee 100644 --- a/content/docs/k8s/ingress.md +++ b/content/docs/deploy/k8s/ingress.md @@ -17,24 +17,24 @@ keywords: pagination_next: null --- -The [Pomerium Kubernetes Ingress Controller](https://github.com/pomerium/ingress-controller) is Pomerium’s official, open-source controller for Kubernetes environments. Pomerium's Ingress Controller builds secure access to Kubernetes Services by enforcing access control policies based on user identity; Enterprise users can build access control policies that include criteria like device, location, and other contextual factors." +The [Pomerium Kubernetes Ingress Controller](https://github.com/pomerium/ingress-controller) is Pomerium's official, open-source controller for Kubernetes environments. Pomerium's Ingress Controller builds secure access to Kubernetes Services by enforcing access control policies based on user identity; Enterprise users can build access control policies that include criteria like device, location, and other contextual factors." ## How Pomerium Ingress Controller works -Pomerium’s Ingress Controller for Kubernetes enables you to dynamically provision routes from Ingress resources and set authorization policy on those routes with Ingress annotations. By defining routes as Ingress resources in the Kubernetes API, you can easily create and remove those routes from your Pomerium configuration. +Pomerium's Ingress Controller for Kubernetes enables you to dynamically provision routes from Ingress resources and set authorization policy on those routes with Ingress annotations. By defining routes as Ingress resources in the Kubernetes API, you can easily create and remove those routes from your Pomerium configuration. -If you've tested Pomerium using the [all-in-one binary](/docs/core), you're probably familiar with configuring routes in Pomerium's [`config.yaml`](/docs/internals/configuration) file. When using the Pomerium Ingress Controller, each route is defined as an Ingress resource in the Kubernetes API. +If you've tested Pomerium using the [all-in-one binary](/docs/deploy/core), you're probably familiar with configuring routes in Pomerium's [`config.yaml`](/docs/internals/configuration) file. When using the Pomerium Ingress Controller, each route is defined as an Ingress resource in the Kubernetes API. -This document shows you how to configure an Ingress resource that’s compatible with the Pomerium Ingress Controller. +This document shows you how to configure an Ingress resource that's compatible with the Pomerium Ingress Controller. **Before you start:** -This document assumes you've installed the Pomerium Ingress Controller and added global configuration settings with the [Pomerium CRD](/docs/k8s/configure). +This document assumes you've installed the Pomerium Ingress Controller and added global configuration settings with the [Pomerium CRD](/docs/deploy/k8s/configure). If you haven't completed these steps, see the following docs: -- [Install Pomerium Ingress Controller](/docs/k8s/install) -- [Global Configuration](/docs/k8s/configure) +- [Install Pomerium Ingress Controller](/docs/deploy/k8s/install) +- [Global Configuration](/docs/deploy/k8s/configure) ## Configure an Ingress resource @@ -87,7 +87,7 @@ spec: The default installation adds `pomerium` [IngressClass](https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class) to your cluster. In order for Pomerium to service your Ingress objects, please set `spec.ingressClassName` to `pomerium`. -It is also possible to [set Pomerium to be a default ingress controller](/docs/k8s/install#set-pomerium-as-default-ingressclass) cluster-wide. +It is also possible to [set Pomerium to be a default ingress controller](/docs/deploy/k8s/install#set-pomerium-as-default-ingressclass) cluster-wide. ### Set Ingress annotations @@ -175,17 +175,17 @@ The remaining annotations are specific to or behave differently than they do whe | `ingress.pomerium.io/set_request_headers_secret` | Name of Kubernetes Secret containing the contents of the request header to send upstream. When used, `ingress.pomerium.io/set_request_headers` should not contain overlapping keys. | | `ingress.pomerium.io/set_response_headers_secret` | Name of Kubernetes Secret containing the contents of the response header to send downstream. When used, `ingress.pomerium.io/set_response_headers` should not contain overlapping keys. | | `ingress.pomerium.io/service_proxy_upstream` | When set to `"true"` forces Pomerium to connect to upstream servers through the k8s service proxy, and not individual endpoints.
This is useful when deploying Pomerium inside a service mesh. | -| `ingress.pomerium.io/tcp_upstream` | When set to `"true"`, defines the route as supporting a TCP tunnel. See the [example below](/docs/k8s/ingress#tcp-services) for more information. | +| `ingress.pomerium.io/tcp_upstream` | When set to `"true"`, defines the route as supporting a TCP tunnel. See the [example below](/docs/deploy/k8s/ingress#tcp-services) for more information. | | `ingress.pomerium.io/tls_client_secret` | Name of Kubernetes `tls` Secret containing a [client certificate][tls_client_certificate] for connecting to the upstream. | | `ingress.pomerium.io/tls_custom_ca_secret` | Name of Kubernetes `tls` Secret containing a custom [CA certificate][`tls_custom_ca_secret`] for the upstream. | | `ingress.pomerium.io/tls_downstream_client_ca_secret` | Name of Kubernetes `tls` Secret containing a [Client CA][client-certificate-authority] for validating downstream clients. | -| `ingress.pomerium.io/policy` | [Pomerium Policy Language](/docs/capabilities/ppl) YAML or JSON block (as string) | +| `ingress.pomerium.io/policy` | [Pomerium Policy Language](/docs/internals/ppl) YAML or JSON block (as string) | | `ingress.pomerium.io/allow_any_authenticated_user` | When set to `"true"`, allows access to any user that was successfully authenticated with your Identity Provider. | | `ingress.pomerium.io/allow_public_unauthenticated_access` | When set to `"true"`, does not require authentication, grants public access | ### Set authorization policy -The `ingress.pomerium.io/policy` annotation allows you to build an authorization policy and apply it to a route. To build your authorization policy, apply [Pomerium Policy Language (PPL)](https://www.pomerium.com/docs/capabilities/ppl) inside a YAML or JSON block (as strings). +The `ingress.pomerium.io/policy` annotation allows you to build an authorization policy and apply it to a route. To build your authorization policy, apply [Pomerium Policy Language (PPL)](https://www.pomerium.com/docs/internals/ppl) inside a YAML or JSON block (as strings). #### Ingress authorization policy examples @@ -323,7 +323,7 @@ Each Ingress should be backed by a Service. Pomerium supports certain extensions Pomerium is capable of creating secure connections to services like SSH, Databases, and more by creating a TCP tunnel to the service with a local client. -The example route below defines a route providing a tunneled TCP connection to an upstream service listening for non-web traffic. Pomerium provides [command line and GUI](/docs/capabilities/tcp/client) clients to interact with the TCP services. +The example route below defines a route providing a tunneled TCP connection to an upstream service listening for non-web traffic. Pomerium provides [command line and GUI](/docs/deploy/clients) clients to interact with the TCP services. ```yaml apiVersion: networking.k8s.io/v1 @@ -351,7 +351,7 @@ The important points to note in this example: - The annotation `ingress.pomerium.io/tcp_upstream:` is set to `"true"`, - `spec.rules.[].http.paths.[].path` is omitted, - `spec.rules.[].http.paths.[].pathType` is set to `ImplementationSpecific`, -- `spec.rules.[].host` and `spec.rules.[].paths.[].backend.service.port.name/number` together define the address used when connecting to the route using the [Pomerium Desktop or CLI clients](/docs/capabilities/tcp/client), +- `spec.rules.[].host` and `spec.rules.[].paths.[].backend.service.port.name/number` together define the address used when connecting to the route using the [Pomerium Desktop or CLI clients](/docs/deploy/clients), - You may apply standard access control annotations to define access restrictions to the service. :::note @@ -370,7 +370,7 @@ ingress.pomerium.io/service_proxy_upstream: 'true' ### Load Balancing -Unless you disabled direct traffic to Endpoints, Pomerium would load balance the requests to the upstream endpoints. See the [Load Balancing](/docs/capabilities/load-balancing) guide for details, and use relevant Ingress annotations to fine tune load balancing and health checks. +Unless you disabled direct traffic to Endpoints, Pomerium would load balance the requests to the upstream endpoints. See the [Load Balancing](/docs/capabilities/routing) guide for details, and use relevant Ingress annotations to fine tune load balancing and health checks. ```yaml ingress.pomerium.io/lb_policy: 'lb_policy_option' @@ -544,7 +544,7 @@ spec: ## Metrics -Pomerium [exposes](/docs/k8s/install#metrics) a number of Prometheus style metrics that you may use to monitor your Ingress. +Pomerium [exposes](/docs/deploy/k8s/install#metrics) a number of Prometheus style metrics that you may use to monitor your Ingress. In order to filter out metrics for a particular Ingress, use `envoy_cluster_name` metric label, that has a `ingressnamespace-ingressname-host-domain-com` format. diff --git a/content/docs/k8s/install.md b/content/docs/deploy/k8s/install.md similarity index 100% rename from content/docs/k8s/install.md rename to content/docs/deploy/k8s/install.md diff --git a/content/docs/k8s/quickstart.mdx b/content/docs/deploy/k8s/quickstart.mdx similarity index 92% rename from content/docs/k8s/quickstart.mdx rename to content/docs/deploy/k8s/quickstart.mdx index f9c377979..f39134140 100644 --- a/content/docs/k8s/quickstart.mdx +++ b/content/docs/deploy/k8s/quickstart.mdx @@ -20,14 +20,14 @@ keywords: import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem'; -import InstallMkcert from '@site/content/_install-mkcert.md'; +import InstallMkcert from '@site/content/docs/admonitions/_install-mkcert.md'; import GlobalExample from '@site/content/examples/kubernetes/pomerium-global-settings.md'; Deploy Pomerium Core with [Kubernetes]. -This quickstart guide uses our [**Hosted Authenticate Service**](/docs/capabilities/hosted-authenticate-service) so you don't need to configure an identity provider or authenticate service URL. +This quickstart guide uses our [**Hosted Authenticate Service**](/docs/capabilities/authentication) so you don't need to configure an identity provider or authenticate service URL. -If you want to self-host, see the [**Self-Hosted Authenticate Service**](/docs/capabilities/self-hosted-authenticate-service) page. +If you want to self-host, see the [**Self-Hosted Authenticate Service**](/docs/capabilities/authentication) page. ## Prerequisites @@ -188,7 +188,7 @@ See the [**Verify examples**](https://github.com/pomerium/verify/blob/main/examp number: 8000 ``` - Note that in **Line 8**, we include the [annotation](/docs/k8s/ingress#supported-annotations) `ingress.pomerium.io/pass_identity_headers`, which provides a [JWT](/docs/internals/glossary#json-web-token) to the Verify service. + Note that in **Line 8**, we include the [annotation](/docs/deploy/k8s/ingress#supported-annotations) `ingress.pomerium.io/pass_identity_headers`, which provides a [JWT](/docs/internals/glossary#json-web-token) to the Verify service. Deploy the service with `kubectl apply -f verify-ingress.yaml`, and visit the path in your browser: @@ -246,10 +246,10 @@ Events: ``` [cert-manager]: https://cert-manager.io/docs/ -[identity provider]: /docs/identity-providers +[identity provider]: /docs/integrations/user-identity/identity-providers [ingress controller]: ./ingress.md [install kubectl]: https://kubernetes.io/docs/tasks/tools/install-kubectl/ [kubernetes]: https://kubernetes.io [mkcert]: https://github.com/FiloSottile/mkcert [organizing cluster access using kubeconfig files]: https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/ -[tls certificates]: /docs/guides/certificates +[tls certificates]: /docs/internals/certificates-and-tls diff --git a/content/docs/k8s/reference.md b/content/docs/deploy/k8s/reference.md similarity index 97% rename from content/docs/k8s/reference.md rename to content/docs/deploy/k8s/reference.md index 5c5032587..fcb5cca85 100644 --- a/content/docs/k8s/reference.md +++ b/content/docs/deploy/k8s/reference.md @@ -135,7 +135,7 @@ PomeriumSpec defines Pomerium-specific configuration parameters.

- IdentityProvider configure single-sign-on authentication and user identity details by integrating with your Identity Provider + IdentityProvider configure single-sign-on authentication and user identity details by integrating with your Identity Provider

@@ -376,7 +376,7 @@ Cookie defines Pomerium session cookie options.

- Expire sets cookie and Pomerium session expiration time. Once session expires, users would have to re-login. If you change this parameter, existing sessions are not affected.

See Session Management (Enterprise) for a more fine-grained session controls.

Defaults to 14 hours.

+ Expire sets cookie and Pomerium session expiration time. Once session expires, users would have to re-login. If you change this parameter, existing sessions are not affected.

See Session Management (Enterprise) for a more fine-grained session controls.

Defaults to 14 hours.

Format: a duration string like "22s" as parsed by Golang time.ParseDuration. @@ -437,7 +437,7 @@ Cookie defines Pomerium session cookie options. ### `identityProvider` -IdentityProvider configure single-sign-on authentication and user identity details by integrating with your Identity Provider +IdentityProvider configure single-sign-on authentication and user identity details by integrating with your Identity Provider @@ -574,7 +574,7 @@ IdentityProvider configure single-sign-on authentication and user identity detai

- URL is the base path to an identity provider's OpenID connect discovery document. See Identity Providers guides for details. + URL is the base path to an identity provider's OpenID connect discovery document. See Identity Providers guides for details.

Format: an URI as parsed by Golang net/url.ParseRequestURI. @@ -791,7 +791,7 @@ Timeout specifies the + + + +## Upgrade Guide (Core Edition) + +:::tip + +Changelog notes for Pomerium Core can be found on [GitHub](https://github.com/pomerium/pomerium/releases). + +::: + +This page contains the list of deprecations and important or breaking changes for Pomerium Core. Please read it carefully before upgrading. + +### 0.28.0 + +There are no breaking changes in v0.28. + +### 0.27.0 + +#### Breaking + +##### Deprecated JWT endpoint + +The `/.pomerium/jwt` endpoint is now deprecated and disabled by default. You can temporarily opt out of this deprecation by setting the runtime flag [`pomerium_jwt_endpoint`](/docs/reference/runtime-flags) to `true`. This flag will be removed in a future release. + +- **Context**: This endpoint was originally added for single-page web apps to get information about the currently signed-in user, but that same user data can be fetched without a signed JWT. +- **New approach**: A new `/.pomerium/user` endpoint provides user data as plaintext JSON. If you use Pomerium's [JavaScript SDK](https://github.com/pomerium/js-sdk), version 1.1.0 includes `getBrowserUser()`, which replaces `verifyBrowserUser()`. + +##### Upgrading Pomerium Zero deployments in Kubernetes + +For Pomerium Zero in Kubernetes, we updated the manifest to use a **Deployment** instead of a StatefulSet. Before upgrading, delete your old StatefulSet: + +```bash +kubectl delete statefulset/pomerium -n pomerium-zero +``` + +Then apply the new deployment: + +```bash +kubectl apply -k github.com/pomerium/pomerium/k8s/zero +``` + +### 0.26.0 + +##### Routes port matching + +- **Previous Behavior**: Pomerium required the request's `Host` header to match the route's `from` URL exactly, including port. +- **New Behavior**: If your `from` URL does not include an explicit port, Pomerium ignores the incoming port. This helps with NAT or load balancers that change the request port. +- **Note**: You can revert to the old behavior by setting the runtime flag `match_any_incoming_port=false`. + +##### Host header rewrite + +Pomerium now rewrites the host header to match the `to` URL consistently, including port if specified. Use [Preserve Host Header](/docs/reference/routes/headers#1-preserve-host-header) if you need to keep the original host. + +##### Session refresh reliability + +- Pomerium's approach to refreshing OAuth tokens changed to be more reliable, potentially increasing the rate of requests to your identity provider. +- You can restore the previous approach with runtime flag `legacy_identity_manager=true`. + +##### Deprecations + +- `client_ca` is removed. Use `downstream_mtls.ca` or `DOWNSTREAM_MTLS_CA` instead. + +### 0.25.0 + +#### Breaking + +##### Base64-encoded Certificates + +The `certificates` key no longer supports base64-encoded cert data (this was undocumented). Provide a file location instead. + +**Note**: The singular `certificate` key still supports base64-encoded cert data. + +##### Remove Debug Option + +Support for a `Debug` setting was removed. If you prefer pretty-print logs, pipe JSON logs into `jq`. + +#### New + +##### Authentication Flows + +- For self-hosted deployments, the flow reverts to a v0.20–like approach. +- For Hosted Authenticate, it continues with the flow introduced in v0.21. + +### 0.24.0 + +#### Breaking + +##### Remove `set_authorization_header` + +Use [Set Request Headers](/docs/reference/routes/headers#set-request-headers) with variable substitution to pass ID tokens upstream. + +##### Base64-encoded `certificates` Key + +Support was removed (the second mention). Provide a file path instead. + +##### Redis Storage + +Redis was deprecated as a data storage backend, replaced by PostgreSQL since v0.18. Redis is now removed. + +### 0.23.0 + +#### Logging Configs + +- [Access Log Fields](/docs/reference/access-log-fields) and [Authorize Log Fields](/docs/reference/authorize-log-fields) let you customize what fields are logged. + +#### Downstream mTLS Settings + +- Moved to a new `downstream_mtls` block. +- Support for CRLs, a new [Enforcement Mode](/docs/reference/downstream-mtls-settings#enforcement-mode), and optional [Match Subject Alt Names](/docs/reference/downstream-mtls-settings#match-sans). +- The [TLS Downstream Client Certificate Authority](/docs/reference/routes/tls#tls-downstream-client-certificate-authority) setting is deprecated. + +##### Breaking + +###### Set Request Headers `$` Substitution + +To avoid `$` being interpreted as a variable start, you may need to escape `$` with `$$`. + +### 0.22.0 + +#### New + +- [Hosted Authenticate Service](/docs/capabilities/authentication) is the default for SSO (no identity config needed). +- [Wildcard From Routes](/docs/reference/routes/from#wildcard-from-routes) in Beta. +- Improved memory usage in dynamic config environments. + +##### Breaking + +- Devices must be re-enrolled (internal data model changes). +- Forward auth is removed (subpar security). +- Bastion Host for TCP routes is now supported in a new way. + +### 0.21.0 + +#### Breaking + +- Re-enroll devices (data model changed, not forward compatible). +- Forward auth was removed in v0.21. +- Bastion host support for TCP routes. +- Internal TLS by default if you run Pomerium Enterprise. + +### 0.20.0 + +#### Breaking + +- `allowed_groups` and `groups` PPL criteria are removed for open source. Use IdP claims instead. +- IdP directory sync has moved to [External Data Sources](/docs/capabilities/integrations/) in Pomerium Enterprise. For open source, group membership must come from ID tokens. + +### 0.19.0 / 0.18.0 + +No changes required. + +### 0.17.0 + +#### Per Route OIDC + +- `idp_client_id` and `idp_client_secret` can now be specified per route. + +### 0.16.0 + +#### Breaking + +- Self-signed fallback certificates are newly generated if no match is found for service URLs. +- OIDC flow no longer sets default `access_type=offline` except for Google. +- Removed `signing_key_algorithm` option. +- Some GitHub group IDs changed from integer to slug with the new GraphQL approach. + +### 0.15.0 + +#### Breaking + +- Removed unused options: `grpc_server_max_connection_age`, `grpc_server_max_connection_age_grace`, `refresh_cooldown`. +- Ed25519 signing keys are no longer supported. +- Expanded PPL route syntax in `routes`. + +### 0.14.0 + +#### Breaking + +- Programmatic login domain whitelist introduced: default `localhost`. Use `programmatic_redirect_domain_whitelist` to configure. +- GitHub team IDs now use slugs instead of numeric IDs. +- `allowed_users` by ID no longer includes the identity provider prefix. + +### 0.13.0 + +#### Breaking + +- User impersonation and client-side service accounts removed (server-side approach in Enterprise now). +- `administrators` config option removed. + +### 0.12.0 + +- **TCP Proxying** introduced. + +### 0.11.0 + +#### Breaking + +- `enable_user_impersonation=false` by default. +- `cache_service_url` renamed to `databroker_service_url`. + +### 0.10.0 + +#### Breaking + +- Service accounts are required for group/directory data. +- `cache` service becomes `databroker`, storing identity data. +- `pass_identity_headers` must be explicitly set true if you want identity headers. + +### 0.9.0 + +#### Breaking + +- Default log level is `info`. +- HTTP 1.0 not supported. For HAProxy health checks, set `HTTP/1.1\r\nHost:pomerium`. + +### 0.8.0 + +#### Breaking + +- `from` routes with a path are no longer valid (use `prefix` instead). + +### 0.7.0 + +#### Breaking + +- By default, removed the `x-pomerium-authenticated-user-*` headers; replaced by `X-Pomerium-Jwt-Assertion` unless you set `jwt_claims_headers`. + +### 0.6.0 + +#### Breaking + +- A new `cache` service is introduced for back-end session data. + +### 0.5.0 + +#### Breaking + +- Subdomain requirement dropped; you can proxy any domain. +- Some IdPs (Okta, Azure, OneLogin) require group membership updates. +- Programmatic Access API changed from `/api/v1/token` to a per-route OAuth2 flow. +- Forward-auth route verification changed from path-based to query string-based. + +### 0.4.0 + +#### Breaking + +- `authorize_service_url` is no longer needed in all-in-one mode. +- `AUTHENTICATE_INTERNAL_URL` is removed. +- No default certificate location. +- Authorize service health checks are not HTTP-based in distributed mode. + +### 0.3.0 / 0.2.0 / 0.1.0 / 0.0.5 + +#### Breaking Highlights + +- Policy `from` field must contain a valid scheme (0.1.0). +- `POLICY_FILE` removed (0.0.5). + + + + + +## Upgrading Pomerium Enterprise + +Please review these deprecations and important changes for Pomerium Enterprise before upgrading. + +:::caution + + +::: + +### v0.28.0 + +No breaking changes in v0.28. + +### v0.27.0 + +#### Before you upgrade + +##### New + +- A “Report Issue” feedback widget in the Enterprise Console, loaded from a third-party script. Disable with [`--disable-feedback-widget`](/docs/deploy/enterprise/configure#disable-feedback-widget). + +##### Changed + +- `--disable-validation` is now deprecated. Use [`--validation-mode=none`](/docs/deploy/enterprise/configure#validation_mode) to preserve existing behavior, or [`--validation-mode=static`](/docs/deploy/enterprise/configure#validation_mode). We'll remove `--disable-validation` in a future release. + +- The Enterprise Console now includes a “Report issue” feedback widget, allowing you to easily report any problems you may encounter. +- IdP directory sync performance has been improved, especially when using Okta. +- The policy builder has a new “Exists” condition for use with external data source records. +- When configuring an external data source, the “Foreign Key” input will now display all valid choices. +- The `--disable-validation` option has been expanded to include additional validation modes, represented by [`--validation-mode`](https://www.pomerium.com/docs/deploy/enterprise/configure#validation_mode). + +- A few policy builder UI bugs are fixed: + - The “Claim” criterion now correctly displays claim names containing a “/” character. + - The “Record” criterion now correctly displays the value “0”. + +### v0.27.1 + +- Restrict the debug “DataBroker Browser” page to users with global admin privileges. +- Fix the Kubernetes service account token route setting (previously had no effect). +- Fix the database migration command to synchronize schema version metadata on rollback. + +### v0.27.2 + +- Fix a bug with the route “To” option. + +### v0.27.3 + +- Integrate with FleetDM to support policy enforcement based on device state. +- Improve handling of external data source records; stale records are removed. +- Add a “Kubernetes Service Account Token File” route setting. +- Make the “From” URL on the routes list page into a link. +- Fix an issue where newly-created entities might not appear right away in list pages. +- Fix table content overlap and tooltip flicker in charts. +- Fix a potential error on the “Runtime” dashboard. +- Rename the “Identity Provider” settings tab to “Directory Sync.” + +### v0.26.0 + +- Expanded policy builder functionality: reference client certificate Subject Alternative Names; require trusted client certificate per route; numeric comparisons in external data sources; external data keyed by client certificate fingerprint; direct-response routes; new Rego `print()` debugging. +- Various UI fixes, improved logout detection, license usage metrics, etc. + +### v0.25.0 + +#### Before you upgrade + +##### Breaking + +###### Base64-encoded Certificates + +As with Core, the `certificates` key no longer supports inline base64. Use a file location. + +###### Remove Debug Option + +We've removed the Debug setting. If you prefer pretty-print logs, pipe JSON logs into `jq`. + +##### New + +###### Authentication Flows + +For self-hosted deployments, the flow is more like v0.20. For Hosted Authenticate, it continues with the flow from v0.21. + +- Remove support for the `debug` option in the Console. +- Various UI improvements to route import, which now supports `allow_public_unauthenticated_access`, `allow_any_authenticated_user`, and `allowed_idp_claims`. +- Adds an optional, global-level [Pass Identity Headers](/docs/reference/pass-identity-headers) setting (always had per-route, now also global). +- Removed support for the [Secure Cookie](https://en.wikipedia.org/wiki/Secure_cookie) setting; it's always enabled by default. +- Multiple Open Telemetry improvements. + +### v0.25.1 + +- Removes the **cookie secure** backend logic from the Enterprise Console. + +### 0.24.0 + +#### Before you upgrade + +##### Breaking + +- `set_authorization_header` was removed. Use [Set Request Headers](/docs/reference/routes/headers#set-request-headers) for ID tokens. + +- Removed support for the deprecated `set_authorization_header`. +- The Enterprise Console no longer logs gRPC payload data. +- PPL builder can now configure device auth via client certificates. +- Performance improvements with configuration and service account syncs. +- Various UI improvements, plus a fix to prevent missing policy criteria during route migrations. +- Various Telemetry fixes in the Console. + +### 0.23.0 + +#### Before you upgrade + +##### Breaking + +- For [`set_request_headers`](/docs/reference/routes/headers#set-request-headers), replace `$` with `$$` to avoid variable substitution. + +- New token substitutions in [Set Request Headers](/docs/reference/routes/headers#set-request-headers): client cert fingerprint, ID token, and access token. +- [Access Log Fields](/docs/reference/access-log-fields) and [Authorize Log Fields](/docs/reference/authorize-log-fields) can be customized. +- [Cookies SameSite](/docs/reference/cookies#cookie-samesite) is configurable in the Console. +- `$` must be escaped with `$$` in set_request_headers. + +### 0.22.0 + +#### Before you upgrade + +##### New + +- Hosted Authenticate Service enabled by default. +- Wildcard From Routes (beta). +- Memory usage improvements. + +##### Fixes + +- Changes to device credential references and external data source links in the Console. + +##### Changed + +- Adds DNS Lookup Families and requires a name for new Namespaces. + +- Security patch updates to Go v1.20.3 and Envoy v1.24.5. +- Removes user references when a device credential is deleted. +- External data source link only if provider is configured. +- DNS Lookup Families default to V4_PREFERRED. +- Namespaces require a name. + +### 0.21.0 + +#### Before you upgrade + +##### Breaking + +- Re-enroll devices: device identity changed in a non-forward-compatible way. +- `--derive-tls` can auto-generate internal TLS certs from `shared_secret`. + +- Auto TLS support for Console/Databroker gRPC endpoints. +- Client TLS renegotiation for upstream clusters. +- Various console UI fixes. + +### v0.21.1 + +- Fix empty headers, custom text fields, and other UI errors. +- Pass TLS options to HTTP clients. +- Remove device credential references from user/session. + +### 0.20.0 + +#### Before you upgrade + +##### Groups & directory sync + +Moved to [External Data Sources](/docs/capabilities/integrations/). Remove references to `idp_service_account` in config. Instead, configure directory sync from Settings > Identity Provider in the Enterprise Console. + +- Groups & directory sync is now managed from external data sources. +- UI improvements, bug fixes in policy builder, and performance improvements. +- Envoy updated to v1.23.1. + +### v0.20.1 + +- UI fixes and improvements to branding settings. + +### 0.19.0 + +No breaking changes. + +### 0.18.0 + +#### Before you upgrade + +- Use [Postgres](/docs/internals/data-storage#postgres) for `external-data` integration. Redis is deprecated for storage. + +- Support for external data sources. +- Simplified Kubernetes ingress. +- Postgres databroker backend and Envoy 1.21.1. +- Data in the Authorize service is queried on-demand. +- Various internal URL, forward auth, and in-memory datastore fixes. + +### 0.17.0 + +#### Before you upgrade + +- `license-key` is now required. + +- Pomerium Enterprise now requires a valid license to start. +- Route and Policy screens redesigned for better UX. + +### 0.16.0 + +#### Before you upgrade + +- `signing-key` replaced with `authenticate-service-url`. If you keep `signing-key`, device enrollment won't work. Use the self-hosted or hosted Authenticate service URL instead. + +- Devices can be managed, enrolled, and used in policy. +- Signing keys can be pulled from the Authenticate service's JWKS endpoint. +- Added ability to write policy for HTTP method/path contexts. +- Envoy upgraded to 1.20.1. +- Various UI and bug fixes. + +### 0.15.0 + +#### Before you upgrade + +- `signing-key` is now required to secure requests from Pomerium Core. Must match Core's own `signing_key`. +- `audience` must match the external hostname for the Enterprise Console. + +##### Helm Installations + +- Helm charts are consolidated. Use `pomerium/pomerium-console` instead of `pomerium-enterprise` charts. Make sure to share the same `signing-key` with Core. + +- Real-time metrics in the Console. +- New extended policy language for non-identity-based conditions. +- Support for Google Cloud Serverless and SPDY routes. +- Overlapping SANs not permitted. +- Time-based criteria in policies. +- Only global admins may manage Rego-based policies. +- Simplified service accounts with token expiration and namespaces. +- Session-based impersonation. + +### v0.15.1 + +- Tracing settings now persist correctly. +- Support multiple audiences. +- Better validation and UI fixes. + +### v0.15.2 + +- Fix a regression in the Deployments page loading. + + + + diff --git a/content/docs/enterprise.md b/content/docs/enterprise.md deleted file mode 100644 index cffc6b6b7..000000000 --- a/content/docs/enterprise.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: Pomerium Enterprise -description: Learn what features come with Pomerium Enterprise, including a Console GUI where you can manage your policies, namespaces, groups, routes, and more. -keywords: - [ - Pomerium Enterprise, - PPL Builder, - Console GUI, - namespaces, - directory sync, - device management, - groups, - programmatic api, - branding, - ] ---- - -import ClearIcon from '@mui/icons-material/Clear'; - -# Pomerium Enterprise - -Pomerium Enterprise is built on our open-source Pomerium Core offering. Pomerium Enterprise makes Pomerium easier to manage at scale, and adds additional functionality aimed at organizations with auditing, compliance, governance, and risk management needs. - -## Pomerium Enterprise Features - -Pomerium Enterprise comes with all the capabilities in Pomerium Core, plus the following features: - -### Enterprise Console - -The **Enterprise Console** provides a dashboard where you can view traffic and logs, manage routes and policies, import external data, configure global and namespaced settings, and more. - -![An overview animation of the Pomerium Enterprise Console](./enterprise/img/enterprise-console-overview.gif) - -### Enterprise API - -The **Enterprise API** helps you manage your configuration with your preferred programming language or infrastructure management tool. - -Everything that is manageable in the Enterprise Console can also be driven programmatically through the [Enterprise API](/docs/capabilities/enterprise-api). - -### Session Management - -The **Sessions** dashboard allows you to view and manage sessions within your organization. Admin members can export session data and revoke sessions in real time. - -![View and manage sessions in the Enterprise Console's Sessions dashboard](./enterprise/img/manage-sessions.png) - -:::enterprise - -Ready to upgrade to Pomerium Enterprise? [**Contact us**](https://www.pomerium.com/enterprise-sales/) today to get started. - -::: - -### Namespaces and Self-Service - -The **Namespaces** dashboard is where you configure user roles and permissions for routes, policies, and the Enterprise Console itself. Once you’ve configured a [Namespace](/docs/capabilities/namespacing), members of that namespace can self-manage access to the infrastructure they build from or depend on. - -Pomerium Enterprise allows you to import groups defined by your identity provider. This allows you to build stable policies that don’t require adjustments as your company changes. - -![Manage Namespaces in the Enterprise Console's Namespaces dashboard](./enterprise/img/manage-namespaces.gif) - -### Deployment History and Audit Logs - -The **Deployments** dashboard allows you to view and export change logs from the Enterprise Console. Select a change to review which user applied it and when. - -![View deployments in the Enterprise Console's Deployments dashboard](./enterprise/img/deployments-dashboard.gif) - -### Directory Sync - -Pomerium Enterprise's [**Directory Sync**](/docs/capabilities/directory-sync) feature allows you to import your identity provider's directory data. After a successful sync, you can use your internal groups and teams data when building policies. ![Viewing the Identity Providers settings for a directory sync in the Enterprise Console](./enterprise/img/directory-sync-2.png) - -### External Data Sources - -In the **External Data** dashboard, you can import, view, and manage [external data sources](/docs/capabilities/integrations). After a successful sync, you can use data unique to your organization to serve as context in your authorization policies. ![Using the External Data Source Record type in a policy](./enterprise/img/external-data-as-context.gif) - -## Pomerium Enterprise features comparison - -| Features | Pomerium Core | Pomerium Enterprise | -| :-- | :-- | :-- | -| Identity-based Access | ![Pomerium checkmark](./enterprise/img/pomerium-checkmark.svg) | ![Pomerium checkmark](./enterprise/img/pomerium-checkmark.svg) | -| SSO Support | ![Pomerium checkmark](./enterprise/img/pomerium-checkmark.svg) | ![Pomerium checkmark](./enterprise/img/pomerium-checkmark.svg) | -| Declarative Authorization Policy | ![Pomerium checkmark](./enterprise/img/pomerium-checkmark.svg) | ![Pomerium checkmark](./enterprise/img/pomerium-checkmark.svg) | -| TCP Support | ![Pomerium checkmark](./enterprise/img/pomerium-checkmark.svg) | ![Pomerium checkmark](./enterprise/img/pomerium-checkmark.svg) | -| Enterprise Console | | ![Pomerium checkmark](./enterprise/img/pomerium-checkmark.svg) | -| [Enterprise API](/docs/capabilities/enterprise-api) | | ![Pomerium checkmark](./enterprise/img/pomerium-checkmark.svg) | -| [Session Management](/docs/capabilities/metrics#sessions) | | ![Pomerium checkmark](./enterprise/img/pomerium-checkmark.svg) | -| [Namespaces](/docs/capabilities/namespacing) | | ![Pomerium checkmark](./enterprise/img/pomerium-checkmark.svg) | -| [Directory Sync](/docs/capabilities/directory-sync) | | ![Pomerium checkmark](./enterprise/img/pomerium-checkmark.svg) | -| [User Impersonation](/docs/capabilities/impersonation) | | ![Pomerium checkmark](./enterprise/img/pomerium-checkmark.svg) | -| [Deployment History](/docs/capabilities/metrics#changesets-and-deployments) | | ![Pomerium checkmark](./enterprise/img/pomerium-checkmark.svg) | -| [Device Identity](/docs/capabilities/device-identity) | | ![Pomerium checkmark](./enterprise/img/pomerium-checkmark.svg) | -| [Custom Branding](/docs/capabilities/branding) | | ![Pomerium checkmark](./enterprise/img/pomerium-checkmark.svg) | -| [Service Accounts](/docs/capabilities/service-accounts) | | ![Pomerium checkmark](./enterprise/img/pomerium-checkmark.svg) | -| [Metrics](/docs/capabilities/metrics) | | ![Pomerium checkmark](./enterprise/img/pomerium-checkmark.svg) | -| [External Data Sources](/docs/capabilities/integrations) | | ![Pomerium checkmark](./enterprise/img/pomerium-checkmark.svg) | - -## Next Steps - -:::enterprise - -Already upgraded to Pomerium Enterprise, but need some help setting up the Enterprise Console? - -The following docs can help: - -- [**Install Pomerium Enterprise**](/docs/enterprise/install) -- [**Pomerium Enterprise Configuration**](/docs/enterprise/configure) -- [**Pomerium Enterprise Quickstart**](/docs/enterprise/quickstart) - -::: diff --git a/content/docs/enterprise/changelog.mdx b/content/docs/enterprise/changelog.mdx deleted file mode 100644 index 5a2cd7820..000000000 --- a/content/docs/enterprise/changelog.mdx +++ /dev/null @@ -1,365 +0,0 @@ ---- -# cSpell:ignore rankinc fleetdm - -title: Changelog -toc_max_heading_level: 5 ---- - -import Versioning from '../admonitions/_semantic-versioning.mdx'; - -# Changelog - -:::note - - - -::: - -## 0.27.3 - -### New - -- Integrate with FleetDM to support policy enforcement based on device state. With this integration you can ensure that only trusted devices are allowed to access certain routes. See the [FleetDM Integration](/docs/integrations/fleetdm) page for more information. -- Improve handling of external data source records. If a data source is removed, or if a data source no longer contains a particular record type, any corresponding data records will be removed as well. This will prevent stale data record types from showing in the policy builder UI. -- Add a “Kubernetes Service Account Token File” route setting. -- Make the “From” URL on the routes list page into a link. - -### Fixed - -- Fix an issue where newly-created entities might not appear right away in the corresponding list page. -- Fix an issue where list page table contents might overlap. -- Fix an issue where hovering over a chart might cause a tooltip to flicker. -- Fix a potential error on the “Runtime” dashboard page. - -### Changed - -- Rename the “Identity Provider” settings tab to “Directory Sync” to clarify its purpose. - -## 0.27.2 - -### Fixed - -- Fix a bug with the route “To” option. - -## 0.27.1 - -### Security - -- Restrict the debug “DataBroker Browser” page to users with global admin privileges. - -### Fixed - -- Fix the Kubernetes service account token route setting. (Previously this setting was present in the UI but had no effect.) -- Fix the database migration command to synchronize the schema version metadata when rolling back to a previous schema version. - -## 0.27.0 - -### New - -- The Enterprise Console now includes a “Report issue” feedback widget, allowing you to easily report any problems you may encounter. We look forward to hearing your feedback! - - This widget is loaded from a third-party service. If you do not wish to include this on your Enterprise Console installation, you can disable the feedback widget by setting the new option [`--disable-feedback-widget`](/docs/enterprise/configure#disable-feedback-widget). - -- IdP directory sync performance has been improved, especially when using Okta. -- The policy builder has a new “Exists” condition for use with external data source records. This condition is true when an incoming request matches any record in the selected external data source. - - As an example use case: you could maintain an external data source with a list of approved client certificates (keyed by certificate fingerprint), and enforce that incoming requests must match one of the approved client certificates. - -- When configuring an external data source, the ”Foreign Key” input will now display all valid choices, making it easier to configure. -- The `--disable-validation` option has been expanded to include an additional validation mode. The existing validation modes are now represented by a new option [`--validation-mode`](/docs/enterprise/configure#validation_mode). There are now three modes: - - - `full`, the default validation mode - - `static`, a lighter-weight validation mode that should still catch most potential issues - - `none`, equivalent to the existing `--disable-validation` option - - Additionally, the `none` mode now also disables a safety check related to overlapping certificate domain names. - -### Fixed - -- A few policy builder UI bugs are fixed: - - The “Claim” criterion now correctly displays claim names containing a “/” character. - - The “Record” criterion now correctly displays the value “0”. - -## 0.26.0 - -### New - -Expanded Pomerium policy builder functionality: - -- Policies can now reference a client certificate's **Subject Alternative Name**. You can specify criteria matching against DNS name, URI, or email address. -- There is a new **Require Trusted Client Certificate** toggle at the top of the policy builder, for use with the `policy` [mTLS enforcement mode](/docs/reference/downstream-mtls-settings#enforcement-mode). In this mode, you can configure Pomerium to require client certificates only on certain routes. (In the other mTLS enforcement modes, a client certificate is required for all Pomerium routes.) -- **Numerical comparison operators** (`<`, `<=`, `=`, `>=`, and `>`) for use with external data sources. For example, if you have an external data source with a numerical field named `trust_score`, you can now express a condition like `trust_score >= 5`. - -External data sources can now be keyed based on **client certificate fingerprint**, using the key `request.client_certificate.fingerprint`. - -Added **license metrics** `mau.usage`, `mau.limit`, and `license.expires_in` to support monitoring and alerting around license renewal. - -Routes can now be configured to serve a static **direct response** (consisting of an HTTP status code and some fixed body data). - -Added support for the Rego [**`print()`**](https://www.openpolicyagent.org/docs/latest/policy-reference/#debugging) function, to help when writing custom Rego policies. Anything passed to this function will be logged at the Debug level. - -### Fixed - -- The Deployments page now indicates changes made via user impersonation. -- Improved logout detection. -- Various other UI fixes. - -## 0.25.1 - -### Fixed - -- Removes the **cookie secure** backend logic from the Enterprise Console. - -## 0.25.0 - -### Breaking - -- In this release, we removed support for the `debug` option in the Enterprise Console. - -### Fixed - -- Various UI improvements and an update to the route import feature to support the following PPL criteria when importing routes into Enterprise: - - `allow_public_unauthenticated_access` - - `allow_any_authenticated_user` - - `allowed_idp_claims` - -### Changed - -- Adds an optional, global-level [Pass Identity Headers](/docs/reference/pass-identity-headers) setting, which sends identity headers to all upstream applications when enabled. If you want to forward identity headers only to a specific upstream application, you can still use the [per-route Pass Identity Headers](/docs/reference/routes/pass-identity-headers-per-route) setting. -- Removes support for the [Secure Cookie](https://en.wikipedia.org/wiki/Secure_cookie) setting. It is always enabled by default. -- Improved error messages and multiple Open Telemetry improvements - -## 0.24.0 - -### Breaking - -- Removes support for the deprecated `set_authorization_header` setting. You can use the [Set Request Headers](/docs/reference/routes/headers#set-request-headers) setting to pass IdP tokens to upstream services in any header. - -### Security - -- Previously, the Enterprise Console logged gRPC calls and their payload data. This release removes payload data from the logs. - -### New - -- Now, you can configure device authentication using client certificates in the Enterprise Console's PPL builder. -- Performance improvements with configuration and service account syncs. - -### Fixed - -- Various UI improvements, and a fix that prevents missing policy criteria when migrating routes. - -### Changed - -- Various Telemetry fixes in the Console. - -## 0.23.0 - -### New - -- [Set Request Headers](/docs/reference/routes/headers#set-request-headers) has three new new token substitution values that it can send to upstream apps or services: - - **Client certificate fingerprint** (the short-form SHA-256 fingerprint of the presented client certificate) - - **ID token** (the OIDC ID token from the identity provider) - - **Access token** (the OAuth access token from the identity provider) -- [Access Log Fields](/docs/reference/access-log-fields) and [Authorize Log Fields](/docs/reference/authorize-log-fields) settings allow you to customize the values that are logged in the access and authorize logs. -- [Cookies SameSite](/docs/reference/cookies#cookie-samesite) is now configurable in the Enterprise Console. - -### Breaking - -- When using `set_request_headers`, to prevent a ‘$’ character from being treated as the start of a variable substitution, you may need to replace it with ‘$$’. - -## 0.22.0 - -### Security patch - -- Pomerium upgraded to [Go v1.20.3](https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8/m/OV40vnafAwAJ) and [Envoy v1.24.5](https://groups.google.com/g/envoy-announce/c/o_W9gYVU2js/m/kU77ha6tBAAJ) to address security issues exposed in these packages. See the release notes in the links for more information. - -### New - -- [Hosted Authenticate Service](/docs/capabilities/hosted-authenticate-service.md) will now be used by default to handle single-sign-on. Pomerium hosts this service as a convenience to its users; no identity provider configuration or authenticate service url needs to be specified if the hosted authenticate service is used. [Self-hosted authenticate service](/docs/capabilities/self-hosted-authenticate-service.md) is still available for users who want to configure their own identity provider and authenticate service URL. -- [Wildcard From Routes](/docs/reference/routes/from#wildcard-from-routes) is a Beta support feature that allows you to define a wildcard route that points matching external routes to a single destination. -- [RDS changes](https://github.com/pomerium/pomerium/pull/4098) provide more consistent and linear memory performance that significantly reduces memory consumption, especially in environments with rapidly changing configurations. - -### Fixed - -- Removes user references when a device credential is deleted -- Displays external data source link only if provider exists - -### Changed - -- Adds additional DNS Lookup Families and defaults to V4_PREFERRED -- Requires a name when creating a Namespace - -## 0.21.1 - -### Fixed - -- Fixes for UI errors saving empty headers, custom text fields, and more - -### New - -- Pass TLS options to HTTP clients - -### Updated - -- Remove device credential references from the user and session - -## 0.21.0 - -### Breaking - -- Re-enroll devices and update device IDs due to non-forward compatible internal change - -### New - -- Auto TLS support for Console and Databroker gRPC endpoints -- Client TLS renegotiation for upstream clusters - -### Fixed - -- Fixes to the Enterprise Console's UI, builds, gRPC calls, and more - -## 0.20.1 - -### Fixed - -- UI fixes and improvements to branding settings - -## 0.20.0 - -### Breaking - -- Groups & Directory sync now managed and sourced from external data sources. See [upgrading](upgrading.mdx) for details. - -### Fixed - -- Dozens of UI fixes and improvements -- Fixed a bug in policy builder when using groups -- Performance improvements to generated metrics - -### Updated - -- Envoy updated to v1.23.1 - -## 0.19.0 - -### New - -- Additional error details and policy debugging for Enterprise -- ACME TLS-ALPN support for autocert -- Branding customization for Enterprise - -### Updated - -- Well-Known endpoint handler for Proxy -- Upgrade to Envoy 1.23.0 -- Add virtual host domains for all certificates -- Use generic types for sets and atomics - -### Fixed - -- Add CORS headers to JWKS endpoint -- Add authority header to outbound gRPC requests -- Remove not-null constraint on data column of record changes table - -## 0.18.0 - -### New - -- Support for external data sources -- Simplified Kubernetes ingress controller - -### Updated - -- Postgres databroker backend -- Upgrade to Envoy 1.21.1 -- Data in the Authorize service is now queried on-demand - -### Fixed - -- Various issues related to internal service URLs -- Error pages for forward auth -- Databroker in-memory backend deadlock - -## 0.17.0 - -### New - -- Pomerium Enterprise now requires a valid license to start. - -### Updated - -- Route and Policy screens have been redesigned for better UX. - -## 0.16.0 - -### New - -- Devices: It is now possible to manage, enroll, approve, and write authorization policy for device identity. -- Signing keys can now be dynamically pulled from the Authenticate service's JWKS endpoint. -- Added the ability to write PPL policy for HTTP method and path contexts. - -### Updated - -- Policies can now incorporate device identity and approval status. -- Routes certificate UI now shows the matching TLS certificate used. -- Routes now has Kubernetes service account token field -- Metric addresses are now shown in the runtime info dashboard. -- Envoy was upgraded to 1.20.1. -- The code editor now supports dark mode. -- Various UI style improvements and fixes. - -### Fixed - -- `--tls-insecure-skip-verify` was not applied to databroker connections. -- Fixed a bug in the host rewrite code (thank you @rankinc for reporting). -- Fixed a bug in the way timeout fields were being displayed. -- Fixed a bug in the way route header fields were being ordered. - -### Fixed - -## 0.15.2 - -### Fixed - -- A regression in the `Deployments` page loading has been corrected. - -## 0.15.1 - -### Fixed - -- Tracing settings now persist correctly. - -### Updated - -- Support configuring multiple audiences for the console. -- Improved configuration validation. -- Various UI style improvements. - -## 0.15.0 - -### New - -- [Telemetry] - View real time metrics and status from Pomerium components inside the Enterprise Console. -- More expressive policy syntax: Pomerium's new extended [policy language] allows more complex policies to be configured, along with non-identity based conditions for access. -- Support for [Google Cloud Serverless] configuration on routes. -- Support for [SPDY] configuration on routes. -- More consistent filtering and sorting across [resource listing pages][runtime]. - -### Updated - -- Certificate Management - Certificates with overlapping SAN names are no longer permitted. -- [Policies] - New editing screen supports Wizard based, Text based or Rego based policy. -- Policies - Only global administrators may manage Rego based policies. -- Policies - Support time based criteria. -- [Service Accounts] - Simplified UI. -- Service Accounts - Support token expiration time. -- Service Accounts - Namespace support. -- Impersonation - Impersonation is now done on an individual session basis. -- Various other bug fixes and improvements. - -[`signing key`]: /docs/reference/signing-key -[google cloud serverless]: /docs/reference/routes/enable-google-cloud-serverless-authentication -[policy language]: /docs/capabilities/ppl -[runtime]: /docs/capabilities/metrics.md#runtime -[spdy]: /docs/reference/routes/timeouts#spdy -[telemetry]: /docs/capabilities/metrics.md diff --git a/content/docs/enterprise/img/auth-flow-diagram.svg b/content/docs/enterprise/img/auth-flow-diagram.svg deleted file mode 100644 index f361156fe..000000000 --- a/content/docs/enterprise/img/auth-flow-diagram.svg +++ /dev/null @@ -1,399 +0,0 @@ -BrowserIdentity ProviderIngressPomeriumPomerium AuthNPomerium AuthZappGET /app/verify/appAuthenticated?No!HTTP 301 sign in callback urlHTTP 301: Oauth2 callback endpointSave sessionHTTP 301 app/verify/appAuthenticated?Yes!Authorized?Yes?HTTP 200OK!BrowserIdentity ProviderIngressPomeriumPomerium AuthNPomerium AuthZapp \ No newline at end of file diff --git a/content/docs/enterprise/img/certificates-valid-secure-certificate.png b/content/docs/enterprise/img/certificates-valid-secure-certificate.png deleted file mode 100644 index 68fc6275e..000000000 Binary files a/content/docs/enterprise/img/certificates-valid-secure-certificate.png and /dev/null differ diff --git a/content/docs/enterprise/img/cluster-cert-details.png b/content/docs/enterprise/img/cluster-cert-details.png deleted file mode 100644 index 63c05a971..000000000 Binary files a/content/docs/enterprise/img/cluster-cert-details.png and /dev/null differ diff --git a/content/docs/enterprise/img/compare-changes.png b/content/docs/enterprise/img/compare-changes.png deleted file mode 100644 index 5c32dca99..000000000 Binary files a/content/docs/enterprise/img/compare-changes.png and /dev/null differ diff --git a/content/docs/enterprise/img/console-route-traffic.png b/content/docs/enterprise/img/console-route-traffic.png deleted file mode 100644 index 259c48ed0..000000000 Binary files a/content/docs/enterprise/img/console-route-traffic.png and /dev/null differ diff --git a/content/docs/enterprise/img/create-external-data-source.png b/content/docs/enterprise/img/create-external-data-source.png deleted file mode 100644 index d4bbeac19..000000000 Binary files a/content/docs/enterprise/img/create-external-data-source.png and /dev/null differ diff --git a/content/docs/enterprise/img/deployments-dashboard.gif b/content/docs/enterprise/img/deployments-dashboard.gif deleted file mode 100644 index cc91afe5d..000000000 Binary files a/content/docs/enterprise/img/deployments-dashboard.gif and /dev/null differ diff --git a/content/docs/enterprise/img/directory-sync-2.png b/content/docs/enterprise/img/directory-sync-2.png deleted file mode 100644 index 13092dd64..000000000 Binary files a/content/docs/enterprise/img/directory-sync-2.png and /dev/null differ diff --git a/content/docs/enterprise/img/directory-sync.png b/content/docs/enterprise/img/directory-sync.png deleted file mode 100644 index f0a13b225..000000000 Binary files a/content/docs/enterprise/img/directory-sync.png and /dev/null differ diff --git a/content/docs/enterprise/img/enterprise-console-overview.gif b/content/docs/enterprise/img/enterprise-console-overview.gif deleted file mode 100644 index ba4f7e6c6..000000000 Binary files a/content/docs/enterprise/img/enterprise-console-overview.gif and /dev/null differ diff --git a/content/docs/enterprise/img/external-data-as-context.gif b/content/docs/enterprise/img/external-data-as-context.gif deleted file mode 100644 index e5ecc604d..000000000 Binary files a/content/docs/enterprise/img/external-data-as-context.gif and /dev/null differ diff --git a/content/docs/enterprise/img/jaeger.png b/content/docs/enterprise/img/jaeger.png deleted file mode 100644 index ea1b1b53d..000000000 Binary files a/content/docs/enterprise/img/jaeger.png and /dev/null differ diff --git a/content/docs/enterprise/img/manage-namespaces.gif b/content/docs/enterprise/img/manage-namespaces.gif deleted file mode 100644 index 85058b862..000000000 Binary files a/content/docs/enterprise/img/manage-namespaces.gif and /dev/null differ diff --git a/content/docs/enterprise/img/manage-sessions.png b/content/docs/enterprise/img/manage-sessions.png deleted file mode 100644 index 5716db8ab..000000000 Binary files a/content/docs/enterprise/img/manage-sessions.png and /dev/null differ diff --git a/content/docs/enterprise/img/metrics/external-data-sources-dashboard.png b/content/docs/enterprise/img/metrics/external-data-sources-dashboard.png deleted file mode 100644 index 926b32462..000000000 Binary files a/content/docs/enterprise/img/metrics/external-data-sources-dashboard.png and /dev/null differ diff --git a/content/docs/enterprise/img/metrics/traffic-dashboard.png b/content/docs/enterprise/img/metrics/traffic-dashboard.png deleted file mode 100644 index a0695aac4..000000000 Binary files a/content/docs/enterprise/img/metrics/traffic-dashboard.png and /dev/null differ diff --git a/content/docs/enterprise/img/new-enrollment.png b/content/docs/enterprise/img/new-enrollment.png deleted file mode 100644 index 99de9ce65..000000000 Binary files a/content/docs/enterprise/img/new-enrollment.png and /dev/null differ diff --git a/content/docs/enterprise/img/pomerium-checkmark.svg b/content/docs/enterprise/img/pomerium-checkmark.svg deleted file mode 100644 index 7f7271b7c..000000000 --- a/content/docs/enterprise/img/pomerium-checkmark.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/content/docs/enterprise/img/upgrading/idp_enterprise.png b/content/docs/enterprise/img/upgrading/idp_enterprise.png deleted file mode 100644 index c35c73ac3..000000000 Binary files a/content/docs/enterprise/img/upgrading/idp_enterprise.png and /dev/null differ diff --git a/content/docs/enterprise/img/upgrading/policy_groups_enterprise.png b/content/docs/enterprise/img/upgrading/policy_groups_enterprise.png deleted file mode 100644 index e9b25a287..000000000 Binary files a/content/docs/enterprise/img/upgrading/policy_groups_enterprise.png and /dev/null differ diff --git a/content/docs/enterprise/img/upgrading/v23/cookie-samesite.gif b/content/docs/enterprise/img/upgrading/v23/cookie-samesite.gif deleted file mode 100644 index 863433a46..000000000 Binary files a/content/docs/enterprise/img/upgrading/v23/cookie-samesite.gif and /dev/null differ diff --git a/content/docs/enterprise/img/upgrading/v23/logging-configs.gif b/content/docs/enterprise/img/upgrading/v23/logging-configs.gif deleted file mode 100644 index 0ac20d2e4..000000000 Binary files a/content/docs/enterprise/img/upgrading/v23/logging-configs.gif and /dev/null differ diff --git a/content/docs/enterprise/img/upgrading/v23/set-request-headers-fingerprint.png b/content/docs/enterprise/img/upgrading/v23/set-request-headers-fingerprint.png deleted file mode 100644 index 4a2e6d639..000000000 Binary files a/content/docs/enterprise/img/upgrading/v23/set-request-headers-fingerprint.png and /dev/null differ diff --git a/content/docs/enterprise/img/user-id.png b/content/docs/enterprise/img/user-id.png deleted file mode 100644 index 4da86334f..000000000 Binary files a/content/docs/enterprise/img/user-id.png and /dev/null differ diff --git a/content/docs/enterprise/img/view-deployments.png b/content/docs/enterprise/img/view-deployments.png deleted file mode 100644 index bac497ee7..000000000 Binary files a/content/docs/enterprise/img/view-deployments.png and /dev/null differ diff --git a/content/docs/enterprise/upgrading.mdx b/content/docs/enterprise/upgrading.mdx deleted file mode 100644 index d467622ea..000000000 --- a/content/docs/enterprise/upgrading.mdx +++ /dev/null @@ -1,186 +0,0 @@ ---- -title: Upgrading -description: This page contains the list of deprecations and important or breaking changes for Pomerium Enterprise. Please read it carefully. ---- - -import UpgradeNotice from '@site/content/docs/admonitions/_upgrade-versions.mdx'; - -# Upgrading Pomerium Enterprise - -Review the upgrade guide below before upgrading to the latest version of Pomerium Enterprise. - -:::caution - - - -::: - -## v0.28.0 - -There are no breaking changes in v0.28. - -## v0.27.0 - -### Before you upgrade - -#### New - -The Enterprise Console now includes a “Report issue” feedback widget, which is loaded from a third-party service. If you don't want to include this third-party script on your Enterprise Console installation, you can disable the feedback widget using the command-line option [`--disable-feedback-widget`](/docs/enterprise/configure#disable-feedback-widget), or by setting the environment variable [`DISABLE_FEEDBACK_WIDGET=true`](/docs/enterprise/configure#disable-feedback-widget). - -#### Changed - -The [`--disable-validation`](https://main.docs.pomerium.com/docs/enterprise/configure#disable-validation) configuration option is newly deprecated. If you are currently using it, please update your configuration to either use: - -- [`--validation-mode=none`](/docs/enterprise/configure#validation_mode) to preserve the existing behavior, or -- [`--validation-mode=static`](/docs/enterprise/configure#validation_mode), to try a new lighter-weight validation mode. - -We will remove the `--disable-validation` option in a future release. - -## v0.25.0 - -### Before you upgrade - -#### Breaking - -##### Base64-encoded Certificates - -- Previously, the `certificates` key supported base64-encoded certificates as a value (this option was not documented). We've removed support for base64-encoded certificates for this setting and now require that you only use the certificate file location. To avoid issues between versions, please update these values accordingly. - -**Note:** The `certificates` key is distinct from the `certificate` key. The `certificate` key setting still supports base64-encoded certificates; the `certificates` _list_ does not. - -##### Remove Debug Option - -We've removed support for the Debug setting, which changed the format of logs from JSON to a pretty-print format. If you prefer to review logs in a pretty-print format, you can use a command-line processing tool like `jq`. - -#### New - -##### Authentication Flows - -In v0.21, we modified the Core authentication flow to support the [Hosted Authenticate](https://www.pomerium.com/docs/capabilities/hosted-authenticate-service) service. However, this flow posed some limitations for self-hosted deployments (see [#4819](https://github.com/pomerium/pomerium/issues/4819) for more details). In v0.25, we’ve updated the Core authentication flow so that it’s more versatile: Deployments configured to use the Hosted Authenticate service will use the newer authentication flow introduced in v0.21, while self-hosted deployments will use the older flow. - -## 0.24.0 - -### Before you upgrade - -#### Breaking - -- The deprecated `set_authorization_header` has been removed. If you relied on this setting to pass ID tokens to upstream applications, please update your instance to use [Set Request Headers](/docs/reference/routes/headers#set-request-headers) before upgrading. - -## 0.23.0 - -### Before you upgrade - -#### Breaking - -- When using [`set_request_headers`](/docs/reference/routes/headers#set-request-headers), to prevent a ‘$’ character from being treated as the start of a variable substitution, you may need to replace it with ‘$$’. - -## 0.22.0 - -### Before you upgrade - -#### New - -##### Hosted Authenticate Service - -- [Hosted Authenticate Service](/docs/capabilities/hosted-authenticate-service.md) will now be used by default to handle single-sign-on. Pomerium hosts this service as a convenience to its users; no identity provider configuration or authenticate service url needs to be specified if the hosted authenticate service is used. [Self-hosted authenticate service](/docs/capabilities/self-hosted-authenticate-service.md) is still available for users who want to configure their own identity provider and authenticate service URL. - -##### Wildcard From Routes - -- [Wildcard From Routes](/docs/reference/routes/from#wildcard-from-routes) is a Beta support feature that allows you to define a wildcard route that points matching external routes to a single destination. - -##### Better Memory Performance - -- Internal [RDS changes](https://github.com/pomerium/pomerium/pull/4098) reduce memory consumption, offering a more consistent and linear memory performance, especially for environments with rapid configuration changes. - -#### Fixes - -v0.22.0 includes changes to device credential user references and external data source links in the Console. - -#### Changed - -v0.22.0 adds additional DNS Lookup Families and now requires a name when creating a Namespace. - -## 0.21.0 - -### Before you upgrade - -#### Breaking - -##### Re-enroll devices - -The [devices (beta)](/docs/capabilities/device-identity) data model had an internal change that is not forward compatible. Please re-register your enrolled devices and update their device IDs. You may need to update your existing policies as well. - -#### Auto TLS - -- You can autogenerate TLS certificates to secure communication between the Enterprise Console and the Databroker services with the `--derive-tls=domains` configuration setting. The `derive-tls` setting derives your CA from your `shared_secret` and generates TLS certificates to protect the Databroker gRPC endpoint. - -#### Client TLS renegotiation - -- You can renegotiate server-initiated TLS for upstream clusters with the new `tls_upstream_allow_renegotiation` configuration setting. - -#### Fixes - -- v0.21.0 includes various fixes to the Enterprise Console's UI, builds, gRPC calls, and more. - -## 0.20.0 - -### Before You Upgrade - -#### Groups & directory sync are managed from external data sources - -IdP directory sync has been moved to be part of the [External Data Sources integration](/docs/capabilities/integrations/), in order to provide unification with other external data sources, consolidate job scheduling and monitoring. Setting the below options in Pomerium config file would now result in an error. In Pomerium Enterprise Console, please navigate to Settings > Identity Provider and configure directory sync there. - -![idp_enterprise](../enterprise/img/upgrading/idp_enterprise.png) - -- `idp_service_account`: use IdP provider specific options in the UI. -- `idp_refresh_directory_timeout`: use [Polling Min Delay](/docs/reference/identity-provider-settings#identity-provider-polling-minmax-delay). -- `idp_refresh_directory_interval`: replaced by [Polling Max Delay](/docs/reference/identity-provider-settings#identity-provider-polling-minmax-delay). -- `idp_qps`: not required, IdP providers adjust their qps rate. - -Pomerium Core would only perform user authentication and session refresh with the IdP provider, and would not try to synchronize user details and groups, which is now part of [External Data Sources](/docs/capabilities/integrations/). Please review your [identity provider's](/docs/identity-providers/) docs for instructions specific to your IdP (e.g. `Identity Providers` -> `Google` -> `Directory Sync (Enterprise)`). - -## 0.19.0 - -### No changes required to upgrade - -- This release has no breaking changes. Review the [v19 Changelog](/docs/enterprise/changelog#0190) for more information. - -## 0.18.0 - -### Before You Upgrade - -- When using [`external-data`](/docs/capabilities/integrations/) the Databroker backend for Pomerium should be switched from Redis to [Postgres](/docs/internals/data-storage#postgres). - -## 0.17.0 - -### Before You Upgrade - -- The new `license-key` option is required for starting Pomerium Enterprise. Please contact your account team if you have not been issued one yet. - -## 0.16.0 - -### Before You Upgrade - -- The [`signing-key`](/docs/reference/signing-key) has been replaced with [`authenticate-service-url`](/docs/reference/service-urls#authenticate-service-url). Instead of manually setting the signing key in the Enterprise Console to match the Authenticate Service, we specify the trusted URL of the Authenticate Service to pull the signing key from. - - The `signing-key` key will continue to work for existing configurations, but [device enrollment](/docs/capabilities/device-identity#new-enrollment-enterprise) will not work until it is replaced by `authenticate-service-url`. - -## 0.15.0 - -### Before You Upgrade - -- `signing-key` is now a required option to improve request security from Pomerium Core. The value should match the one set in Pomerium Core. See the [signing key] reference page for more information on generating a key. -- `audience` is now a required option to improve request security from Pomerium Core. The value should match the Enterprise Console's external URL hostname, as defined in the [`from`](/docs/reference/routes) field in the Routes entry (not including the protocol). - -[signing key]: /docs/reference/signing-key - -### Helm Installations - -- As of v0.15.0, All Helm charts have been consolidated to a single repository. Remove the `pomerium-enterprise` repo and upgrade from `pomerium`: - - ```bash - helm repo remove pomerium-enterprise - helm upgrade --install pomerium-console pomerium/pomerium-console --values=pomerium-console-values.yaml - ``` - -- As noted above, `signing-key` must be shared between Pomerium and Enterprise. See the [Update Pomerium](/docs/guides/helm#update-pomerium) section of [Install Pomerium Enterprise in Helm](/docs/guides/helm) for more information. diff --git a/content/docs/get-started/fundamentals/core/_category_.json b/content/docs/get-started/fundamentals/core/_category_.json new file mode 100644 index 000000000..b58ce41c4 --- /dev/null +++ b/content/docs/get-started/fundamentals/core/_category_.json @@ -0,0 +1,3 @@ +{ + "label": "Self-Managed (Core)" +} diff --git a/content/docs/courses/fundamentals/advanced-policies.md b/content/docs/get-started/fundamentals/core/advanced-policies.md similarity index 69% rename from content/docs/courses/fundamentals/advanced-policies.md rename to content/docs/get-started/fundamentals/core/advanced-policies.md index 835c15e70..b4b24fb1e 100644 --- a/content/docs/courses/fundamentals/advanced-policies.md +++ b/content/docs/get-started/fundamentals/core/advanced-policies.md @@ -9,29 +9,29 @@ sidebar_position: 5 # Build Advanced Policies -In this guide, you’ll learn how to build **Advanced Policies** with Pomerium. +In this guide, you'll learn how to build **Advanced Policies** with Pomerium. :::note **Before You Start** -Make sure you’ve completed the following tutorials: +Make sure you've completed the following tutorials: -- [**Get Started**](/docs/courses/fundamentals/get-started) -- [**Build a Simple Route**](/docs/courses/fundamentals/build-routes) -- [**Build a Simple Policy**](/docs/courses/fundamentals/build-policies) -- [**Identity Verification with JWTs**](/docs/courses/fundamentals/jwt-verification) +- [**Get Started**](/docs/get-started/fundamentals/core/get-started) +- [**Build a Simple Route**](/docs/get-started/fundamentals/core/build-routes) +- [**Build a Simple Policy**](/docs/get-started/fundamentals/core/build-policies) +- [**Identity Verification with JWTs**](/docs/get-started/fundamentals/core/jwt-verification) -Each tutorial builds on the same configuration files. In this tutorial, you’ll add complexity to your authorization policy. +Each tutorial builds on the same configuration files. In this tutorial, you'll add complexity to your authorization policy. ::: -## What’s an advanced policy? +## What's an advanced policy? An “advanced policy” usually means the policy includes: - Chaining policy blocks - Additional operators, criteria, and matchers -For example, the policy below will only grant access if a user’s email address includes an `example.com` domain: +For example, the policy below will only grant access if a user's email address includes an `example.com` domain: ```yaml policy: @@ -51,17 +51,17 @@ Think of it like this: you have a dog, and obviously you normally let your dog i ### Evaluate claims -Let’s extend the policy above to include a claim from your JWT. If a user doesn’t have the matching claim in their JWT, Pomerium will deny the user access. +Let's extend the policy above to include a claim from your JWT. If a user doesn't have the matching claim in their JWT, Pomerium will deny the user access. 1. **Get the value of the** `Name` **claim** -While running your Docker containers, access the Verify service. Under **Signed Identity Token**, you’ll see a list of claims: +While running your Docker containers, access the Verify service. Under **Signed Identity Token**, you'll see a list of claims: ![JWT claims listed on a web page from the Verify service](./img/jwt-verification/01-jwt-claims.png) Find the **Name** claim and copy the value. -2. **Update your policy** +1. **Update your policy** Right now, your policy consists of one `allow` block with the `and` logical operator. @@ -79,7 +79,7 @@ The `or` operator grants access if either of two criteria are true. Right now, you only have one criterion: `domain`. -Let’s add a second criterion, `claim`, and add it to the same policy block: +Let's add a second criterion, `claim`, and add it to the same policy block: ```yaml policy: @@ -96,11 +96,11 @@ You use `/` to delimit the beginning of the sub-path. In this case, the claim we Replace `Your Name` with the value in your JWT. -Now, if a user’s email address includes `example.com` _or_ their claim matches the `Name` claim, Pomerium will grant the user access. +Now, if a user's email address includes `example.com` _or_ their claim matches the `Name` claim, Pomerium will grant the user access. ### Add a deny rule -Now, let’s add a second `deny` block to this policy. We will write a policy that denies access if a user’s email starts with `admin`. +Now, let's add a second `deny` block to this policy. We will write a policy that denies access if a user's email starts with `admin`. ```yaml policy: @@ -115,19 +115,19 @@ policy: starts_with: admin ``` -As is, this policy will deny access if a user’s email starts with `admin` (of course, you can change this value to whatever you want). +As is, this policy will deny access if a user's email starts with `admin` (of course, you can change this value to whatever you want). -Swap out the value with the beginning of your email address to test it out. This policy will still deny you access, even if your email’s domain and your JWT claim satisfy the `allow` block’s criteria. +Swap out the value with the beginning of your email address to test it out. This policy will still deny you access, even if your email's domain and your JWT claim satisfy the `allow` block's criteria. ## Summary In this tutorial, you built more advanced policies that require multiple rules, logical operators, matchers, and criteria. Then, you attached these policies to your routes. -Now, your Pomerium instance can evaluate claims and grant or deny access based on additional policies you’ve built! We’re teaching Pomerium to do exactly what you want it to do: Verify authorization whenever someone accesses a route. +Now, your Pomerium instance can evaluate claims and grant or deny access based on additional policies you've built! We're teaching Pomerium to do exactly what you want it to do: Verify authorization whenever someone accesses a route. Organizations with multiple applications and services will want to know how they can scale Pomerium for their needs. -In the next tutorial, you’ll learn how to build more complex routes! +In the next tutorial, you'll learn how to build more complex routes! ### Configuration file state @@ -167,13 +167,13 @@ Docker Compose: ```yaml services: pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest volumes: - ./config.yaml:/pomerium/config.yaml:ro ports: - 443:443 verify: - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest expose: - 8000 environment: diff --git a/content/docs/courses/fundamentals/advanced-routes.md b/content/docs/get-started/fundamentals/core/advanced-routes.md similarity index 77% rename from content/docs/courses/fundamentals/advanced-routes.md rename to content/docs/get-started/fundamentals/core/advanced-routes.md index 27a800c79..9df8ad133 100644 --- a/content/docs/courses/fundamentals/advanced-routes.md +++ b/content/docs/get-started/fundamentals/core/advanced-routes.md @@ -10,19 +10,19 @@ sidebar_position: 6 # Build Advanced Routes -Now that you’ve built advanced policies, let’s build on your routes a bit more. +Now that you've built advanced policies, let's build on your routes a bit more. :::note **Before You Start** -Make sure you’ve completed the following tutorials: +Make sure you've completed the following tutorials: -- [**Get Started**](/docs/courses/fundamentals/get-started) -- [**Build a Simple Route**](/docs/courses/fundamentals/build-routes) -- [**Build a Simple Policy**](/docs/courses/fundamentals/build-policies) -- [**Identity Verification with JWTs**](/docs/courses/fundamentals/jwt-verification) -- [**Build Advanced Policies**](/docs/courses/fundamentals/advanced-policies) +- [**Get Started**](/docs/get-started/fundamentals/core/get-started) +- [**Build a Simple Route**](/docs/get-started/fundamentals/core/build-routes) +- [**Build a Simple Policy**](/docs/get-started/fundamentals/core/build-policies) +- [**Identity Verification with JWTs**](/docs/get-started/fundamentals/core/jwt-verification) +- [**Build Advanced Policies**](/docs/get-started/fundamentals/core/advanced-policies) -Each tutorial builds on the same configuration files. In this tutorial, you’ll build new routes with some of Pomerium’s route-level settings. +Each tutorial builds on the same configuration files. In this tutorial, you'll build new routes with some of Pomerium's route-level settings. ::: @@ -40,7 +40,7 @@ For the purposes of this tutorial, we will only review the following settings to ### Configure HTTPBin -To see how some of these settings work, we will configure Pomerium and Docker Compose to host an HTTPBin server. If you’re not familiar with [HTTPBin](https://httpbin.org/), it’s a call-and-response HTTP server you can use to test (you guessed it) HTTP requests and responses. +To see how some of these settings work, we will configure Pomerium and Docker Compose to host an HTTPBin server. If you're not familiar with [HTTPBin](https://httpbin.org/), it's a call-and-response HTTP server you can use to test (you guessed it) HTTP requests and responses. Add the `httpbin` service to your Docker Compose file: @@ -113,7 +113,7 @@ Now, scroll down to **Response body**. You should see a payload like this: Because we added `pass_identity_headers`, we can see that the request includes the `X-Pomerium-Jwt-Assertion` header. This tells us that the identity header has been correctly passed to the upstream application (in this case, to HTTPBin). -Since we’re forwarding the JWT, let’s try adding the JWT Claims Headers global setting to your configuration file, right under the signing_key: +Since we're forwarding the JWT, let's try adding the JWT Claims Headers global setting to your configuration file, right under the signing_key: ```yaml signing_key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUVSNThaeDA2SHJXTW9PUTRaNjlMaDdMZUtFZW5TSmJZcHJvZ3V3TEl0blNvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK1FtamZKQ2ovdzkrOUhrRDVlbTlIZFhRM3ViUEhIdWNOMTlNOXJxR05PeEpTRmR3VHgvaAphdVkvcVFSWWR0YVpnVEpEUWZSYVQ2Q1pPYndSYTl2TXNnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= @@ -124,13 +124,13 @@ jwt_claims_headers: X-Pomerium-Claim-Name: name ``` -This setting sends JWT claims as _unsigned_ headers to the upstream application (unlike the _signed_ JWT assertion header). If you restart the Pomerium Docker instance and send another request to HTTPBin, you’ll notice these claims are included in the request: +This setting sends JWT claims as _unsigned_ headers to the upstream application (unlike the _signed_ JWT assertion header). If you restart the Pomerium Docker instance and send another request to HTTPBin, you'll notice these claims are included in the request: ![View JWT claims as unsigned headers in the request](./img/advanced-routes/httpbin-jwt-claims-headers.png) So, this adds headers from the JWT to our request, but what if you wanted to remove them for privacy or security reasons? Or what if you wanted to add other headers to your request? -This is where Pomerium’s flexibility comes in! Let’s try a few examples using our header settings. +This is where Pomerium's flexibility comes in! Let's try a few examples using our header settings. ### Set and remove request headers @@ -146,9 +146,9 @@ Under your `httpbin` route, add the following settings: - X-Pomerium-Claim-Name ``` -We’re telling Pomerium to add a header to the request called `X-Set-Request-Headers` with a value of `X-Value`. We’re also telling Pomerium to remove the `User` and `Name` claims that are included as unsigned claims headers. This ensures that these specific headers do _not_ reach the upstream application. +We're telling Pomerium to add a header to the request called `X-Set-Request-Headers` with a value of `X-Value`. We're also telling Pomerium to remove the `User` and `Name` claims that are included as unsigned claims headers. This ensures that these specific headers do _not_ reach the upstream application. -If you run `docker compose up` and check HTTPBin again, you’ll notice both the claims headers have been removed, and the test `X-Set-Request-Headers` header is there, too. +If you run `docker compose up` and check HTTPBin again, you'll notice both the claims headers have been removed, and the test `X-Set-Request-Headers` header is there, too. ### Set response headers @@ -166,17 +166,17 @@ Similarly, you can configure responses as well: - X-Pomerium-Claim-Name ``` -If you go HTTPBin’s **Response inspection** row and test a request, you’ll notice the test `X-Set-Response-Headers` header is included in the response. +If you go HTTPBin's **Response inspection** row and test a request, you'll notice the test `X-Set-Response-Headers` header is included in the response. ![View response headers](./img/advanced-routes/response-header.png) ### Set the Host header -You can also control the `Host:` header’s behavior, which is useful if your upstream server expects a certain value for this header. +You can also control the `Host:` header's behavior, which is useful if your upstream server expects a certain value for this header. For example, the value of the Host header is currently `httpbin`. -However, if you add `preserve_host_header` and set it to `true`, you’ll notice the value changes from `httpbin` to `httpbin.localhost.pomerium.io`: +However, if you add `preserve_host_header` and set it to `true`, you'll notice the value changes from `httpbin` to `httpbin.localhost.pomerium.io`: ```yaml title="config.yaml" - from: https://httpbin.localhost.pomerium.io @@ -191,9 +191,9 @@ However, if you add `preserve_host_header` and set it to `true`, you’ll notice preserve_host_header: true ``` -That’s because this setting preserves the Host header from the proxied request instead of taking the value from the destination’s hostname. +That's because this setting preserves the Host header from the proxied request instead of taking the value from the destination's hostname. -Alternatively, you can also use `host_rewrite_header` to change the Host header’s value to that of any incoming request (in this case, it would still be `httpbin.localhost.pomerium.io`). +Alternatively, you can also use `host_rewrite_header` to change the Host header's value to that of any incoming request (in this case, it would still be `httpbin.localhost.pomerium.io`). ```yaml title="config.yaml" - from: https://httpbin.localhost.pomerium.io @@ -342,7 +342,7 @@ routes: is: example.com ``` -Now, `cd` back into your root project and run the following command to build your Node server so it’s accessible inside your container: +Now, `cd` back into your root project and run the following command to build your Node server so it's accessible inside your container: ```bash docker compose up --build @@ -362,11 +362,11 @@ Next, in your Pomerium configuration file, add the `prefix:` setting and give it prefix: /admin ``` -Restart Docker and navigate to `https://nodeserver.localhost.pomerium.io`. Because this URL doesn’t include the `/admin` prefix in its path, Pomerium won’t match the route, which results in a `404` error. +Restart Docker and navigate to `https://nodeserver.localhost.pomerium.io`. Because this URL doesn't include the `/admin` prefix in its path, Pomerium won't match the route, which results in a `404` error. The `prefix` setting will only match the route if the request has the prefix in its path. So, if you try `https://nodeserver.localhost.pomerium.io/admin`, Pomerium should direct you to the `/admin` only page. -Next, let’s add `prefix_rewrite`. To use it, give `prefix_rewrite` the value of `/`. If the incoming request’s prefix matches the value of `prefix` (`/admin`), Pomerium will rewrite `prefix` to match the value of `prefix_rewrite`: +Next, let's add `prefix_rewrite`. To use it, give `prefix_rewrite` the value of `/`. If the incoming request's prefix matches the value of `prefix` (`/admin`), Pomerium will rewrite `prefix` to match the value of `prefix_rewrite`: ```yaml - from: https://nodeserver.localhost.pomerium.io @@ -377,18 +377,18 @@ Next, let’s add `prefix_rewrite`. To use it, give `prefix_rewrite` the value o Now, if you navigate to `https://nodeserver.localhost.pomerium.io/admin`, Pomerium will redirect you to the `/` page. -If you don’t include the `/admin` prefix, the request will `404`. +If you don't include the `/admin` prefix, the request will `404`. ## Clean up -This was just to show you Pomerium’s flexibility when it comes to advanced routes. We won’t be using the HTTPbin or Node server services going forward. To keep your configuration files clean and easy to manage, remove the following services and routes: +This was just to show you Pomerium's flexibility when it comes to advanced routes. We won't be using the HTTPbin or Node server services going forward. To keep your configuration files clean and easy to manage, remove the following services and routes: In your configuration file: - Remove the `httpbin` and `nodeserver` routes and their attached policies from `- routes` - Remove `jwt_claims_headers` -In your project’s root folder: +In your project's root folder: - Delete `app` and its contents @@ -402,7 +402,7 @@ In this tutorial, you added several new services and built routes to them. You also added per-route settings that handle redirects _and_ modify requests, responses, header values, and URL paths and prefixes. -Now that you’ve seen what you can do with routes, it’s time to learn how to proxy TCP connections with Pomerium! +Now that you've seen what you can do with routes, it's time to learn how to proxy TCP connections with Pomerium! ### Configuration file state @@ -442,13 +442,13 @@ Docker Compose ```yaml services: pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest volumes: - ./config.yaml:/pomerium/config.yaml:ro ports: - 443:443 verify: - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest expose: - 8000 environment: diff --git a/content/docs/courses/fundamentals/build-policies.md b/content/docs/get-started/fundamentals/core/build-policies.md similarity index 82% rename from content/docs/courses/fundamentals/build-policies.md rename to content/docs/get-started/fundamentals/core/build-policies.md index 08cde79eb..2038e4570 100644 --- a/content/docs/courses/fundamentals/build-policies.md +++ b/content/docs/get-started/fundamentals/core/build-policies.md @@ -19,9 +19,9 @@ sidebar_position: 3 # Build a Simple Policy -In this guide, you’ll learn about **Authorization Policies** in Pomerium. +In this guide, you'll learn about **Authorization Policies** in Pomerium. -Specifically, we’ll cover: +Specifically, we'll cover: - What an authorization policy is - Why you need policies to enforce access control @@ -30,31 +30,31 @@ Specifically, we’ll cover: :::note **Before You Start** -Make sure you’ve completed the following tutorials: +Make sure you've completed the following tutorials: -- [**Get Started**](/docs/courses/fundamentals/get-started) -- [**Build a Simple Route**](/docs/courses/fundamentals/build-routes) +- [**Get Started**](/docs/get-started/fundamentals/core/get-started) +- [**Build a Simple Route**](/docs/get-started/fundamentals/core/build-routes) If you completed these tutorials, you should have: - A route pointing to Grafana - A route pointing to the Verify service -Each tutorial builds on the same configuration files. In this tutorial, you’ll build simple policies to secure your services. +Each tutorial builds on the same configuration files. In this tutorial, you'll build simple policies to secure your services. ::: ## What is an Authorization Policy? -An **Authorization Policy** defines what resources a user (or group of users) can access within an organization. It’s the logic that tells Pomerium, “this HR employee isn’t authorized to access the engineering staging app.” +An **Authorization Policy** defines what resources a user (or group of users) can access within an organization. It's the logic that tells Pomerium, “this HR employee isn't authorized to access the engineering staging app.” From a purely functional point of view, authorization policies seem like a simple concept: They help _manages access_ to apps and services in your organization. But, they can get pretty complicated as your organization scales. To help you ease into building policies with Pomerium, you should first learn how to build policies in Pomerium with **Pomerium Policy Language** (PPL). -After that, you’ll check out some PPL examples and write your own policies for your routes. +After that, you'll check out some PPL examples and write your own policies for your routes. -Let’s get started! +Let's get started! ### What is Pomerium Policy Language (PPL)? @@ -62,7 +62,7 @@ PPL is a YAML-based notation for creating easy and flexible authorization polici PPL allows administrators to express authorization policy in a high-level, declarative language that promotes safe, performant, fine-grained controls. -You can think of it as coded instructions to tell Pomerium how authorization decisions are made for capturing all niche and edge-case scenarios. It’s as flexible as you want it to be! +You can think of it as coded instructions to tell Pomerium how authorization decisions are made for capturing all niche and edge-case scenarios. It's as flexible as you want it to be! ### How does PPL work? @@ -102,11 +102,11 @@ Matchers can be used with logical operators like criteria. PPL offers a variety - String Matcher - Time of Day Matcher -For an in-depth look at how PPL works, see the [Policy Language](/docs/capabilities/ppl#at-a-glance) page. +For an in-depth look at how PPL works, see the [Policy Language](/docs/internals/ppl#at-a-glance) page. ## Example policies with PPL -Now that you’ve briefly covered PPL, let’s jump into some simple examples: +Now that you've briefly covered PPL, let's jump into some simple examples: **Example 1**: Allow access if the user's `email` address exactly matches the criterion's value @@ -126,7 +126,7 @@ Requiring an exact email address is one way to secure an app, but it won't let a Instead of specifying the entire email address, you can write a policy that allows access if a user has the required `domain` in their email address (the part after `@`). -The example below instructs Pomerium to only grant a user access if their email address matches the **domain** criterion’s value. +The example below instructs Pomerium to only grant a user access if their email address matches the **domain** criterion's value. ```yaml policy: @@ -136,7 +136,7 @@ policy: is: example.com ``` -Again, the domain criterion checks for the domain portion of the user’s email address. Using the example above, if your email were `bob@gmail.com`, Pomerium would deny you access; if your email were `bob@example.com`, Pomerium would grant you access. +Again, the domain criterion checks for the domain portion of the user's email address. Using the example above, if your email were `bob@gmail.com`, Pomerium would deny you access; if your email were `bob@example.com`, Pomerium would grant you access. **Example 3**: Use logical operators to allow access based on `username` _or_ `domain` criteria @@ -172,13 +172,13 @@ policy: ::: -Now that we’ve covered some examples, it’s time to attach a policy to a route. +Now that we've covered some examples, it's time to attach a policy to a route. ## Build policies for your routes By now, your configuration file should have routes for the Verify service and Grafana. You may have noticed that these routes have the `allow_any_authenticated_user` setting attached to them. -That’s a great setting to test a route with, but we want to secure these routes with policies now. +That's a great setting to test a route with, but we want to secure these routes with policies now. In your Pomerium configuration file: @@ -202,7 +202,7 @@ Great job! ## Summary -Now that you’ve built a route and policy to control access, you have the basic building blocks in place to start using Pomerium. +Now that you've built a route and policy to control access, you have the basic building blocks in place to start using Pomerium. To sum up what you have so far: @@ -246,13 +246,13 @@ Docker Compose: ```yaml services: pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest volumes: - ./config.yaml:/pomerium/config.yaml:ro ports: - 443:443 verify: - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest expose: - 8000 grafana: diff --git a/content/docs/courses/fundamentals/build-routes.md b/content/docs/get-started/fundamentals/core/build-routes.md similarity index 69% rename from content/docs/courses/fundamentals/build-routes.md rename to content/docs/get-started/fundamentals/core/build-routes.md index 790ae12cc..499b27345 100644 --- a/content/docs/courses/fundamentals/build-routes.md +++ b/content/docs/get-started/fundamentals/core/build-routes.md @@ -9,28 +9,28 @@ sidebar_position: 2 # Build a Simple Route -In this tutorial, you’ll learn about **Routing** in Pomerium. By the end, you’ll add a new service to Docker Compose and define a route to it. +In this tutorial, you'll learn about **Routing** in Pomerium. By the end, you'll add a new service to Docker Compose and define a route to it. :::note **Before You Start** -Make sure you’ve completed the [**Get Started**](/docs/courses/fundamentals/get-started) tutorial. +Make sure you've completed the [**Get Started**](/docs/get-started/fundamentals/core/get-started) tutorial. If you already did, you should have: - A Pomerium configuration file - A Docker Compose configuration file -You’ll build on these configuration files in each tutorial. +You'll build on these configuration files in each tutorial. ::: ## Routing in Pomerium -In Pomerium, **Routing** tells the Proxy service where to listen for incoming requests _from_ the client and where to direct the origin server’s responses _to_ the client. +In Pomerium, **Routing** tells the Proxy service where to listen for incoming requests _from_ the client and where to direct the origin server's responses _to_ the client. Put simply, routing makes it possible for Pomerium to manage requests and responses between the client and the upstream app. -Continuing our waiter-kitchen analogy, routing is when the client tells Pomerium, “Get me butter cookies. Topped with meringue, tastefully burnt.” and Pomerium forwards that to the kitchen, telling them, “Burnt meringue-topped butter cookies, table 5.” The client gets what they want without entering the kitchen, the kitchen knows what and where to send it, everyone’s happy. +Continuing our waiter-kitchen analogy, routing is when the client tells Pomerium, “Get me butter cookies. Topped with meringue, tastefully burnt.” and Pomerium forwards that to the kitchen, telling them, “Burnt meringue-topped butter cookies, table 5.” The client gets what they want without entering the kitchen, the kitchen knows what and where to send it, everyone's happy. ### How routing works in Pomerium @@ -39,11 +39,11 @@ Each Pomerium route consists of a **From** and **To** field: - The **From** field defines the external, publicly accessible URL of a proxied request. It tells the Proxy service to listen for requests from this location. - The **To** field defines the destination of the proxied request, and can be an internal or external resource -When someone sends a request to access an upstream service, they are accessing the **From** URL. Pomerium receives the request and redirects the origin server’s response to its destination – the value of the **To** URL. +When someone sends a request to access an upstream service, they are accessing the **From** URL. Pomerium receives the request and redirects the origin server's response to its destination – the value of the **To** URL. ## Define a route in Pomerium -Now that you know how Routes work, let’s define one in your Pomerium configuration file. We will build a route to Grafana, an open-source analytics and monitoring tool. +Now that you know how Routes work, let's define one in your Pomerium configuration file. We will build a route to Grafana, an open-source analytics and monitoring tool. Under the `routes:` key in your Pomerium configuration file, add the following route: @@ -70,13 +70,13 @@ In your `docker-compose.yaml` file, add Grafana as a service: ```yaml title="docker-compose.yaml" services: pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest volumes: - ./config.yaml:/pomerium/config.yaml:ro ports: - 443:443 verify: - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest expose: - 8000 grafana: @@ -87,7 +87,7 @@ services: ### Understanding your route -Now, go back to your Pomerium configuration file. Let’s quickly discuss your new Grafana route: +Now, go back to your Pomerium configuration file. Let's quickly discuss your new Grafana route: The **from** field contains our **Fully Qualified Domain Name** (FQDN): @@ -95,7 +95,7 @@ The **from** field contains our **Fully Qualified Domain Name** (FQDN): If we break apart the FQDN, `grafana` is the **hostname**. -Because we’re using Docker Compose, the hostname references the name of the service as defined in your `docker-compose.yaml` file: +Because we're using Docker Compose, the hostname references the name of the service as defined in your `docker-compose.yaml` file: ``` services: @@ -109,15 +109,15 @@ The `localhost` part is a **subdomain**, and `pomerium.io` is the **domain name* :::note -We’ve hardcoded `localhost.pomerium.io` to always point to `127.0.0.1` so you can use it locally in your development environment. +We've hardcoded `localhost.pomerium.io` to always point to `127.0.0.1` so you can use it locally in your development environment. ::: -The **to** field tells the Proxy service where to send the origin server’s response (in this case, the origin server would be Grafana). +The **to** field tells the Proxy service where to send the origin server's response (in this case, the origin server would be Grafana). In our example, Pomerium will send responses to `grafana:3000`. -Again, this is because we’re using Docker Compose to power our services. `grafana` is the name of the service, and we’re exposing our host machine’s port `:3000` and mapping it to port `:3000` in the Grafana container. +Again, this is because we're using Docker Compose to power our services. `grafana` is the name of the service, and we're exposing our host machine's port `:3000` and mapping it to port `:3000` in the Grafana container. Within our Docker environment, Pomerium knows exactly where to send the response to. @@ -133,13 +133,13 @@ And access your route: https://grafana.localhost.pomerium.io ![The Grafana login screen](./img/build-routes/grafana-login-screen.png) -If you reach this after the authentication step, you’ve succeeded in setting up a route to Grafana! +If you reach this after the authentication step, you've succeeded in setting up a route to Grafana! Awesome! :::info -In this tutorial, we won’t configure Grafana any further. But, if you’re curious how to set it up in a local testing environment, see our [**Grafana guide**](https://www.pomerium.com/docs/guides/grafana). +In this tutorial, we won't configure Grafana any further. But, if you're curious how to set it up in a local testing environment, see our [**Grafana guide**](https://www.pomerium.com/docs/guides/grafana). ::: @@ -153,7 +153,7 @@ In this tutorial, we won’t configure Grafana any further. But, if you’re cur This is more or less the service part of a reverse proxy, but after you build a road you need to secure it. -Right now, the security is pretty lax; if you can authenticate, you’re in. So, it’s time to build an authorization policy that won’t just let _anyone_ in except for the right people. +Right now, the security is pretty lax; if you can authenticate, you're in. So, it's time to build an authorization policy that won't just let _anyone_ in except for the right people. **Next up**: Build a Simple Policy @@ -183,13 +183,13 @@ Docker Compose: ```yaml services: pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest volumes: - ./config.yaml:/pomerium/config.yaml:ro ports: - 443:443 verify: - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest expose: - 8000 grafana: diff --git a/content/docs/courses/fundamentals/conclusion.md b/content/docs/get-started/fundamentals/core/conclusion.md similarity index 94% rename from content/docs/courses/fundamentals/conclusion.md rename to content/docs/get-started/fundamentals/core/conclusion.md index f7b4810ad..2f1fbf3c7 100644 --- a/content/docs/courses/fundamentals/conclusion.md +++ b/content/docs/get-started/fundamentals/core/conclusion.md @@ -28,13 +28,13 @@ Well, there's a few things you can do: - Review our Capabilities section to see what other features are available. Here are a few suggestions: - Configure [Single Sign-out](https://www.pomerium.com/docs/capabilities/single-sign-out) - - Add client-side mTLS, also known as [Downstream mTLS](https://www.pomerium.com/docs/capabilities/mtls-clients) + - Add client-side mTLS, also known as [Downstream mTLS](https://www.pomerium.com/docs/internals/certificates-and-tls) - Test out logging in Pomerium with our [Audit Logs](https://www.pomerium.com/docs/capabilities/audit-logs) - Explore global and route-level settings on our [Reference](https://www.pomerium.com/docs/reference) page - Check out our [Guides](https://www.pomerium.com/docs/guides) to learn how to secure other services behind Pomerium - Read some of our [Blog posts](https://www.pomerium.com/blog/) to see what's happening in the greater Zero Trust community and at Pomerium - Import your existing Pomerium Core configuration to Pomerium Zero - Pomerium Zero provides a hosted configuration UI for managing your Pomerium configurations. - - See [**Import Core Config to Zero**](/docs/zero/import) for more information. + - See [**Import Core Config to Zero**](/docs/deploy/cloud/import) for more information. You're bound to have some questions and feedback along the way. Visit our [Discuss page](https://discuss.pomerium.com/) to ask questions, see what our users are up to, and let us know what you thought of our Guided Tutorials! diff --git a/content/docs/courses/fundamentals/get-started.md b/content/docs/get-started/fundamentals/core/get-started.md similarity index 69% rename from content/docs/courses/fundamentals/get-started.md rename to content/docs/get-started/fundamentals/core/get-started.md index 11b70415c..b12d0b02d 100644 --- a/content/docs/courses/fundamentals/get-started.md +++ b/content/docs/get-started/fundamentals/core/get-started.md @@ -20,7 +20,7 @@ In a later tutorial, we will cover how to self-host and run Pomerium in a virtua ## Step 1: Create a new project -For the purposes of this guide, we’ll call this project `pomerium_quickstart` (but name it whatever you want). +For the purposes of this guide, we'll call this project `pomerium_quickstart` (but name it whatever you want). Your project will contain all the files and configurations you need to run **Pomerium Core**. @@ -31,16 +31,16 @@ The directory structure will look like this: - The `config.yaml` file configures Pomerium itself - The `docker-compose.yaml` file configures and runs your Docker containers -We’ll configure these files together in the next section. +We'll configure these files together in the next section. :::info What is **Pomerium Core**? -[**Pomerium Core**](/docs/core) is our open-source, identity-aware reverse gateway. Pomerium consists of **4 service** identities (that can be deployed together or independently), including the: +[**Pomerium Core**](/docs/deploy/core) is our open-source, identity-aware reverse gateway. Pomerium consists of **4 service** identities (that can be deployed together or independently), including the: - **Proxy** service — the red-linen rope - **Authentication** service — the bouncer checking the user's ID to see if they are who they say they are - **Authorization** service — the bouncer checking if the user is authorized to do what they want to do -- **Databroker** service — the waiter remembering the user’s current session to offer the best user experience +- **Databroker** service — the waiter remembering the user's current session to offer the best user experience When you run Core, these services work together to secure your apps and connect your users to them. @@ -65,37 +65,37 @@ routes: is: user@example.com ``` -Update `user@example.com` to use your desired email address – otherwise, the example won’t work! (Unless, of course, your actual email address is `user@example.com`, in which case, carry on.) +Update `user@example.com` to use your desired email address – otherwise, the example won't work! (Unless, of course, your actual email address is `user@example.com`, in which case, carry on.)
Understanding the configuration file
The Authenticate Service URL -The `authenticate_service_url` setting provides an externally accessible URL that Pomerium’s **Authentication Service** uses to manage client authentication. It works like this: +The `authenticate_service_url` setting provides an externally accessible URL that Pomerium's **Authentication Service** uses to manage client authentication. It works like this:
  1. You request to access an app protected behind Pomerium
  2. The Authentication Service receives the request, and uses the `authenticate_service_url` to redirect you to the Identity Provider to sign in
-(If it helps to understand why, it’s because our waiter, Pomerium, needs to cross-reference with a list of users to go, “Ah, I see you’re on our list. Right this way, please.”) +(If it helps to understand why, it's because our waiter, Pomerium, needs to cross-reference with a list of users to go, “Ah, I see you're on our list. Right this way, please.”)
What Identity Provider? -Pomerium relies on an Identity Provider (IdP) to authenticate users and authorize requests (it’s the list we just mentioned, except the IdP gives you a token badge so Pomerium recognizes you). +Pomerium relies on an Identity Provider (IdP) to authenticate users and authorize requests (it's the list we just mentioned, except the IdP gives you a token badge so Pomerium recognizes you). -You probably noticed this configuration file doesn’t include an Identity Provider – that’s because you’re using Pomerium’s Hosted Authentication Service, which provides a preconfigured identity provider for you. +You probably noticed this configuration file doesn't include an Identity Provider – that's because you're using Pomerium's Hosted Authentication Service, which provides a preconfigured identity provider for you. -This way, you can just plug and play. (Don’t worry; we’ll show you how to configure your own identity provider later!) +This way, you can just plug and play. (Don't worry; we'll show you how to configure your own identity provider later!)
What about the routes? -We’ll learn more about routes in the next section, but for now, just know that the `from` route is the externally accessible URL that Pomerium will redirect you to after authenticating with your identity provider. +We'll learn more about routes in the next section, but for now, just know that the `from` route is the externally accessible URL that Pomerium will redirect you to after authenticating with your identity provider.
@@ -109,13 +109,13 @@ Add the following configuration settings to `docker-compose.yaml`: ```yaml title="docker-compose.yaml" services: pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest volumes: - ./config.yaml:/pomerium/config.yaml:ro ports: - 443:443 verify: - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest expose: - 8000 ``` @@ -124,7 +124,7 @@ This file includes the Docker images and instructions to run Pomerium and the Ve ## Step 4: Run Pomerium -Go into your project’s root directory and run the following command: +Go into your project's root directory and run the following command: ```sh docker compose up @@ -138,13 +138,13 @@ You may have some questions, like: **Why is the URL insecure?** -If you don’t provide certificates to verify the upstream service, Pomerium will generate self-signed certificates for you. Because the certificates are self-signed, your browser will throw a self-signed certificate warning. +If you don't provide certificates to verify the upstream service, Pomerium will generate self-signed certificates for you. Because the certificates are self-signed, your browser will throw a self-signed certificate warning. To bypass this warning: 1. Click anywhere in the browser window 2. Enter `thisisunsafe` (no spaces) and hit enter -3. Repeat step 2 if you’re prompted with the same error +3. Repeat step 2 if you're prompted with the same error Later, we will cover how to self-host Pomerium using Autocert, which will automate the process of managing certificates for your upstream services. @@ -152,13 +152,13 @@ Later, we will cover how to self-host Pomerium using Autocert, which will automa The simple answer is: You haven't configured Pomerium to handle JWTs yet. The Verify service expects a _cryptographically signed_ JWT, which contains identifying information about the user in the form of JWT claims. Without the JWT itself (and a way to verify the signature), the Verify service can't identity the user. -In a later tutorial, you will configure Pomerium and the Verify service to successfully verify a user’s identity. +In a later tutorial, you will configure Pomerium and the Verify service to successfully verify a user's identity. ## Summary Great job! If you got this far, then you have everything you need to run Pomerium and continue on with our guided tutorials. -In the next section, we will dive deeper into [**Routes**](/docs/courses/fundamentals/build-routes) with Pomerium. +In the next section, we will dive deeper into [**Routes**](/docs/get-started/fundamentals/core/build-routes) with Pomerium. ### Configuration file state: @@ -182,13 +182,13 @@ Docker Compose: ```yaml services: pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest volumes: - ./config.yaml:/pomerium/config.yaml:ro ports: - 443:443 verify: - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest expose: - 8000 ``` diff --git a/content/docs/get-started/fundamentals/core/img/advanced-routes/httpbin-jwt-claims-headers.png b/content/docs/get-started/fundamentals/core/img/advanced-routes/httpbin-jwt-claims-headers.png new file mode 100644 index 000000000..33226015c Binary files /dev/null and b/content/docs/get-started/fundamentals/core/img/advanced-routes/httpbin-jwt-claims-headers.png differ diff --git a/content/docs/get-started/fundamentals/core/img/advanced-routes/node-admin-only.png b/content/docs/get-started/fundamentals/core/img/advanced-routes/node-admin-only.png new file mode 100644 index 000000000..0a426b52b Binary files /dev/null and b/content/docs/get-started/fundamentals/core/img/advanced-routes/node-admin-only.png differ diff --git a/content/docs/get-started/fundamentals/core/img/advanced-routes/node-hello-world.png b/content/docs/get-started/fundamentals/core/img/advanced-routes/node-hello-world.png new file mode 100644 index 000000000..1db39fe0b Binary files /dev/null and b/content/docs/get-started/fundamentals/core/img/advanced-routes/node-hello-world.png differ diff --git a/content/docs/get-started/fundamentals/core/img/advanced-routes/response-header.png b/content/docs/get-started/fundamentals/core/img/advanced-routes/response-header.png new file mode 100644 index 000000000..1e02a83e6 Binary files /dev/null and b/content/docs/get-started/fundamentals/core/img/advanced-routes/response-header.png differ diff --git a/content/docs/get-started/fundamentals/core/img/build-routes/grafana-login-screen.png b/content/docs/get-started/fundamentals/core/img/build-routes/grafana-login-screen.png new file mode 100644 index 000000000..59ef0c4fa Binary files /dev/null and b/content/docs/get-started/fundamentals/core/img/build-routes/grafana-login-screen.png differ diff --git a/content/docs/get-started/fundamentals/core/img/get-started/pomerium-file-structure.png b/content/docs/get-started/fundamentals/core/img/get-started/pomerium-file-structure.png new file mode 100644 index 000000000..147675ff3 Binary files /dev/null and b/content/docs/get-started/fundamentals/core/img/get-started/pomerium-file-structure.png differ diff --git a/content/docs/get-started/fundamentals/core/img/get-started/verify-state.png b/content/docs/get-started/fundamentals/core/img/get-started/verify-state.png new file mode 100644 index 000000000..274cc48cf Binary files /dev/null and b/content/docs/get-started/fundamentals/core/img/get-started/verify-state.png differ diff --git a/content/docs/get-started/fundamentals/core/img/jwt-verification/00-root-project-files.png b/content/docs/get-started/fundamentals/core/img/jwt-verification/00-root-project-files.png new file mode 100644 index 000000000..163c82686 Binary files /dev/null and b/content/docs/get-started/fundamentals/core/img/jwt-verification/00-root-project-files.png differ diff --git a/content/docs/get-started/fundamentals/core/img/jwt-verification/01-jwt-claims.png b/content/docs/get-started/fundamentals/core/img/jwt-verification/01-jwt-claims.png new file mode 100644 index 000000000..18018bf5c Binary files /dev/null and b/content/docs/get-started/fundamentals/core/img/jwt-verification/01-jwt-claims.png differ diff --git a/content/docs/get-started/fundamentals/core/img/jwt-verification/02-jwt-payload.png b/content/docs/get-started/fundamentals/core/img/jwt-verification/02-jwt-payload.png new file mode 100644 index 000000000..9c99bcd58 Binary files /dev/null and b/content/docs/get-started/fundamentals/core/img/jwt-verification/02-jwt-payload.png differ diff --git a/content/docs/get-started/fundamentals/core/img/jwt-verification/03-jwt-decoded.png b/content/docs/get-started/fundamentals/core/img/jwt-verification/03-jwt-decoded.png new file mode 100644 index 000000000..bb17eb83b Binary files /dev/null and b/content/docs/get-started/fundamentals/core/img/jwt-verification/03-jwt-decoded.png differ diff --git a/content/docs/get-started/fundamentals/core/img/jwt-verification/04-jwt-signature-verified.png b/content/docs/get-started/fundamentals/core/img/jwt-verification/04-jwt-signature-verified.png new file mode 100644 index 000000000..338afbf85 Binary files /dev/null and b/content/docs/get-started/fundamentals/core/img/jwt-verification/04-jwt-signature-verified.png differ diff --git a/content/docs/courses/fundamentals/img/jwt-verification/jwt-verification-diagram.svg b/content/docs/get-started/fundamentals/core/img/jwt-verification/jwt-verification-diagram.svg similarity index 100% rename from content/docs/courses/fundamentals/img/jwt-verification/jwt-verification-diagram.svg rename to content/docs/get-started/fundamentals/core/img/jwt-verification/jwt-verification-diagram.svg diff --git a/content/docs/get-started/fundamentals/core/img/production-certificates/autocert-certificate.png b/content/docs/get-started/fundamentals/core/img/production-certificates/autocert-certificate.png new file mode 100644 index 000000000..982d8563f Binary files /dev/null and b/content/docs/get-started/fundamentals/core/img/production-certificates/autocert-certificate.png differ diff --git a/content/docs/get-started/fundamentals/core/img/self-hosted-pomerium/user-details-page.png b/content/docs/get-started/fundamentals/core/img/self-hosted-pomerium/user-details-page.png new file mode 100644 index 000000000..bfcd3fcbb Binary files /dev/null and b/content/docs/get-started/fundamentals/core/img/self-hosted-pomerium/user-details-page.png differ diff --git a/content/docs/courses/fundamentals/jwt-verification.md b/content/docs/get-started/fundamentals/core/jwt-verification.md similarity index 77% rename from content/docs/courses/fundamentals/jwt-verification.md rename to content/docs/get-started/fundamentals/core/jwt-verification.md index 201d9ce95..e756cc21e 100644 --- a/content/docs/courses/fundamentals/jwt-verification.md +++ b/content/docs/get-started/fundamentals/core/jwt-verification.md @@ -2,7 +2,7 @@ # cSpell:ignore ecparam, pubout, mypomerium id: jwt-verification title: Identity Verification with JWTs -description: In lesson 4, you’ll learn how to set up Pomerium to verify a user’s identity with JSON Web Tokens (JWTs). +description: In lesson 4, you'll learn how to set up Pomerium to verify a user's identity with JSON Web Tokens (JWTs). keywords: [ reverse proxy, @@ -20,30 +20,30 @@ sidebar_position: 4 # Identity Verification With JWTs -In this tutorial, you’ll learn how to set up Pomerium to verify a user’s identity with JSON Web Tokens (JWTs). +In this tutorial, you'll learn how to set up Pomerium to verify a user's identity with JSON Web Tokens (JWTs). But first, a bit of background on JWTs and their application in Pomerium… :::note **Before You Start** -Make sure you’ve completed the following tutorials: +Make sure you've completed the following tutorials: -- [**Get Started**](/docs/courses/fundamentals/get-started) -- [**Build a Simple Route**](/docs/courses/fundamentals/build-routes) -- [**Build a Simple Policy**](/docs/courses/fundamentals/build-policies) +- [**Get Started**](/docs/get-started/fundamentals/core/get-started) +- [**Build a Simple Route**](/docs/get-started/fundamentals/core/build-routes) +- [**Build a Simple Policy**](/docs/get-started/fundamentals/core/build-policies) If you completed these tutorials, you should have: - 2 routes pointing to Grafana and the Verify service - 2 policies (one policy per route) to control access to these services -Each tutorial builds on the same configuration files. In this tutorial, you’ll configure Pomerium to send the Pomerium JWT to an upstream service to verify a user’s identity. +Each tutorial builds on the same configuration files. In this tutorial, you'll configure Pomerium to send the Pomerium JWT to an upstream service to verify a user's identity. ::: ## Background -JWT verification (and, by extension, identity verification) **does not** replace Pomerium’s initial authentication flow with an identity provider. Identity verification is just an additional security layer that helps the upstream application verify that Pomerium handled the request and the user’s JWT. +JWT verification (and, by extension, identity verification) **does not** replace Pomerium's initial authentication flow with an identity provider. Identity verification is just an additional security layer that helps the upstream application verify that Pomerium handled the request and the user's JWT. :::info **Simplifying JWTs and Pomerium** @@ -51,15 +51,15 @@ If it helps, think of the upstream app as the airplane at an airport and TLS as But, what if someone found a way to skip the security checkpoint and went straight to the airplane? -The airplane, like the upstream app, has no way of knowing that a passenger didn’t come through the secure connection — the TLS tunnel — but the airline attendants can check that the passenger has a stamp on their boarding pass. +The airplane, like the upstream app, has no way of knowing that a passenger didn't come through the secure connection — the TLS tunnel — but the airline attendants can check that the passenger has a stamp on their boarding pass. -A user’s signed JWT acts as the stamp: In the event of other network configuration mistakes, the app can still grant or deny users if they don’t have a signed JWT to verify their identity. +A user's signed JWT acts as the stamp: In the event of other network configuration mistakes, the app can still grant or deny users if they don't have a signed JWT to verify their identity. ::: ## What is a JWT? -If you’re unfamiliar with JWTs, here’s a quick definition sourced from [JWT.io](https://jwt.io/): +If you're unfamiliar with JWTs, here's a quick definition sourced from [JWT.io](https://jwt.io/): “JSON Web Tokens are an open, industry standard [RFC 7519](https://tools.ietf.org/html/rfc7519) method for representing claims securely between two parties.” @@ -73,13 +73,13 @@ Check out [**this article**](https://jwt.io/introduction) to learn more about th ## How do JWTs work with Pomerium? -You can configure Pomerium to send the user’s JWT as a signed HTTP header in the request to access a service behind Pomerium. +You can configure Pomerium to send the user's JWT as a signed HTTP header in the request to access a service behind Pomerium. -Here’s how the JWT authentication flow looks at a high level: +Here's how the JWT authentication flow looks at a high level: 1. End User connects to Pomerium -2. Pomerium redirects the client to the IdP, the client signs in, and Pomerium gets the user’s ID, Access, and Refresh tokens +2. Pomerium redirects the client to the IdP, the client signs in, and Pomerium gets the user's ID, Access, and Refresh tokens 3. Two important actions happen here: @@ -90,7 +90,7 @@ Here’s how the JWT authentication flow looks at a high level: ![Diagram of JWT flow in Pomerium](./img/jwt-verification/jwt-verification-diagram.svg) -If that’s a lot to take in, don’t worry, Pomerium handles a lot of it for you! This is just for those that are interested in what’s happening behind the scenes. +If that's a lot to take in, don't worry, Pomerium handles a lot of it for you! This is just for those that are interested in what's happening behind the scenes. ## Configure identity verification with JWTs @@ -112,7 +112,7 @@ Configuring identity verification is a great example of how you should organize - **Signing Key** is a global-level setting. Any time a user sends a request to an upstream service, Pomerium will look for a signing key. - **Pass Identity Headers** is a route-level setting. It tells Pomerium to send the signed header to a certain route. -In this way, global and route level settings allow you to fine tune your configuration to suit a service’s use case. +In this way, global and route level settings allow you to fine tune your configuration to suit a service's use case. ::: @@ -140,7 +140,7 @@ routes: is: example.com ``` -You **must** add `pass_identity_headers` to a route for identity verification to work. Otherwise, Pomerium won’t forward the signed JWT Assertion Header in the request. +You **must** add `pass_identity_headers` to a route for identity verification to work. Otherwise, Pomerium won't forward the signed JWT Assertion Header in the request. ### Add a signing key @@ -148,12 +148,12 @@ You **must** add `pass_identity_headers` to a route for identity verification to Public/Private Key Pairs -You might be asking, “What exactly is a signing key?” Put simply, a signing key is the private key counterpart in a public/private key pair. These keys correspond to one another cryptographically. See SmallStep’s [PKI blog post](https://smallstep.com/blog/everything-pki/) for more information on the technologies that power public/private key pairs. +You might be asking, “What exactly is a signing key?” Put simply, a signing key is the private key counterpart in a public/private key pair. These keys correspond to one another cryptographically. See SmallStep's [PKI blog post](https://smallstep.com/blog/everything-pki/) for more information on the technologies that power public/private key pairs. -Here’s a few things to keep in mind: +Here's a few things to keep in mind: - A private key is assigned to a user, and should not be shared with anyone else -- A user’s private key can function as a signing key to cryptographically sign their JWT +- A user's private key can function as a signing key to cryptographically sign their JWT - A public key can be given to anyone (hence the name) - The public key can verify that a JWT was signed by its corresponding private key without revealing the value of the signing key (this ensures the private key is protected) @@ -163,7 +163,7 @@ This section covers how you can add a signing key to your configuration file. Bu To generate a signing key: -1. In your project’s terminal, run the following command: +1. In your project's terminal, run the following command: ```bash openssl ecparam -genkey -name prime256v1 -noout -out ec_private.pem @@ -200,7 +200,7 @@ signing_key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUVSNThaeDA2SHJ ### Update Docker Compose -Next, you need to update your service’s in Docker Compose so they can fetch the public key. This step relies on what’s called a JSON Web Key Set (JWKS) endpoint. +Next, you need to update your service's in Docker Compose so they can fetch the public key. This step relies on what's called a JSON Web Key Set (JWKS) endpoint. The JWKS endpoint is an internal Pomerium URL that provides the public key the upstream service needs to verify a private key. @@ -208,7 +208,7 @@ In your Docker Compose file, add the following environment variable to your Veri ```yaml title="docker-compose" verify: - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest expose: - 8000 environment: @@ -235,16 +235,16 @@ Under **Signed Identity Token**, you should see a list claims: Pomerium sources these claims from the ID token it gets from your identity provider and uses them to generate a new “Pomerium” JWT. This ensures the original ID token is never leaked. -You’re doing great! Let’s summarize what you’ve configured Pomerium to do so far: +You're doing great! Let's summarize what you've configured Pomerium to do so far: - You accessed the upstream Verify service behind Pomerium - Pomerium redirected to the identity provider and prompted you to sign in - After signing in, Pomerium mints a new JWT based on the original ID token -- Because you’ve added a **Signing Key** and **Pass Identity Headers**, Pomerium signs the JWT and forwards it in a JWT Assertion Header to the Verify service +- Because you've added a **Signing Key** and **Pass Identity Headers**, Pomerium signs the JWT and forwards it in a JWT Assertion Header to the Verify service But, how does the upstream service verify the JWT? -Let’s walk through the steps of manually verifying a JWT below. +Let's walk through the steps of manually verifying a JWT below. ## Manually verify the JWT @@ -286,13 +286,13 @@ In JWT.io under **VERIFY SIGNATURE**, enter the public key. The “Invalid Signa ![JWT signature verification](./img/jwt-verification/04-jwt-signature-verified.png) -Great! With these steps, you can manually verify the JWT’s signature and that the request was handled by Pomerium. +Great! With these steps, you can manually verify the JWT's signature and that the request was handled by Pomerium. :::note -Pomerium offers [**front- and back-end SDKs**](/docs/guides/verify-jwt) with built-in JWT libraries. +Pomerium offers [**front- and back-end SDKs**](/docs/capabilities/getting-users-identity.mdx) with built-in JWT libraries. -You can use these libraries in your own applications to work easily with Pomerium’s JWT flow, or implement your own solution. +You can use these libraries in your own applications to work easily with Pomerium's JWT flow, or implement your own solution. ::: @@ -338,13 +338,13 @@ Docker Compose ```yaml services: pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest volumes: - ./config.yaml:/pomerium/config.yaml:ro ports: - 443:443 verify: - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest expose: - 8000 environment: diff --git a/content/docs/courses/fundamentals/production-certificates.md b/content/docs/get-started/fundamentals/core/production-certificates.md similarity index 65% rename from content/docs/courses/fundamentals/production-certificates.md rename to content/docs/get-started/fundamentals/core/production-certificates.md index 33da018a2..73ef62c44 100644 --- a/content/docs/courses/fundamentals/production-certificates.md +++ b/content/docs/get-started/fundamentals/core/production-certificates.md @@ -17,22 +17,22 @@ sidebar_position: 9 # Production Certificates With Autocert -In this tutorial, you’ll add production certificates with Autocert to your Pomerium instance. +In this tutorial, you'll add production certificates with Autocert to your Pomerium instance. :::note **Before You Start** -Make sure you’ve completed the following tutorials: +Make sure you've completed the following tutorials: -- [**Get Started**](/docs/courses/fundamentals/get-started) -- [**Build a Simple Route**](/docs/courses/fundamentals/build-routes) -- [**Build a Simple Policy**](/docs/courses/fundamentals/build-policies) -- [**Identity Verification with JWTs**](/docs/courses/fundamentals/jwt-verification) -- [**Build Advanced Policies**](/docs/courses/fundamentals/advanced-policies) -- [**Build Advanced Routes**](/docs/courses/fundamentals/advanced-routes) -- [**Build TCP Routes**](/docs/courses/fundamentals/tcp-routes) -- [**Self-Host Pomerium**](/docs/courses/fundamentals/self-hosted-pomerium) +- [**Get Started**](/docs/get-started/fundamentals/core/get-started) +- [**Build a Simple Route**](/docs/get-started/fundamentals/core/build-routes) +- [**Build a Simple Policy**](/docs/get-started/fundamentals/core/build-policies) +- [**Identity Verification with JWTs**](/docs/get-started/fundamentals/core/jwt-verification) +- [**Build Advanced Policies**](/docs/get-started/fundamentals/core/advanced-policies) +- [**Build Advanced Routes**](/docs/get-started/fundamentals/core/advanced-routes) +- [**Build TCP Routes**](/docs/get-started/fundamentals/core/tcp-routes) +- [**Self-Host Pomerium**](/docs/get-started/fundamentals/core/self-hosted-pomerium) -Each tutorial builds on the same configuration files. In this tutorial, you’ll learn how to enable Autocert to manage TLS certificate automation for your upstream services. +Each tutorial builds on the same configuration files. In this tutorial, you'll learn how to enable Autocert to manage TLS certificate automation for your upstream services. ::: @@ -44,7 +44,7 @@ To understand Autocert, it helps to understand one of the problems it solves: If you installed Pomerium in a VM instance, the default configuration file includes `certificates` keys where you can import your own certificates to secure the connection from Pomerium to the _upstream_ service. -If you don’t include certificates, Pomerium will generate self-signed certificates to secure these connections for you. +If you don't include certificates, Pomerium will generate self-signed certificates to secure these connections for you. However, a self-signed certificate will prompt your browser to throw a self-signed certificate warning. To avoid this warning, you need to import and manage certificates yourself. @@ -54,11 +54,11 @@ But, managing your own certificates can be tedious and difficult to maintain (es Fortunately, Pomerium has an Autocert setting that, when enabled, allows Pomerium to automatically retrieve, manage, and renew public-facing TLS certificates from [Let's Encrypt](https://letsencrypt.org/). -(If your OS trusts the [ISRG Root X1](https://letsencrypt.org/docs/certificate-compatibility/) certificate, it will validate Let’s Encrypt certificates, too.) +(If your OS trusts the [ISRG Root X1](https://letsencrypt.org/docs/certificate-compatibility/) certificate, it will validate Let's Encrypt certificates, too.) :::note -To be clear, Autocert enables Pomerium to generate _per-route_ certificates that authenticate the _upstream_ server and secure the _upstream_ connection. This means you won’t encounter the self-signed certificate warning when you access a route. +To be clear, Autocert enables Pomerium to generate _per-route_ certificates that authenticate the _upstream_ server and secure the _upstream_ connection. This means you won't encounter the self-signed certificate warning when you access a route. Autocert _does not_ secure the downstream connection (that is, the connection between the client and Pomerium). @@ -66,20 +66,20 @@ Autocert _does not_ secure the downstream connection (that is, the connection be ### How Autocert works with Pomerium -The Autocert setting relies on the **[Automatic Certificate Management Environment](https://datatracker.ietf.org/doc/html/rfc8555)** (ACME) protocol to automate the issuance and verification of certificates between a Certificate Authority (CA) and a user’s server (also known as the “applicant”). +The Autocert setting relies on the **[Automatic Certificate Management Environment](https://datatracker.ietf.org/doc/html/rfc8555)** (ACME) protocol to automate the issuance and verification of certificates between a Certificate Authority (CA) and a user's server (also known as the “applicant”). -We implement Autocert with Let’s Encrypt, which functions as the CA. +We implement Autocert with Let's Encrypt, which functions as the CA. Your domain is the applicant. -Let’s Encrypt uses the ACME protocol to verify that you own a domain before it issues you a certificate for it. To verify that you own a domain, you need to satisfy one of the following challenges: +Let's Encrypt uses the ACME protocol to verify that you own a domain before it issues you a certificate for it. To verify that you own a domain, you need to satisfy one of the following challenges: - [**HTTP-01 challenge**](https://letsencrypt.org/docs/client-options/#projects-integrating-with-let-s-encrypt) - [**TLS-ALPN-01 challenge**](https://letsencrypt.org/docs/challenge-types/#tls-alpn-01) (There are other challenges, but Pomerium only supports these two for now.) -After satisfying either of these challenges, Let’s Encrypt – and, in turn, Autocert – will retrieve, manage, and renew certificates for your domain. +After satisfying either of these challenges, Let's Encrypt – and, in turn, Autocert – will retrieve, manage, and renew certificates for your domain. ## Configure Autocert @@ -105,12 +105,12 @@ You should see your domain in the **Issued To > Common Name (CN)** field (the UI ![Viewing the certificate provided by Autocert](./img/production-certificates/autocert-certificate.png) -That’s it! You configured Pomerium to manage certificates for your upstream applications. +That's it! You configured Pomerium to manage certificates for your upstream applications. ## Summary Now that Pomerium is running on a VM with Autocert managing certificates, you have a fully functional reverse proxy for your access control needs. -With Pomerium’s setup complete, you’re ready to start adding and securing your own services behind Pomerium. +With Pomerium's setup complete, you're ready to start adding and securing your own services behind Pomerium. Head to our final tutorial, Putting It All Together, to see what you should do next. diff --git a/content/docs/courses/fundamentals/self-hosted-pomerium.md b/content/docs/get-started/fundamentals/core/self-hosted-pomerium.md similarity index 64% rename from content/docs/courses/fundamentals/self-hosted-pomerium.md rename to content/docs/get-started/fundamentals/core/self-hosted-pomerium.md index 5ae61c2dc..1f5e79025 100644 --- a/content/docs/courses/fundamentals/self-hosted-pomerium.md +++ b/content/docs/get-started/fundamentals/core/self-hosted-pomerium.md @@ -9,11 +9,11 @@ sidebar_position: 8 # Self-Hosted Authenticate Service -So far, you’ve been using the Hosted Authenticate service, which provides an authenticate service URL (`authenticate.pomerium.app`) and a hosted identity provider (Cognito) to authenticate users. +So far, you've been using the Hosted Authenticate service, which provides an authenticate service URL (`authenticate.pomerium.app`) and a hosted identity provider (Cognito) to authenticate users. -We’ve also used the `*.localhost.pomerium.io` URL to host our services locally. (This wildcard domain points to `127.0.0.1`.) +We've also used the `*.localhost.pomerium.io` URL to host our services locally. (This wildcard domain points to `127.0.0.1`.) -In this tutorial, you’ll replace the Hosted Authenticate service with your own self-hosted authenticate service. +In this tutorial, you'll replace the Hosted Authenticate service with your own self-hosted authenticate service. To do this, you must: @@ -23,17 +23,17 @@ To do this, you must: :::note **Before You Start** -Make sure you’ve completed the following tutorials: +Make sure you've completed the following tutorials: -- [**Get Started**](/docs/courses/fundamentals/get-started) -- [**Build a Simple Route**](/docs/courses/fundamentals/build-routes) -- [**Build a Simple Policy**](/docs/courses/fundamentals/build-policies) -- [**Identity Verification with JWTs**](/docs/courses/fundamentals/jwt-verification) -- [**Build Advanced Policies**](/docs/courses/fundamentals/advanced-policies) -- [**Build Advanced Routes**](/docs/courses/fundamentals/advanced-routes) -- [**Build TCP Routes**](/docs/courses/fundamentals/tcp-routes) +- [**Get Started**](/docs/get-started/fundamentals/core/get-started) +- [**Build a Simple Route**](/docs/get-started/fundamentals/core/build-routes) +- [**Build a Simple Policy**](/docs/get-started/fundamentals/core/build-policies) +- [**Identity Verification with JWTs**](/docs/get-started/fundamentals/core/jwt-verification) +- [**Build Advanced Policies**](/docs/get-started/fundamentals/core/advanced-policies) +- [**Build Advanced Routes**](/docs/get-started/fundamentals/core/advanced-routes) +- [**Build TCP Routes**](/docs/get-started/fundamentals/core/tcp-routes) -Each tutorial builds on the same configuration files. In this tutorial, you’ll replace the Hosted Authenticate service with your own self-hosted authenticate service. +Each tutorial builds on the same configuration files. In this tutorial, you'll replace the Hosted Authenticate service with your own self-hosted authenticate service. ::: @@ -43,31 +43,31 @@ This next step requires you to set up a VM instance where you will configure and ### Create a Virtual Machine Instance -To self-host the authenticate service, you need a domain that you own. You also need to point your domain’s DNS servers to your VM’s public IP address. +To self-host the authenticate service, you need a domain that you own. You also need to point your domain's DNS servers to your VM's public IP address. -One straightforward way to do this is to use Google’s Compute Engine API to spin up a virtual machine (VM): +One straightforward way to do this is to use Google's Compute Engine API to spin up a virtual machine (VM): -1. Use Google’s Cloud Domains service to register a domain (the cost varies depending on the domain) +1. Use Google's Cloud Domains service to register a domain (the cost varies depending on the domain) -1. Create a VM instance with Google’s Compute Engine service (for this tutorial, choose Debian Bullseye) +1. Create a VM instance with Google's Compute Engine service (for this tutorial, choose Debian Bullseye) 1. Enable HTTP and HTTPS traffic as part of your Firewall rules -1. Use Google’s Cloud DNS service to set up a DNS zone with a DNS name +1. Use Google's Cloud DNS service to set up a DNS zone with a DNS name 1. In the DNS zone, create a wildcard DNS type A record (for example, `*.example.sandbox.com`) -1. In the **IPv4 Address 1** field, enter your VM’s **External IPv4 Address** (a publicly routable IP) +1. In the **IPv4 Address 1** field, enter your VM's **External IPv4 Address** (a publicly routable IP) If set up correctly, you can SSH into the VM and configure Pomerium. -After you’re in the VM, it’s time to set up Pomerium. +After you're in the VM, it's time to set up Pomerium. :::note **Your VM Setup** This tutorial will be using a Compute Engine VM instance running Debian 11 (”bullseye”) to self-host Pomerium. -You don’t have to use this environment if you don’t want to, but we will assume you’re running a VM to self-host Pomerium — and that you have a domain you registered and own — going forward. +You don't have to use this environment if you don't want to, but we will assume you're running a VM to self-host Pomerium — and that you have a domain you registered and own — going forward. Certain steps will vary depending on your VM and Cloud provider. @@ -75,13 +75,13 @@ Certain steps will vary depending on your VM and Cloud provider. ### Install Pomerium -If you set up a VM using Debian, you can use Pomerium’s Debian OS package to install the latest version: +If you set up a VM using Debian, you can use Pomerium's Debian OS package to install the latest version: 1. Go to [Cloudsmith.io](https://cloudsmith.io/~pomerium/repos/pomerium/groups/) and select the **Set Me Up** dropdown menu 2. Select **Debian** -3. Copy the following curl command and run it in your VM’s terminal: +3. Copy the following curl command and run it in your VM's terminal: ```sh curl -1sLf \ @@ -109,11 +109,11 @@ You can integrate Pomerium with any identity provider (IdP) that supports OAuth2 - Okta OneLogin - Ping -For the purposes of this guide, we will use GitHub as the IdP (the configuration is simpler than other IdPs). See our [GitHub](/docs/identity-providers/github) guide for detailed instructions. +For the purposes of this guide, we will use GitHub as the IdP (the configuration is simpler than other IdPs). See our [GitHub](/docs/integrations/user-identity/github) guide for detailed instructions. :::tip **About the Authorization Callback URL** -Now that you have your own domain, make sure you attach the `/oauth2/callback` path to GitHub’s Authorization URL. +Now that you have your own domain, make sure you attach the `/oauth2/callback` path to GitHub's Authorization URL. For example, if your domain is `authenticate.domain.com`, the callback URL would look like: @@ -123,7 +123,7 @@ For example, if your domain is `authenticate.domain.com`, the callback URL would ### Configure Pomerium -Now that you’ve configured your IdP, you can update your Pomerium configuration file. +Now that you've configured your IdP, you can update your Pomerium configuration file. We will configure Pomerium in a Vim text editor. To do that, run this command: @@ -167,11 +167,11 @@ In the next tutorial you will add **Autocert** to manage production certificates 1. **Remove cookie secret and shared secret settings** -You only need these settings if you’re setting up the Enterprise Console.  For now, it’s safe to remove them. +You only need these settings if you're setting up the Enterprise Console.  For now, it's safe to remove them. 1. **Add IdP configuration keys** -If you’re using GitHub as the IdP, you only need the following IdP keys: +If you're using GitHub as the IdP, you only need the following IdP keys: ```yaml title="config.yaml" idp_provider: 'github' @@ -196,7 +196,7 @@ For example: :::note **About the Verify `to:` URL** -In the route above, the internal `to:` URL points to `verify.pomerium.com`. This domain is hosted by Pomerium. While you can deploy your own Verify instance, we will use the hosted instance in this tutorial so you don’t have to configure one yourself. +In the route above, the internal `to:` URL points to `verify.pomerium.com`. This domain is hosted by Pomerium. While you can deploy your own Verify instance, we will use the hosted instance in this tutorial so you don't have to configure one yourself. ::: @@ -212,7 +212,7 @@ policy: is: user@example.com ``` -Save and quit the Vim editor (run `:wq` if you’re not familiar). +Save and quit the Vim editor (run `:wq` if you're not familiar). 1. **Edit Pomerium service file** @@ -247,14 +247,14 @@ After signing in, Pomerium will redirect you to the **User Details** page: ![The User Details page](./img/self-hosted-pomerium/user-details-page.png) -Awesome! You’ve successfully configured Pomerium to run in a Compute Engine VM instance running Debian. +Awesome! You've successfully configured Pomerium to run in a Compute Engine VM instance running Debian. ## Summary If you got this far, then you learned how to successfully run Pomerium in a VM! -This means your Pomerium instance is hosted in a private network. Because you have a domain with a wildcard DNS record that points to your VM’s _public_ IPv4 address, you can now configure Pomerium to run an **automated certificate management environment** (ACME) with Autocert. +This means your Pomerium instance is hosted in a private network. Because you have a domain with a wildcard DNS record that points to your VM's _public_ IPv4 address, you can now configure Pomerium to run an **automated certificate management environment** (ACME) with Autocert. -This setting will secure connections between Pomerium and the upstream service, and it’s the final piece you need to self-host a production-ready Pomerium deployment. +This setting will secure connections between Pomerium and the upstream service, and it's the final piece you need to self-host a production-ready Pomerium deployment. -**Next up**: [Production Certificates With Autocert](/docs/courses/fundamentals/production-certificates) +**Next up**: [Production Certificates With Autocert](/docs/capabilities/authentication) diff --git a/content/docs/courses/fundamentals/tcp-routes.md b/content/docs/get-started/fundamentals/core/tcp-routes.md similarity index 71% rename from content/docs/courses/fundamentals/tcp-routes.md rename to content/docs/get-started/fundamentals/core/tcp-routes.md index b371621fc..8aca2adf8 100644 --- a/content/docs/courses/fundamentals/tcp-routes.md +++ b/content/docs/get-started/fundamentals/core/tcp-routes.md @@ -11,38 +11,38 @@ sidebar_position: 7 # Build TCP Routes -Now that you’ve built several routes, it's time to proxy TCP connections with Pomerium. +Now that you've built several routes, it's time to proxy TCP connections with Pomerium. -Specifically,  we’ll create a [Redis](https://redis.io/) service and route users to it with a TCP connection. +Specifically,  we'll create a [Redis](https://redis.io/) service and route users to it with a TCP connection. :::note **Before You Start** -Make sure you’ve completed the following tutorials: +Make sure you've completed the following tutorials: -- [**Get Started**](/docs/courses/fundamentals/get-started) -- [**Build a Simple Route**](/docs/courses/fundamentals/build-routes) -- [**Build a Simple Policy**](/docs/courses/fundamentals/build-policies) -- [**Identity Verification with JWTs**](/docs/courses/fundamentals/jwt-verification) -- [**Build Advanced Policies**](/docs/courses/fundamentals/advanced-policies) -- [**Build Advanced Routes**](/docs/courses/fundamentals/advanced-routes) +- [**Get Started**](/docs/get-started/fundamentals/core/get-started) +- [**Build a Simple Route**](/docs/get-started/fundamentals/core/build-routes) +- [**Build a Simple Policy**](/docs/get-started/fundamentals/core/build-policies) +- [**Identity Verification with JWTs**](/docs/get-started/fundamentals/core/jwt-verification) +- [**Build Advanced Policies**](/docs/get-started/fundamentals/core/advanced-policies) +- [**Build Advanced Routes**](/docs/get-started/fundamentals/core/advanced-routes) -Each tutorial builds on the same configuration files. In this tutorial, you’ll build routes to several services and proxy TCP connections to these services with Pomerium CLI. +Each tutorial builds on the same configuration files. In this tutorial, you'll build routes to several services and proxy TCP connections to these services with Pomerium CLI. ::: ## Background -When replacing a traditional VPN, there are often non-HTTP based applications you still need to reach. Pomerium can provide the same type of protection to these services with [Pomerium CLI](/docs/clients/pomerium-cli), a client-side application to proxy TCP connections. +When replacing a traditional VPN, there are often non-HTTP based applications you still need to reach. Pomerium can provide the same type of protection to these services with [Pomerium CLI](/docs/deploy/clients), a client-side application to proxy TCP connections. -In this tutorial, you’ll secure a backend Redis service behind Pomerium and access it by connecting to it with a TCP route. +In this tutorial, you'll secure a backend Redis service behind Pomerium and access it by connecting to it with a TCP route. -Pomerium’s CLI client comes with a `tcp` command that you can use to secure this connection. +Pomerium's CLI client comes with a `tcp` command that you can use to secure this connection. ## Prerequisites To complete this tutorial, you need: -- [Pomerium CLI](/docs/clients/pomerium-cli) to proxy TCP connections between end-users and services behind Pomerium +- [Pomerium CLI](/docs/deploy/clients) to proxy TCP connections between end-users and services behind Pomerium - [mkcert](https://github.com/FiloSottile/mkcert) to generate a locally trusted Certificate Authority and certificates (for development purposes only) :::note @@ -53,7 +53,7 @@ For this tutorial, install Pomerium CLI to your system instead of using the Pome ### Test Pomerium CLI -Once you’ve installed Pomerium CLI, test the installation by running `pomerium-cli`: +Once you've installed Pomerium CLI, test the installation by running `pomerium-cli`: ```shell-session $ pomerium-cli @@ -86,7 +86,7 @@ Install `mkcert`: mkcert -install ``` -This command will install `mkcert` and generate a `rootCA.pem` file in your system’s trust store. +This command will install `mkcert` and generate a `rootCA.pem` file in your system's trust store. Generate wildcard certificates: @@ -94,7 +94,7 @@ Generate wildcard certificates: `mkcert "*.localhost.pomerium.io"` ``` -This command will generate the following certificates in your project’s root directory: +This command will generate the following certificates in your project's root directory: - `_wildcard.localhost.pomerium.io.pem` - `_wildcard.localhost.pomerium.io-key.pem` @@ -116,7 +116,7 @@ In your Docker Compose file, bind mount your wildcard certificates as a volume i ```yaml title="docker-compose.yaml" services: pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest volumes: # Mount your wildcard certificates: - ./_wildcard.localhost.pomerium.io-key.pem:/pomerium/key.pem:ro @@ -155,7 +155,7 @@ Add the Redis route to your service in your Pomerium configuration file using th ### Connect with Pomerium CLI -Now, use Pomerium CLI’s `tcp` command to connect to the Redis service +Now, use Pomerium CLI's `tcp` command to connect to the Redis service ```shell-session $ pomerium-cli tcp redis.localhost.pomerium.io:6379 --listen localhost:6379 @@ -198,6 +198,6 @@ io_threads_active:0 In this tutorial, you secured a TCP connection to Redis. To secure the connection, you used the `pomerium-cli` `tcp` command. -At this point, we’ve done all we can do with a hosted Pomerium instance in a Dockerized environment. You now know all the necessary basics for running Pomerium itself, so let’s take it out of Docker and into the wild! +At this point, we've done all we can do with a hosted Pomerium instance in a Dockerized environment. You now know all the necessary basics for running Pomerium itself, so let's take it out of Docker and into the wild! In the next tutorial, we will turn to Google Cloud Platform (GCP) to spin up a Virtual Machine instance, register a domain using Cloud Domains, and wire it up with Cloud DNS. This way, you can self-host your own domain and Pomerium. diff --git a/content/docs/get-started/fundamentals/zero/_category_.json b/content/docs/get-started/fundamentals/zero/_category_.json new file mode 100644 index 000000000..b688993f0 --- /dev/null +++ b/content/docs/get-started/fundamentals/zero/_category_.json @@ -0,0 +1,3 @@ +{ + "label": "Cloud Managed (Zero)" +} diff --git a/content/docs/get-started/fundamentals/zero/img/zero-advanced-policies/change-and-to-or-operator.gif b/content/docs/get-started/fundamentals/zero/img/zero-advanced-policies/change-and-to-or-operator.gif new file mode 100644 index 000000000..850d45a2a Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-advanced-policies/change-and-to-or-operator.gif differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-advanced-policies/email-allowlist.png b/content/docs/get-started/fundamentals/zero/img/zero-advanced-policies/email-allowlist.png new file mode 100644 index 000000000..4b6651c0a Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-advanced-policies/email-allowlist.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-advanced-policies/email-claim.png b/content/docs/get-started/fundamentals/zero/img/zero-advanced-policies/email-claim.png new file mode 100644 index 000000000..f334469c7 Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-advanced-policies/email-claim.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-advanced-policies/matching-domain.png b/content/docs/get-started/fundamentals/zero/img/zero-advanced-policies/matching-domain.png new file mode 100644 index 000000000..68643a9e6 Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-advanced-policies/matching-domain.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-advanced-policies/multiple-deny-blocks.png b/content/docs/get-started/fundamentals/zero/img/zero-advanced-policies/multiple-deny-blocks.png new file mode 100644 index 000000000..d4093589c Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-advanced-policies/multiple-deny-blocks.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-advanced-policies/multiple-policies.png b/content/docs/get-started/fundamentals/zero/img/zero-advanced-policies/multiple-policies.png new file mode 100644 index 000000000..1a7bfb11d Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-advanced-policies/multiple-policies.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-advanced-policies/user-data.png b/content/docs/get-started/fundamentals/zero/img/zero-advanced-policies/user-data.png new file mode 100644 index 000000000..4ee78c4e4 Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-advanced-policies/user-data.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/add-redirects-in-zero-console.png b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/add-redirects-in-zero-console.png new file mode 100644 index 000000000..4ce2cc089 Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/add-redirects-in-zero-console.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/host-rewrite-to-literal-value.png b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/host-rewrite-to-literal-value.png new file mode 100644 index 000000000..4869275ae Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/host-rewrite-to-literal-value.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/jwt-assertion-header.png b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/jwt-assertion-header.png new file mode 100644 index 000000000..75641eff6 Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/jwt-assertion-header.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/jwt-claim-headers.png b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/jwt-claim-headers.png new file mode 100644 index 000000000..47bbb5a92 Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/jwt-claim-headers.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/jwt-claims-response.png b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/jwt-claims-response.png new file mode 100644 index 000000000..1707b0b1d Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/jwt-claims-response.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/node-server-route.png b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/node-server-route.png new file mode 100644 index 000000000..b10ce2ecb Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/node-server-route.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/nodeserver-prefix-rewrite-setting.gif b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/nodeserver-prefix-rewrite-setting.gif new file mode 100644 index 000000000..8084b467d Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/nodeserver-prefix-rewrite-setting.gif differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/nodeserver-prefix-setting.gif b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/nodeserver-prefix-setting.gif new file mode 100644 index 000000000..28f758c72 Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/nodeserver-prefix-setting.gif differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/pz-redirect.gif b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/pz-redirect.gif new file mode 100644 index 000000000..a6285608a Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/pz-redirect.gif differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/server-endpoints.gif b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/server-endpoints.gif new file mode 100644 index 000000000..3527778a1 Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/server-endpoints.gif differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/set-and-remove-headers-response-body.png b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/set-and-remove-headers-response-body.png new file mode 100644 index 000000000..1dc1d71cb Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/set-and-remove-headers-response-body.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/set-and-remove-request-headers.png b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/set-and-remove-request-headers.png new file mode 100644 index 000000000..da43f02dd Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-advanced-routes/set-and-remove-request-headers.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-idp/idp-flow.gif b/content/docs/get-started/fundamentals/zero/img/zero-idp/idp-flow.gif new file mode 100644 index 000000000..a0850fcce Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-idp/idp-flow.gif differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-idp/zero-idp-settings.png b/content/docs/get-started/fundamentals/zero/img/zero-idp/zero-idp-settings.png new file mode 100644 index 000000000..e774cd0a9 Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-idp/zero-idp-settings.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-policies/pz-courses-ppl-editor.png b/content/docs/get-started/fundamentals/zero/img/zero-policies/pz-courses-ppl-editor.png new file mode 100644 index 000000000..cb1177366 Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-policies/pz-courses-ppl-editor.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-policies/pz-courses-ppl-example-1.png b/content/docs/get-started/fundamentals/zero/img/zero-policies/pz-courses-ppl-example-1.png new file mode 100644 index 000000000..0e29b72c0 Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-policies/pz-courses-ppl-example-1.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-policies/pz-courses-ppl-example-2.png b/content/docs/get-started/fundamentals/zero/img/zero-policies/pz-courses-ppl-example-2.png new file mode 100644 index 000000000..970e8b290 Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-policies/pz-courses-ppl-example-2.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-routes/from-and-to-urls.png b/content/docs/get-started/fundamentals/zero/img/zero-routes/from-and-to-urls.png new file mode 100644 index 000000000..c509f36b0 Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-routes/from-and-to-urls.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-routes/pz-courses-first-route.png b/content/docs/get-started/fundamentals/zero/img/zero-routes/pz-courses-first-route.png new file mode 100644 index 000000000..ca1ef09a5 Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-routes/pz-courses-first-route.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-routes/pz-courses-route-details.png b/content/docs/get-started/fundamentals/zero/img/zero-routes/pz-courses-route-details.png new file mode 100644 index 000000000..396b62942 Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-routes/pz-courses-route-details.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-sso/jwt-flow.svg b/content/docs/get-started/fundamentals/zero/img/zero-sso/jwt-flow.svg new file mode 100644 index 000000000..c9d1afa05 --- /dev/null +++ b/content/docs/get-started/fundamentals/zero/img/zero-sso/jwt-flow.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/content/docs/get-started/fundamentals/zero/img/zero-sso/pz-courses-apply-pass-id-headers.gif b/content/docs/get-started/fundamentals/zero/img/zero-sso/pz-courses-apply-pass-id-headers.gif new file mode 100644 index 000000000..87400c28e Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-sso/pz-courses-apply-pass-id-headers.gif differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-sso/pz-courses-jwt-synced.png b/content/docs/get-started/fundamentals/zero/img/zero-sso/pz-courses-jwt-synced.png new file mode 100644 index 000000000..2aad700db Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-sso/pz-courses-jwt-synced.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-tcp/redis-service.png b/content/docs/get-started/fundamentals/zero/img/zero-tcp/redis-service.png new file mode 100644 index 000000000..069ab90f6 Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-tcp/redis-service.png differ diff --git a/content/docs/get-started/fundamentals/zero/img/zero-tcp/ssh-server.png b/content/docs/get-started/fundamentals/zero/img/zero-tcp/ssh-server.png new file mode 100644 index 000000000..955cc9280 Binary files /dev/null and b/content/docs/get-started/fundamentals/zero/img/zero-tcp/ssh-server.png differ diff --git a/content/docs/courses/fundamentals/zero-advanced-policies.mdx b/content/docs/get-started/fundamentals/zero/zero-advanced-policies.mdx similarity index 88% rename from content/docs/courses/fundamentals/zero-advanced-policies.mdx rename to content/docs/get-started/fundamentals/zero/zero-advanced-policies.mdx index ee4af5041..5ec82a5de 100644 --- a/content/docs/courses/fundamentals/zero-advanced-policies.mdx +++ b/content/docs/get-started/fundamentals/zero/zero-advanced-policies.mdx @@ -1,7 +1,7 @@ --- id: zero-advanced-policies title: Advanced Policies -sidebar_label: 04. Advanced Policies +sidebar_label: 4. Advanced Policies sidebar_position: 4 --- @@ -10,21 +10,21 @@ import TabItem from '@theme/TabItem'; # Zero Fundamentals: Build Advanced Policies -In this guide, you’ll learn how to build **Advanced Policies** with Pomerium. +In this guide, you'll learn how to build **Advanced Policies** with Pomerium. :::note **Before You Start** -Make sure you’ve completed the following guides: +Make sure you've completed the following guides: -- [**Build a Simple Route**](/docs/courses/fundamentals/zero-build-routes) -- [**Build a Simple Policy**](/docs/courses/fundamentals/zero-build-policies) -- [**Single Sign-on (SSO)**](/docs/courses/fundamentals/zero-single-sign-on) +- [**Build a Simple Route**](/docs/get-started/fundamentals/zero/zero-build-routes) +- [**Build a Simple Policy**](/docs/get-started/fundamentals/zero/zero-build-policies) +- [**Single Sign-on (SSO)**](/docs/get-started/fundamentals/zero/zero-single-sign-on) -Each tutorial builds on the same configuration files. In this tutorial, you’ll add complexity to your authorization policy. +Each tutorial builds on the same configuration files. In this tutorial, you'll add complexity to your authorization policy. ::: -## What’s an advanced policy? +## What's an advanced policy? An “advanced policy” means the policy includes: @@ -132,14 +132,14 @@ Taking the policy you just created, you could create an identical policy that so Lastly, we'll create a new policy that denies access to any user on Saturday, Sunday, or weekdays after 5PM. -Deny access based on the [day of the week](/docs/capabilities/ppl#day-of-week-matcher): +Deny access based on the [day of the week](/docs/internals/ppl#day-of-week-matcher): 1. Create a new policy named "Deny access Sat-Sun and weekdays after 5pm" 1. Add a **DENY** block with an **And** operator 1. For **Criteria**, select **Day of Week** 1. For **Value**, enter "sat-sun" -Deny access based on the [time of day](/docs/capabilities/ppl#time-of-day-matcher): +Deny access based on the [time of day](/docs/internals/ppl#time-of-day-matcher): 1. Add another **Deny** block with an **Or** operator 1. For **Criteria**, select **Time of Day** @@ -193,4 +193,4 @@ In this way, you can chain together multiple policies to add richer access contr Now that you've seen some advanced policies, you should learn about advanced routes. -Go to [**Advanced Routes**](/docs/courses/fundamentals/zero-advanced-routes). +Go to [**Advanced Routes**](/docs/get-started/fundamentals/zero/zero-advanced-routes). diff --git a/content/docs/courses/fundamentals/zero-advanced-routes.mdx b/content/docs/get-started/fundamentals/zero/zero-advanced-routes.mdx similarity index 90% rename from content/docs/courses/fundamentals/zero-advanced-routes.mdx rename to content/docs/get-started/fundamentals/zero/zero-advanced-routes.mdx index 5dbfda6c3..207e11962 100644 --- a/content/docs/courses/fundamentals/zero-advanced-routes.mdx +++ b/content/docs/get-started/fundamentals/zero/zero-advanced-routes.mdx @@ -3,7 +3,7 @@ id: zero-advanced-routes title: Advanced Routes -sidebar_label: 05. Advanced Routes +sidebar_label: 5. Advanced Routes sidebar_position: 5 --- @@ -13,14 +13,14 @@ In this guide, you'll build advanced routes by exploring some of the route setti :::note **Before You Start** -Make sure you’ve completed the following guides: +Make sure you've completed the following guides: -- [**Build a Simple Route**](/docs/courses/fundamentals/zero-build-routes) -- [**Build a Simple Policy**](/docs/courses/fundamentals/zero-build-policies) -- [**Single Sign-on (SSO)**](/docs/courses/fundamentals/zero-single-sign-on) -- [**Build Advanced Policies**](/docs/courses/fundamentals/zero-advanced-policies) +- [**Build a Simple Route**](/docs/get-started/fundamentals/zero/zero-build-routes) +- [**Build a Simple Policy**](/docs/get-started/fundamentals/zero/zero-build-policies) +- [**Single Sign-on (SSO)**](/docs/get-started/fundamentals/zero/zero-single-sign-on) +- [**Build Advanced Policies**](/docs/get-started/fundamentals/zero/zero-advanced-policies) -Each tutorial builds on the same configuration files. In this tutorial, you’ll build new routes with some of Pomerium’s route-level settings. +Each tutorial builds on the same configuration files. In this tutorial, you'll build new routes with some of Pomerium's route-level settings. ::: @@ -37,7 +37,7 @@ In the Zero Console, these settings are organized into categories, like TLS Sett ### Set up HTTPBin -To test these settings, we will configure Pomerium Zero and Docker Compose to host an HTTPBin server. If you’re not familiar with [HTTPBin](https://httpbin.org/), it’s a call-and-response HTTP server you can use to test (you guessed it) HTTP requests and responses. +To test these settings, we will configure Pomerium Zero and Docker Compose to host an HTTPBin server. If you're not familiar with [HTTPBin](https://httpbin.org/), it's a call-and-response HTTP server you can use to test (you guessed it) HTTP requests and responses. Add the `httpbin` service to your Docker Compose file: @@ -62,7 +62,7 @@ Save your route and apply your changeset. ### Pass identity headers (per route) -[Pass Identity Headers](/docs/reference/routes/pass-identity-headers-per-route) is a route-level setting that forwards the user's JWT to the upstream application in a signed HTTP header. The HTTP header must use the (case insensitive) `x-pomerium-jwt-assertion` format. You configured this setting in the [previous guide](/docs/courses/fundamentals/zero-single-sign-on), but let's see how it looks as a request header. +[Pass Identity Headers](/docs/reference/routes/pass-identity-headers-per-route) is a route-level setting that forwards the user's JWT to the upstream application in a signed HTTP header. The HTTP header must use the (case insensitive) `x-pomerium-jwt-assertion` format. You configured this setting in the [previous guide](/docs/get-started/fundamentals/zero/zero-single-sign-on), but let's see how it looks as a request header. In the Zero Console: @@ -313,16 +313,16 @@ If you append the `/admin` endpoint to your route, Pomerium should direct you to ### Path Rewriting: Prefix Rewrite -Next, let’s add [**Prefix Rewrite**](/docs/reference/routes/path-rewriting#prefix-rewrite). +Next, let's add [**Prefix Rewrite**](/docs/reference/routes/path-rewriting#prefix-rewrite). In the Zero Console: 1. Select **Path Rewriting** 1. In the **Prefix Rewrite** field, enter a `/` -If the incoming request’s prefix matches the value of `prefix` (`/admin`), Pomerium will rewrite `prefix` to match the value of `prefix_rewrite`. +If the incoming request's prefix matches the value of `prefix` (`/admin`), Pomerium will rewrite `prefix` to match the value of `prefix_rewrite`. -Now, if you navigate to the `/admin` endpoint, Pomerium will redirect you to the `/` page. If you don’t include the `/admin` prefix, the request will `404`. +Now, if you navigate to the `/admin` endpoint, Pomerium will redirect you to the `/` page. If you don't include the `/admin` prefix, the request will `404`. ![Adding the / prefix rewrite setting to the Node server route](./img/zero-advanced-routes/nodeserver-prefix-rewrite-setting.gif) @@ -332,7 +332,7 @@ Great job! You've configured several advanced routes in Pomerium Zero. In the next guide, you'll secure TCP routes and access an SSH service. -Go to [TCP Routes](/docs/courses/fundamentals/zero-tcp-routes). +Go to [TCP Routes](/docs/get-started/fundamentals/zero/zero-tcp-routes). #### Configuration file state @@ -341,7 +341,7 @@ At this point, your Docker Compose file should look like: ```yaml title="docker-compose.yaml" services: pomerium: - image: pomerium/pomerium:v0.27.2 + image: pomerium/pomerium:latest ports: - 443:443 restart: always @@ -356,7 +356,7 @@ services: - verify..pomerium.app - authenticate..pomerium.app verify: - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest networks: main: aliases: diff --git a/content/docs/courses/fundamentals/zero-build-policies.mdx b/content/docs/get-started/fundamentals/zero/zero-build-policies.mdx similarity index 82% rename from content/docs/courses/fundamentals/zero-build-policies.mdx rename to content/docs/get-started/fundamentals/zero/zero-build-policies.mdx index 0cfa38146..fb223c604 100644 --- a/content/docs/courses/fundamentals/zero-build-policies.mdx +++ b/content/docs/get-started/fundamentals/zero/zero-build-policies.mdx @@ -2,7 +2,7 @@ id: zero-build-policies title: Build Policies description: Learn how policies work in Pomerium Zero. You'll build a simple authorization policy that protects access to Grafana. -sidebar_label: 02. Build Policies +sidebar_label: 2. Build Policies sidebar_position: 2 --- @@ -23,8 +23,8 @@ This guide shows you how to build **Authorization Policies** in Pomerium Zero. W Make sure you've completed the following guides: -- [**Quickstart**](/docs/quickstart) -- [**Build Routes**](/docs/courses/fundamentals/zero-build-routes) +- [**Quickstart**](/docs/get-started/quickstart) +- [**Build Routes**](/docs/get-started/fundamentals/zero/zero-build-routes) Each guide builds on the same configuration files. In this guide, you'll build a simple policy to protect access to your route. @@ -32,21 +32,21 @@ Each guide builds on the same configuration files. In this guide, you'll build a ## What is an Authorization Policy? -An **Authorization Policy** defines what resources a user (or group of users) can access within a cluster. It’s the logic that tells Pomerium, “this HR employee isn’t authorized to access the engineering staging app.” +An **Authorization Policy** defines what resources a user (or group of users) can access within a cluster. It's the logic that tells Pomerium, “this HR employee isn't authorized to access the engineering staging app.” As you might imagine, managing policies can get complicated as you add more members to your organization, or as you add more routes to your cluster. To ease you into building policies with Pomerium, you should first learn about **Pomerium Policy Language** (PPL). -After that, you’ll check out some PPL examples and write your own policies for your routes. +After that, you'll check out some PPL examples and write your own policies for your routes. -Let’s get started! +Let's get started! ### What is Pomerium Policy Language (PPL)? PPL is a proprietary, YAML-based declarative language that enables you to create fine-grained, secure, and performant policies to protect your services. -PPL is designed to be intuitive and simple. See the [**Policy Language**](/docs/capabilities/ppl) page for examples and in-depth explanations of the following core concepts in PPL: +PPL is designed to be intuitive and simple. See the [**Policy Language**](/docs/internals/ppl) page for examples and in-depth explanations of the following core concepts in PPL: - **Rules** - **Actions** @@ -58,7 +58,7 @@ We will cover each of these concepts in the examples below. ### PPL examples -Now that you’ve had a chance to learn about PPL, let’s jump into some simple examples: +Now that you've had a chance to learn about PPL, let's jump into some simple examples: **Example 1**: Allow access if the user's email address matches the `email` criterion value @@ -90,18 +90,18 @@ Requiring an exact email address is one way to secure an app, but it won't let a Instead of specifying the entire email address, you can write a policy that allows access if a user has the required `domain` in their email address (the part after `@`). -The example below instructs Pomerium to only grant a user access if their email address matches the **domain** criterion’s value. +The example below instructs Pomerium to only grant a user access if their email address matches the **domain** criterion's value. ![Creating a policy in Zero Console that only grants access if the user has matching domain in email address](./img/zero-policies/pz-courses-ppl-example-2.png) -Again, the domain criterion checks for the domain portion of the user’s email address. Using the example above: +Again, the domain criterion checks for the domain portion of the user's email address. Using the example above: - If your email is `bob@gmail.com`, Pomerium will deny you access - If your email is `bob@example.com`, Pomerium will grant you access **Example 3**: TODO - Currently, `user` criterion isn't an option in Zero. Wait until Custom IdP is implemented to use "Groups" claim -Now that we’ve covered some examples, it’s time to attach a policy to a route. +Now that we've covered some examples, it's time to attach a policy to a route. ## Build a policy @@ -113,7 +113,7 @@ By now, your Pomerium Zero cluster should have routes for the following services Currently, these routes secure access with the `Allow @pomerium.com ` setting. -That’s a great setting to test a route with, but we want to secure these routes with policies now. +That's a great setting to test a route with, but we want to secure these routes with policies now. **Learning Opportunity**: @@ -130,4 +130,4 @@ If you built your policy correctly, Pomerium should only grant you access if you Next, you'll learn how to secure your upstream service by verifying the user's identity with a JWT. This adds another layer of security to your application. -Go to [**Single Sign-on**](/docs/courses/fundamentals/zero-single-sign-on). +Go to [**Single Sign-on**](/docs/get-started/fundamentals/zero/zero-single-sign-on). diff --git a/content/docs/courses/fundamentals/zero-build-routes.mdx b/content/docs/get-started/fundamentals/zero/zero-build-routes.mdx similarity index 94% rename from content/docs/courses/fundamentals/zero-build-routes.mdx rename to content/docs/get-started/fundamentals/zero/zero-build-routes.mdx index b0c426ed1..219bc82a5 100644 --- a/content/docs/courses/fundamentals/zero-build-routes.mdx +++ b/content/docs/get-started/fundamentals/zero/zero-build-routes.mdx @@ -2,7 +2,7 @@ id: zero-build-routes title: Build Routes description: In this guide, learn how to configure a route in Pomerium Zero that secures an instance of Grafana. -sidebar_label: 01. Build Routes +sidebar_label: 1. Build Routes sidebar_position: 1 --- @@ -21,7 +21,7 @@ This guide shows you how to build a route to Grafana in Pomerium Zero. Watch the :::note -This guide assumes you've completed the [**Pomerium Zero Quickstart**](/docs/quickstart). +This guide assumes you've completed the [**Pomerium Zero Quickstart**](/docs/get-started/quickstart). ::: @@ -89,7 +89,7 @@ If you look at the route's TLS certificate, you'll notice the certificate was is Great job! You successfully built a route in Pomerium Zero. Next, you'll learn how to build authorization policies. -Go to [Build Policies](/docs/courses/fundamentals/zero-build-policies). +Go to [Build Policies](/docs/get-started/fundamentals/zero/zero-build-policies). #### Configuration file state @@ -98,7 +98,7 @@ At this point, your Docker Compose file should look like this: ```yaml title="docker-compose.yaml" services: pomerium: - image: cr.pomerium.com/pomerium/pomerium:v0.27.2 + image: pomerium.com/pomerium/pomerium:latest ports: - 443:443 restart: always @@ -112,7 +112,7 @@ services: aliases: - verify..pomerium.app verify: - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest networks: main: aliases: diff --git a/content/docs/courses/fundamentals/zero-custom-idp.mdx b/content/docs/get-started/fundamentals/zero/zero-custom-idp.mdx similarity index 62% rename from content/docs/courses/fundamentals/zero-custom-idp.mdx rename to content/docs/get-started/fundamentals/zero/zero-custom-idp.mdx index 5a53cc7ce..c086a319b 100644 --- a/content/docs/courses/fundamentals/zero-custom-idp.mdx +++ b/content/docs/get-started/fundamentals/zero/zero-custom-idp.mdx @@ -2,13 +2,13 @@ id: zero-custom-idp title: Custom Identity Provider description: In this guide, learn how to configure a custom identity provider in the Zero Console. -sidebar_label: 07. Custom Identity Provider +sidebar_label: 7. Custom Identity Provider sidebar_position: 7 --- # Zero Fundamentals: Configure a Custom Identity Provider -So far, you've been using our [Hosted Authenticate service](/docs/capabilities/hosted-authenticate-service), which provides a hosted authenticate service URL (`authenticate.pomerium.app`) and Pomerium's hosted identity provider to authenticate users. +So far, you've been using our [Hosted Authenticate service](/docs/capabilities/authentication), which provides a hosted authenticate service URL (`authenticate.pomerium.app`) and Pomerium's hosted identity provider to authenticate users. In this guide, you'll replace Pomerium's hosted identity provider with your own custom identity provider to handle authentication. @@ -16,12 +16,12 @@ In this guide, you'll replace Pomerium's hosted identity provider with your own Make sure you've completed the following tutorials: -- [**Build a Simple Route**](/docs/courses/fundamentals/zero-build-routes) -- [**Build a Simple Policy**](/docs/courses/fundamentals/zero-build-policies) -- [**Single Sign-on with JWTs**](/docs/courses/fundamentals/zero-single-sign-on) -- [**Build Advanced Policies**](/docs/courses/fundamentals/zero-advanced-policies) -- [**Build Advanced Routes**](/docs/courses/fundamentals/zero-advanced-routes) -- [**Build TCP Routes**](/docs/courses/fundamentals/zero-tcp-routes) +- [**Build a Simple Route**](/docs/get-started/fundamentals/zero/zero-build-routes) +- [**Build a Simple Policy**](/docs/get-started/fundamentals/zero/zero-build-policies) +- [**Single Sign-on with JWTs**](/docs/get-started/fundamentals/zero/zero-single-sign-on) +- [**Build Advanced Policies**](/docs/get-started/fundamentals/zero/zero-advanced-policies) +- [**Build Advanced Routes**](/docs/get-started/fundamentals/zero/zero-advanced-routes) +- [**Build TCP Routes**](/docs/get-started/fundamentals/zero/zero-tcp-routes) Each tutorial builds on the same configuration files. In this guide, you'll replace our hosted identity provider solution with your own custom identity provider. @@ -29,21 +29,21 @@ Each tutorial builds on the same configuration files. In this guide, you'll repl ## Choose an identity provider -You can integrate Pomerium with any identity provider (IdP) that supports the OAuth2.0 and OIDC protocols. For the purposes of this guide, we will use [GitHub](/docs/identity-providers/github) as the IdP (the configuration is simpler than other IdPs). +You can integrate Pomerium with any identity provider (IdP) that supports the OAuth2.0 and OIDC protocols. For the purposes of this guide, we will use [GitHub](/docs/integrations/user-identity/github) as the IdP (the configuration is simpler than other IdPs). If you prefer to use another IdP instead of GitHub, feel free to do so. You can refer to our identity provider guides for setup instructions. -- [Apple](/docs/identity-providers/apple) -- [Auth0](/docs/identity-providers/auth0) -- [Microsoft Entra ID (Azure AD)](/docs/identity-providers/azure) -- [Cognito](/docs/identity-providers/cognito) -- [GitHub](/docs/identity-providers/github) -- [GitLab](/docs/identity-providers/gitlab) -- [Google](/docs/identity-providers/google) -- [Okta](/docs/identity-providers/okta) -- [OneLogin](/docs/identity-providers/one-login) -- [Ping Identity](/docs/identity-providers/ping) -- [OIDC](/docs/identity-providers/oidc) +- [Apple](/docs/integrations/user-identity/apple) +- [Auth0](/docs/integrations/user-identity/auth0) +- [Microsoft Entra ID (Azure AD)](/docs/integrations/user-identity/azure) +- [Cognito](/docs/integrations/user-identity/cognito) +- [GitHub](/docs/integrations/user-identity/github) +- [GitLab](/docs/integrations/user-identity/gitlab) +- [Google](/docs/integrations/user-identity/google) +- [Okta](/docs/integrations/user-identity/okta) +- [OneLogin](/docs/integrations/user-identity/one-login) +- [Ping Identity](/docs/integrations/user-identity/ping) +- [OIDC](/docs/integrations/user-identity/oidc) ## Configure your identity provider diff --git a/content/docs/courses/fundamentals/zero-single-sign-on.mdx b/content/docs/get-started/fundamentals/zero/zero-single-sign-on.mdx similarity index 93% rename from content/docs/courses/fundamentals/zero-single-sign-on.mdx rename to content/docs/get-started/fundamentals/zero/zero-single-sign-on.mdx index ccc3aad7d..a43b9ae39 100644 --- a/content/docs/courses/fundamentals/zero-single-sign-on.mdx +++ b/content/docs/get-started/fundamentals/zero/zero-single-sign-on.mdx @@ -3,7 +3,7 @@ id: zero-single-sign-on title: Single Sign On -sidebar_label: 03. Single Sign-on with JWTs +sidebar_label: 3. Single Sign-on with JWTs sidebar_position: 3 --- @@ -26,8 +26,8 @@ Watch the video for a quick walkthrough or read the guide below for step-by-step Make sure you've completed the following guides: -- [**Build Routes**](/docs/courses/fundamentals/zero-build-routes) -- [**Build Policies**](/docs/courses/fundamentals/zero-build-policies) +- [**Build Routes**](/docs/get-started/fundamentals/zero/zero-build-routes) +- [**Build Policies**](/docs/get-started/fundamentals/zero/zero-build-policies) Each guide builds on the same configuration files. In this guide, you'll add JWT settings to your Grafana instance. @@ -35,7 +35,7 @@ Each guide builds on the same configuration files. In this guide, you'll add JWT ## What is a JWT? -If you’re unfamiliar with JWTs, here’s a quick definition sourced from [JWT.io](https://jwt.io/): +If you're unfamiliar with JWTs, here's a quick definition sourced from [JWT.io](https://jwt.io/): > JSON Web Tokens are an open, industry standard [RFC 7519](https://tools.ietf.org/html/rfc7519) method for representing **claims** securely between two parties. @@ -139,7 +139,7 @@ You also need to add another alias for the Pomerium Authenticate service: ```yaml title="docker-compose" pomerium: - image: pomerium/pomerium:v0.27.2 + image: pomerium/pomerium:latest ports: - 443:443 restart: always @@ -190,7 +190,7 @@ We also provide SDKs for JWT verification in the following languages: Great job! You successfully configured SSO in Pomerium. Next, you'll learn how to build more advanced policies. -Go to [**Build Advanced Policies**](/docs/courses/fundamentals/zero-advanced-policies). +Go to [**Build Advanced Policies**](/docs/get-started/fundamentals/zero/zero-advanced-policies). #### Configuration file state @@ -199,7 +199,7 @@ At this point, your Docker Compose file should look like this: ```yaml title="docker-compose.yaml" services: pomerium: - image: cr.pomerium.com/pomerium/pomerium:v0.27.2 + image: pomerium.com/pomerium/pomerium:latest ports: - 443:443 restart: always @@ -214,7 +214,7 @@ services: - verify..pomerium.app - authenticate..pomerium.app verify: - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest networks: main: aliases: diff --git a/content/docs/courses/fundamentals/zero-tcp-routes.mdx b/content/docs/get-started/fundamentals/zero/zero-tcp-routes.mdx similarity index 82% rename from content/docs/courses/fundamentals/zero-tcp-routes.mdx rename to content/docs/get-started/fundamentals/zero/zero-tcp-routes.mdx index dce3924fa..cc19875b1 100644 --- a/content/docs/courses/fundamentals/zero-tcp-routes.mdx +++ b/content/docs/get-started/fundamentals/zero/zero-tcp-routes.mdx @@ -3,23 +3,23 @@ id: zero-tcp-routes title: TCP Routes -sidebar_label: 06. TCP Routes +sidebar_label: 6. TCP Routes sidebar_position: 6 --- # Zero Fundamentals: Secure TCP and SSH Connections -Now that you’ve built several routes, you'll learn how to proxy TCP and SSH connections with Pomerium Zero. +Now that you've built several routes, you'll learn how to proxy TCP and SSH connections with Pomerium Zero. :::note **Before You Start** -Make sure you’ve completed the following tutorials: +Make sure you've completed the following tutorials: -- [**Build a Simple Route**](/docs/courses/fundamentals/zero-build-routes) -- [**Build a Simple Policy**](/docs/courses/fundamentals/zero-build-policies) -- [**Single Sign-on with JWTs**](/docs/courses/fundamentals/zero-single-sign-on) -- [**Build Advanced Policies**](/docs/courses/fundamentals/zero-advanced-policies) -- [**Build Advanced Routes**](/docs/courses/fundamentals/zero-advanced-routes) +- [**Build a Simple Route**](/docs/get-started/fundamentals/zero/zero-build-routes) +- [**Build a Simple Policy**](/docs/get-started/fundamentals/zero/zero-build-policies) +- [**Single Sign-on with JWTs**](/docs/get-started/fundamentals/zero/zero-single-sign-on) +- [**Build Advanced Policies**](/docs/get-started/fundamentals/zero/zero-advanced-policies) +- [**Build Advanced Routes**](/docs/get-started/fundamentals/zero/zero-advanced-routes) Each tutorial builds on the same configuration files. In this guide, you'll proxy TCP connections to a Redis database and a remote OpenSSH server. @@ -27,17 +27,17 @@ Each tutorial builds on the same configuration files. In this guide, you'll prox ## Background -When replacing a traditional VPN, there are often non-HTTP based applications you still need to reach. Pomerium can provide the same type of protection to these services with [Pomerium CLI](/docs/clients/pomerium-cli), a client-side application to proxy TCP connections. +When replacing a traditional VPN, there are often non-HTTP based applications you still need to reach. Pomerium can provide the same type of protection to these services with [Pomerium CLI](/docs/deploy/clients), a client-side application to proxy TCP connections. In this guide, you'll proxy TCP connections to a Redis database and an OpenSSH server. -Pomerium’s CLI client comes with a `tcp` command that you can use to secure these connections. +Pomerium's CLI client comes with a `tcp` command that you can use to secure these connections. ## Prerequisites To complete this guide, you need: -- [Pomerium CLI](/docs/clients/pomerium-cli) to proxy TCP connections between end-users and services behind Pomerium +- [Pomerium CLI](/docs/deploy/clients) to proxy TCP connections between end-users and services behind Pomerium :::note @@ -195,4 +195,4 @@ Awesome! You successfully configured two services that take advantage of Pomeriu ## Next Steps: -- Add your own [**Custom Identity Provider**](/docs/courses/fundamentals/zero-custom-idp) +- Add your own [**Custom Identity Provider**](/docs/get-started/fundamentals/zero/zero-custom-idp) diff --git a/content/docs/quickstart.mdx b/content/docs/get-started/quickstart.mdx similarity index 77% rename from content/docs/quickstart.mdx rename to content/docs/get-started/quickstart.mdx index e518e6091..a0650dff6 100644 --- a/content/docs/quickstart.mdx +++ b/content/docs/get-started/quickstart.mdx @@ -41,7 +41,7 @@ After you create an account, you'll be directed to the Zero onboarding screen. I If you are using Pomerium Zero for the first time, but have an existing Pomerium Core configuration, you can import it into Pomerium Zero by following the prompts in the Zero onboarding flow. -See [**Import Core Config to Zero**](/docs/zero/import#how-to-import-your-core-configuration) for more information. +See [**Import Core Config to Zero**](/docs/deploy/cloud/import#how-to-import-your-core-configuration) for more information. ::: @@ -52,7 +52,7 @@ Paste the configuration in a `compose.yaml` file: ```yaml title="compose.yaml" {8,15} showLineNumbers services: pomerium: - image: pomerium/pomerium:v0.27.2 + image: pomerium/pomerium:latest ports: - 443:443 restart: always @@ -66,7 +66,7 @@ services: aliases: - verify..pomerium.app verify: - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest networks: main: aliases: @@ -88,7 +88,7 @@ Replace the following values: You can find your **Starter Domain** at the top of the Zero Console navigation bar: -![Selecting the Cluster dropdown menu in the Zero Console to see the cluster starter domain](./img/quickstart/starter-domain.png) +![Selecting the Cluster dropdown menu in the Zero Console to see the cluster starter domain](./quickstart/starter-domain.png) ::: @@ -104,7 +104,7 @@ Pomerium will deploy and run in a special "Zero-managed" mode. In Zero-managed m If your Pomerium deployment connects to the cloud successfully, Pomerium Zero will notify you in the onboarding screen: -![The successful connection notification in the Pomerium Zero onboarding flow](./img/quickstart/zero-quickstart-connection.png) +![The successful connection notification in the Pomerium Zero onboarding flow](./quickstart/zero-quickstart-connection.png) Once you've connected, select **Finish**. You'll be directed to the Zero Console. @@ -112,8 +112,8 @@ Once you've connected, select **Finish**. You'll be directed to the Zero Console If you can't connect to Pomerium Zero, check out these pages for help: -- [**Configure port 443 to allow inbound access**](/docs/troubleshooting#configure-port-443-to-allow-inbound-access) -- [**Override IP address**](/docs/concepts/clusters#detected-and-override-ip-address) +- [**Configure port 443 to allow inbound access**](/docs/internals/troubleshooting#configure-port-443-to-allow-inbound-access) +- [**Override IP address**](/docs/internals/clusters#detected-and-override-ip-address) ::: @@ -121,7 +121,7 @@ If you can't connect to Pomerium Zero, check out these pages for help: In the Zero Console, we've provisioned two starter routes, **SSH** and **Verify**, that come with their own DNS records and TLS certificates: -![Viewing the two starter routes](./img/quickstart/pz-quickstart-routes.png) +![Viewing the two starter routes](./quickstart/pz-quickstart-routes.png) ### Connect to Verify @@ -131,11 +131,11 @@ In the Zero Console, select the **From** URL for the Verify app. You should land on the Verify page: -![The homepage of the Verify app after the user is redirected](./img/quickstart/pz-identity-verified.png) +![The homepage of the Verify app after the user is redirected](./quickstart/pz-identity-verified.png) :::info Build your own route -Check out [**Pomerium Fundamentals: Build Routes**](/docs/courses/fundamentals/zero-build-routes) to learn how to create a route to your own service behind Pomerium. +Check out [**Pomerium Fundamentals: Build Routes**](/docs/get-started/fundamentals/zero/zero-build-routes) to learn how to create a route to your own service behind Pomerium. ::: @@ -145,7 +145,7 @@ The demo SSH route connects to a remote server that you can use to test SSH conn :::note Install Pomerium CLI -You need the Pomerium CLI client to connect to services like **SSH** over a TCP connection. See the [**Pomerium CLI**](/docs/clients/pomerium-cli) page for installation instructions. +You need the Pomerium CLI client to connect to services like **SSH** over a TCP connection. See the [**Pomerium CLI**](/docs/deploy/clients) page for installation instructions. ::: @@ -172,14 +172,14 @@ This is an SSH honeypot. Everything is logged and monitored. Select the **Policies** tab. In the policies table, you'll notice a default policy that only grants access if the user's email matches the one associated with your Pomerium Zero account: -![Reviewing the starter policy in the Zero Console](./img/quickstart/pz-quickstart-policy.png) +![Reviewing the starter policy in the Zero Console](./quickstart/pz-quickstart-policy.png) :::info Update policy This **Starter Policy** is assigned to both of the demo routes. You can remove this policy and create your own at any time. -- Go to the [**PPL page**](/docs/capabilities/ppl) to learn about Pomerium Policy Language -- Go to [**Build Policies**](/docs/courses/fundamentals/zero-build-policies) to learn how to create and assign policies using the Zero PPL builder +- Go to the [**PPL page**](/docs/internals/ppl) to learn about Pomerium Policy Language +- Go to [**Build Policies**](/docs/get-started/fundamentals/zero/zero-build-policies) to learn how to create and assign policies using the Zero PPL builder ::: @@ -187,10 +187,10 @@ Pomerium automatically provisions and manages TLS certificates issued by ZeroSSL To see certificates in your cluster, go to the **Certificates** tab: -![View cluster certificates from ZeroSSL](./img/quickstart/pz-starter-certificates.png) +![View cluster certificates from ZeroSSL](./quickstart/pz-starter-certificates.png) ## Next Steps -### [Build your First Route](/docs/courses/fundamentals/zero-build-routes) +### [Build your First Route](/docs/get-started/fundamentals/zero/zero-build-routes) ### [Add a Custom Domain](/docs/capabilities/custom-domains) diff --git a/content/docs/get-started/quickstart/cluster-certs.png b/content/docs/get-started/quickstart/cluster-certs.png new file mode 100644 index 000000000..ebd1919ec Binary files /dev/null and b/content/docs/get-started/quickstart/cluster-certs.png differ diff --git a/content/docs/get-started/quickstart/pz-identity-verified.png b/content/docs/get-started/quickstart/pz-identity-verified.png new file mode 100644 index 000000000..ec332c224 Binary files /dev/null and b/content/docs/get-started/quickstart/pz-identity-verified.png differ diff --git a/content/docs/get-started/quickstart/pz-quickstart-policy.png b/content/docs/get-started/quickstart/pz-quickstart-policy.png new file mode 100644 index 000000000..777badd6b Binary files /dev/null and b/content/docs/get-started/quickstart/pz-quickstart-policy.png differ diff --git a/content/docs/get-started/quickstart/pz-quickstart-routes.png b/content/docs/get-started/quickstart/pz-quickstart-routes.png new file mode 100644 index 000000000..996880ef3 Binary files /dev/null and b/content/docs/get-started/quickstart/pz-quickstart-routes.png differ diff --git a/content/docs/get-started/quickstart/pz-starter-certificates.png b/content/docs/get-started/quickstart/pz-starter-certificates.png new file mode 100644 index 000000000..e0a9f2851 Binary files /dev/null and b/content/docs/get-started/quickstart/pz-starter-certificates.png differ diff --git a/content/docs/get-started/quickstart/self-signed-warning.png b/content/docs/get-started/quickstart/self-signed-warning.png new file mode 100644 index 000000000..e00423759 Binary files /dev/null and b/content/docs/get-started/quickstart/self-signed-warning.png differ diff --git a/content/docs/get-started/quickstart/starter-domain.png b/content/docs/get-started/quickstart/starter-domain.png new file mode 100644 index 000000000..105d5ab97 Binary files /dev/null and b/content/docs/get-started/quickstart/starter-domain.png differ diff --git a/content/docs/get-started/quickstart/zero-quickstart-connection.png b/content/docs/get-started/quickstart/zero-quickstart-connection.png new file mode 100644 index 000000000..f5e58e428 Binary files /dev/null and b/content/docs/get-started/quickstart/zero-quickstart-connection.png differ diff --git a/content/docs/guides/ad-guard.md b/content/docs/guides/ad-guard.md index 1254e09f7..b0ee4d55d 100644 --- a/content/docs/guides/ad-guard.md +++ b/content/docs/guides/ad-guard.md @@ -76,4 +76,4 @@ Simply navigate to your new adguard instance (e.g. `https://adguard.domain.examp ![adguard dashboard](img/adguard/adguard-dashboard.png) -[quick start]: /docs/quickstart +[quick start]: /docs/get-started/quickstart diff --git a/content/docs/guides/certificates.mdx b/content/docs/guides/certificates.mdx deleted file mode 100644 index c807b01e4..000000000 --- a/content/docs/guides/certificates.mdx +++ /dev/null @@ -1,144 +0,0 @@ ---- -# cSpell:ignore filippo, signcsr, mycsr - -title: Set up mTLS -sidebar_label: Set up mTLS -lang: en-US -description: This guide walks you through setting up mutual TLS with Pomerium. -keywords: [x509, certificates, tls, mtls, letsencrypt, lets encrypt] -pagination_prev: null ---- - -import Tabs from '@theme/Tabs'; -import TabItem from '@theme/TabItem'; -import GenerateWildcardCert from '@site/content/examples/sh/generate_wildcard_cert.sh.md'; - -## Set up mTLS with Pomerium - -This guide covers how to generate and set up TLS certificates suitable for working with Pomerium. - -Tools and resources: - -- [LetsEncrypt](https://letsencrypt.org/about/): a public CA that issues free certificates trusted by major browsers; other [private](https://blog.cloudflare.com/how-to-build-your-own-public-key-infrastructure/) or [public](https://scotthelme.co.uk/are-ev-certificates-worth-the-paper-theyre-written-on/) CAs are also fine -- [mkcert](https://mkcert.org/): a free tool for generating self-signed certificates ideal for testing purposes -- [Google Domains](https://domains.google.com/): a domain name registrar you will use to set up your wildcard domain and certificate validation. You can use other registrars as well (some even support [automatic renewal](https://github.com/Neilpang/acme.sh/wiki/dnsapi)) -- [Acme.sh](https://github.com/Neilpang/acme.sh): an Automated Certificate Management Environment (ACME) client you will use to fetch your wildcard certificate. Any [LetsEncrypt client](https://letsencrypt.org/docs/client-options/) that supports wildcard domains would work. - -:::note - -There are countless ways to build and manage your public-key infrastructure. Although we hope this guide serves as a helpful baseline for generating and securing Pomerium with certificates, you should modify these instructions to meet your own organization's tools, needs, and constraints. - -In a production environment you will likely use your corporate load balancer or a key management system to manage your certificate authority infrastructure. - -::: - -### Set up DNS - -Set a CNAME record for the wildcard domain you will use with Pomerium. - -![Certificate wildcard domain](./img/certificates/certificate-wildcard-domain.png) - -### Enable per-route TLS certificate automation - -Pomerium can retrieve, manage, and renew certificates for you (for free) using LetsEncrypt. To enable certificate automation, you must allow public traffic on ports `80` and `443`. - -To use Pomerium’s autocert configuration setting, set `autocert` to `true` in your configuration file: - -```yaml -autocert: true -``` - -See the [Autocert] and [Autocert Directory] settings for more information. - -### Generate a self-signed wildcard certificate - -In production, you would use a public CA like LetsEncrypt to generate your wildcard certificate. For a local proof of concept or development, you can use mkcert to generate a locally-trusted, self-signed development certificate with any name you like. - -For the purposes of this guide, create a wildcard certificate using the domain `*.localhost.pomerium.io`, which we’ve pre-configured to route to localhost. - -1. Install mkcert. - - - - - - ```bash - go install filippo.io/mkcert@latest - ``` - - - - - - ```bash - brew install mkcert - ``` - - - - - -1. Bootstrap mkcert's root certificate into your operating system's trust store. - - ```bash - mkcert -install - ``` - -1. Create your wildcard domain. `*.localhost.pomerium.io` is a helper domain we've hard-coded to route to localhost: - - ```bash - mkcert "*.localhost.pomerium.io" - ``` - -### Sign wildcard certificate - -With your wildcard domain set at `*.localhost.pomerium.io`, use acme.sh to create a certificate signing request with LetsEncrypt. - - - -LetsEncrypt will respond with the corresponding `TXT` record needed to verify your domain. - -![pomerium add a text entry to your dns records](./img/certificates/certificate-domain-challenge.png) - -It may take a few minutes for the DNS records to propagate. Once they do, run the following command to complete the certificate request process: - -```bash -acme.sh --signcsr --csr /path/to/mycsr/csr --dns dns_cf -``` - -Here's how the above certificates signed by LetsEncrypt correspond to their respective Pomerium configuration settings: - -| Pomerium Config | Certificate file | -| --- | --- | -| [CERTIFICATE] | `$HOME/.acme.sh/*.corp.example.com_ecc/fullchain.cer` | -| [CERTIFICATE_KEY][certificate] | `$HOME/.acme.sh/*.corp.example.com_ecc/*.corp.example.com.key` | - -Your end users will see a valid certificate for all domains delegated by Pomerium. - -![pomerium valid certificate](./img/certificates/certificates-valid-secure-certificate.png) - -![pomerium certificates A+ ssl labs rating](./img/certificates/certificates-ssl-report.png) - -:::caution - -LetsEncrypt certificates must be renewed [every 90 days](https://letsencrypt.org/2015/11/09/why-90-days.html). - -::: - -## Resources - -Certificates, TLS, and Public Key Cryptography is a vast subject we cannot adequately cover here. If you are unfamiliar with these topics, the following resources may be helpful: - -- [Why HTTPS for Everything?](https://https.cio.gov/everything/) The US government's CIO office has an excellent guide covering HTTPS and why future government sites will all be HTTPS. -- [Is TLS Fast](https://istlsfastyet.com/) debunks the performance myth associated with HTTPS. -- [Use TLS](https://smallstep.com/blog/use-tls.html) covers why TLS should be used everywhere; not just for securing typical internet traffic, but for securing service communication in both "trusted" and adversarial situations. -- [Everything you should know about certificates and PKI but are too afraid to ask](https://smallstep.com/blog/everything-pki.html) - -[autocert]: /docs/reference/autocert -[autocert directory]: /docs/reference/autocert -[certificate]: /docs/reference/certificates -[certificate_authority]: /docs/reference/certificates -[certificate_key]: /docs/reference/certificates -[override_certificate_name]: /docs/reference/override-certificate-name -[principles]: /docs/concepts/zero-trust.md#history -[zero trust]: /docs/concepts/zero-trust.md#zero-trust diff --git a/content/docs/guides/cloud-run.mdx b/content/docs/guides/cloud-run.mdx index 962ef5cd3..1fa4a78a4 100644 --- a/content/docs/guides/cloud-run.mdx +++ b/content/docs/guides/cloud-run.mdx @@ -9,10 +9,10 @@ keywords: description: This guide covers how to deploy Pomerium to Cloud Run and use it to protect other endpoints via Authorization Headers. --- -import CloudRunConfig from '../../examples/cloudrun/config.yaml.md'; -import PolicyTemplate from '../../examples/cloudrun/policy.template.yaml.md'; -import Zonefile from '../../examples/cloudrun/zonefile.txt.md'; -import DeployScript from '../../examples/cloudrun/deploy.sh.md'; +import CloudRunConfig from '/content/examples/cloudrun/config.yaml.md'; +import PolicyTemplate from '/content/examples/cloudrun/policy.template.yaml.md'; +import Zonefile from '/content/examples/cloudrun/zonefile.txt.md'; +import DeployScript from '/content/examples/cloudrun/deploy.sh.md'; :::caution diff --git a/content/docs/guides/cockpit.md b/content/docs/guides/cockpit.md index d5b004709..670f880f3 100644 --- a/content/docs/guides/cockpit.md +++ b/content/docs/guides/cockpit.md @@ -23,10 +23,10 @@ description: Learn how to secure Cockpit, a web GUI for Linux servers, behind Po This guide assumes you already have Pomerium installed and connected to your [IdP](/docs/internals/glossary#identity-provider). If not, follow the instructions in the following articles before continuing: - Install Pomerium - - [Binaries](/docs/core) if installing Pomerium as a system-level service. - - [Pomerium using Docker](/docs/quickstart) if installing Pomerium as a Docker container - - [Install Pomerium using Kubernetes](/docs/k8s/quickstart) for Kubernetes environments. -- Connect to an IdP - See [Identity Provider Configuration](/docs/identity-providers) and find the article for your identity provider. + - [Binaries](/docs/deploy/core) if installing Pomerium as a system-level service. + - [Pomerium using Docker](/docs/get-started/quickstart) if installing Pomerium as a Docker container + - [Install Pomerium using Kubernetes](/docs/deploy/k8s/quickstart) for Kubernetes environments. +- Connect to an IdP - See [Identity Provider Configuration](/docs/integrations/user-identity/identity-providers) and find the article for your identity provider. ## Install & Configure Cockpit diff --git a/content/docs/guides/code-server.mdx b/content/docs/guides/code-server.mdx index 1d6b5c07f..200d8f671 100644 --- a/content/docs/guides/code-server.mdx +++ b/content/docs/guides/code-server.mdx @@ -16,7 +16,7 @@ keywords: coder, codercom, ] -description: In this guide, you’ll run code-server VSCode in a Docker container and secure browser access to your project behind Pomerium. +description: In this guide, you'll run code-server VSCode in a Docker container and secure browser access to your project behind Pomerium. --- import Tabs from '@theme/Tabs'; @@ -34,9 +34,9 @@ Code-server is particularly popular among developers who want the full power of ## How to secure Code-server with Pomerium -Code-server requires [password authentication](https://coder.com/docs/code-server/latest/guide#expose-code-server) by default. By securing code-server behind Pomerium, you can remove code-server’s password requirement and configure Pomerium to add [authentication](/docs/capabilities/authentication) and [authorization](/docs/capabilities/authorization) to an online instance of VSCode. +Code-server requires [password authentication](https://coder.com/docs/code-server/latest/guide#expose-code-server) by default. By securing code-server behind Pomerium, you can remove code-server's password requirement and configure Pomerium to add [authentication](/docs/capabilities/authentication) and [authorization](/docs/capabilities/authorization) to an online instance of VSCode. -This guide shows you how to secure code-server with Pomerium. Here are the steps you’ll follow: +This guide shows you how to secure code-server with Pomerium. Here are the steps you'll follow: 1. Install code-server and run it in a Docker container @@ -90,7 +90,7 @@ First, make sure your `docker-compose.yaml` file contains the images to run Pome ```yaml {7,14} showLineNumbers pomerium: - image: pomerium/pomerium:v0.27.2 + image: pomerium/pomerium:latest ports: - 443:443 restart: always @@ -132,7 +132,7 @@ Now that you can access VSCode in your browser, test out code-server by building 1. Create an `index.html` file and add the following code: ```html - + diff --git a/content/docs/guides/cors.md b/content/docs/guides/cors.md deleted file mode 100644 index 5326830c3..000000000 --- a/content/docs/guides/cors.md +++ /dev/null @@ -1,245 +0,0 @@ ---- -# cSpell:ignore reactjs nextjs - -title: Cross-Origin Configuration -lang: en-US -keywords: - [cors, javascript, cross-origin, spa, reactjs, single-page-app, nextjs, ajax] -description: This guide covers how to configure Pomerium for Cross-Origin setups. ---- - -Many applications, particularly single-page Javascript applications, use multiple domains for requests. For example an application may be served from `https://app.example.com`, but may make API calls to `https://api.example.com`. This guide covers how to configure Pomerium to work with applications like this. - -This guide uses the following components: - -1. An authenticated web application that serves the initial HTML + Javascript. -1. An API web application that serves a JSON API. -1. An instance of Pomerium in front of both. - -## Configuration - -### Pomerium - -Create a file `config.yaml`: - -```yaml -authenticate_service_url: https://authenticate.localhost.pomerium.io - -certificate_file: /pomerium/cert.pem -certificate_key_file: /pomerium/private-key.pem - -idp_provider: REPLACE -idp_client_id: REPLACE -idp_client_secret: REPLACE - -cookie_secret: V2JBZk0zWGtsL29UcFUvWjVDWWQ2UHExNXJ0b2VhcDI= - -routes: - - from: https://api.localhost.pomerium.io - to: http://api:8000 - allow_any_authenticated_user: true - cors_allow_preflight: true - set_response_headers: - 'Access-Control-Allow-Credentials': 'true' - 'Access-Control-Allow-Origin': 'https://app.localhost.pomerium.io' - 'Access-Control-Allow-Headers': 'X-Pomerium-Authorization' - - from: https://app.localhost.pomerium.io - to: http://app:8000 - allow_any_authenticated_user: true -``` - -### Web Application - -The Web application is a simple go HTTP server. Create a file `app.go`: - -```go -package main - -import ( - "net/http" -) - -func main() { - http.Handle("/", http.FileServer(http.Dir("."))) - http.ListenAndServe(":8000", nil) -} -``` - -Create a file `index.html`: - -```html - - - - Example Application - - - - -``` - -And a file `index.mjs`: - -```javascript -(async () => { - const result = await fetch('https://api.localhost.pomerium.io', { - method: 'POST', - headers: { - Accept: 'application/json', - }, - }); - const json = await result.json(); - console.log('RESULT', json); -})(); -``` - -### API Application - -The API application is a simple go HTTP server. Create a file `api.go`: - -```go -package main - -import ( - "io" - "net/http" -) - -func main() { - http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { - w.Header().Set("Content-Type", "application/json") - io.WriteString(w, `{ "message": "HELLO WORLD" }`) - }) - http.ListenAndServe(":8000", nil) -} -``` - -### Docker-Compose - -Finally create a docker-compose file `docker-compose.yaml`: - -```yaml -services: - pomerium: - image: pomerium/pomerium:main - ports: - - 443:443 - volumes: - - ./_wildcard.localhost.pomerium.io.pem:/pomerium/cert.pem:ro - - ./_wildcard.localhost.pomerium.io-key.pem:/pomerium/private-key.pem:ro - - ./config.yaml:/pomerium/config.yaml:ro - - app: - image: golang:latest - command: ['go', 'run', '.'] - environment: - GO111MODULE: 'off' - volumes: - - ./app.go:/go/app.go:ro - - ./index.html:/go/index.html:ro - - ./index.mjs:/go/index.mjs:ro - - api: - image: golang:latest - command: ['go', 'run', '.'] - environment: - GO111MODULE: 'off' - volumes: - - ./api.go:/go/api.go:ro -``` - -### Problem - -This configuration results in a 401 error when `app.localhost.pomerium.io` is accessed: - -> URL: https://api.localhost.pomerium.io/ Status: 401 Unauthorized Source: Network Address: 127.0.0.1:443 Initiator: index.mjs:2 - -The 401 is because the browser will not send the Pomerium cookie to a different domain. - -## Solutions - -### Use a Single Domain - -Instead of using two domains, a single domain can be used with separate routes based on the path instead of the domain name. For example the routes can be setup as: - -```yaml -routes: - - from: https://app.localhost.pomerium.io - prefix: /api - to: http://api:8000 - allow_any_authenticated_user: true - - from: https://app.localhost.pomerium.io - to: http://app:8000 - allow_any_authenticated_user: true -``` - -In this way all requests to `/api` will be sent to the API server, and all other requests will be handled by the web application. Update the javascript to use the new domain: - -```javascript -(async () => { - const result = await fetch(location.origin + '/api', { - method: 'POST', - headers: { - Accept: 'application/json', - }, - }); - const json = await result.json(); - console.log('RESULT', json); -})(); -``` - -And the request will succeed. - -### Pass the Pomerium Credentials via a Header - -Since the browser won't send a cookie to a different domain, you can pass the Pomerium authorization JWT via a header instead. - -First allow Javascript to see the cookie with: - -```yaml -cookie_http_only: false -``` - -And update the javascript: - -```javascript -(async () => { - const result = await fetch('https://api.localhost.pomerium.io', { - method: 'POST', - headers: { - Accept: 'application/json', - 'X-Pomerium-Authorization': document.cookie.substring( - document.cookie.indexOf('=') + 1, - ), - }, - }); - const json = await result.json(); - console.log('RESULT', json); -})(); -``` - -### Share the Cookie - -If both domains fall under a shared parent domain (`app.example.com` and `api.example.com` are both under `example.com`), you can change the Pomerium's cookie domain and share the cookie. Update the pomerium configuration: - -```yaml -cookie_domain: '.localhost.pomerium.io' # note the starting . -``` - -And now the cookie will be used for both domains. However the default browser policy for XHR and Fetch requests is to not pass the cookie, so you also need to change the javascript: - -```javascript -(async () => { - const result = await fetch('https://api.localhost.pomerium.io', { - method: 'POST', - headers: { - Accept: 'application/json', - }, - credentials: 'include', - }); - const json = await result.json(); - console.log('RESULT', json); -})(); -``` - -See [withCredentials](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials) for XMLHttpRequest. diff --git a/content/docs/guides/gitlab.mdx b/content/docs/guides/gitlab.mdx index 5e84827ef..25d729394 100644 --- a/content/docs/guides/gitlab.mdx +++ b/content/docs/guides/gitlab.mdx @@ -19,7 +19,7 @@ description: This guide covers how to secure self-hosted GitLab behind Pomerium, import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem'; -import InstallMkcert from '@site/content/_install-mkcert.md'; +import InstallMkcert from '@site/content/docs/admonitions/_install-mkcert.md'; [GitLab] is a highly customizable, highly configurable tool to manage source code, project management, and many other aspects of project development. In addition to the SaaS product, its self-hosted solution and easy free-to-enterprise upgrade path make it a popular choice for those managing sensitive code bases. @@ -212,7 +212,7 @@ Integrations that use unique subdomains will require their own certificates and ... pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest container_name: pomerium volumes: - ./srv/pomerium/config.yaml:/pomerium/config.yaml:ro @@ -260,15 +260,15 @@ Integrations that use unique subdomains will require their own certificates and 1. Run `docker-compose up -d` to recreate the containers with the adjusted settings. -[background]: /docs/concepts/zero-trust.md +[background]: /docs/internals/zero-trust.md [docker compose]: https://docs.docker.com/compose/ [fqdn]: https://en.wikipedia.org/wiki/Fully_qualified_domain_name [gitlab]: https://gitlab.com/ -[gitlab-idp]: /docs/identity-providers/gitlab +[gitlab-idp]: /docs/integrations/user-identity/gitlab [gitlab docker images]: https://docs.gitlab.com/ee/install/docker.html [jwt omniauth provider]: https://docs.gitlab.com/ee/administration/auth/jwt.html [mkcert]: https://github.com/FiloSottile/mkcert -[mtls]: /docs/concepts/mutual-auth.md#mtls-protocol-based-mutual-authentication -[pomerium-cli]: /docs/clients/pomerium-cli +[mtls]: /docs/internals/mutual-auth.md#mtls-protocol-based-mutual-authentication +[pomerium-cli]: /docs/deploy/clients [pomerium desktop]: https://github.com/pomerium/desktop-client/releases -[quick-start]: /docs/quickstart +[quick-start]: /docs/get-started/quickstart diff --git a/content/docs/guides/guacamole.md b/content/docs/guides/guacamole.md index 69e7fcfbf..24bddf5bd 100644 --- a/content/docs/guides/guacamole.md +++ b/content/docs/guides/guacamole.md @@ -29,12 +29,12 @@ This guide provides steps to secure access to the Guacamole gateway behind Pomer To complete this guide, you need: -- [Pomerium Core](/docs/core) +- [Pomerium Core](/docs/deploy/core) - [Docker](https://docs.docker.com/install/) and [Docker Compose](https://docs.docker.com/compose/install/) :::note -This guide uses the [Hosted Authenticate Service](/docs/capabilities/hosted-authenticate-service.md), which provides its own hosted identity provider and authenticate service URL. If you prefer to configure your own identity provider, see [Self-Hosted Authenticate Service](/docs/capabilities/self-hosted-authenticate-service). +This guide uses the [Hosted Authenticate Service](/docs/capabilities/authentication), which provides its own hosted identity provider and authenticate service URL. If you prefer to configure your own identity provider, see [Self-Hosted Authenticate Service](/docs/capabilities/authentication). ::: @@ -122,7 +122,7 @@ In your Docker Compose file, replace `nginx` with Pomerium Core: ```yaml showLineNumbers pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest # highlight-start # Mount your config file volumes: diff --git a/content/docs/guides/hedgedoc.md b/content/docs/guides/hedgedoc.md index ddf515d21..bdd6563d2 100644 --- a/content/docs/guides/hedgedoc.md +++ b/content/docs/guides/hedgedoc.md @@ -32,7 +32,7 @@ To complete this guide, you need: :::note -If you completed our [**Quickstart guide**](/docs/quickstart), you should have a working Pomerium project with the following YAML files: +If you completed our [**Quickstart guide**](/docs/get-started/quickstart), you should have a working Pomerium project with the following YAML files: - `config.yaml` - `docker-compose.yaml` @@ -97,7 +97,7 @@ In your `docker-compose.yaml` file, add the following services: ```yaml services: pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest volumes: # Mount your certificates - ./_wildcard.localhost.pomerium.io.pem:/pomerium/cert.pem:ro diff --git a/content/docs/guides/helm.mdx b/content/docs/guides/helm.mdx index 7dde1126b..fd4f4a263 100644 --- a/content/docs/guides/helm.mdx +++ b/content/docs/guides/helm.mdx @@ -16,7 +16,7 @@ keywords: ] --- -import InstallMkcert from '@site/content/_install-mkcert.md'; +import InstallMkcert from '@site/content/docs/admonitions/_install-mkcert.md'; import PomeriumCerts from '@site/content/examples/kubernetes/pomerium-certificates.yaml.md'; import PomeriumValues from '@site/content/examples/kubernetes/pomerium-values.yaml.md'; import ExampleIngress from '@site/content/examples/kubernetes/example-ingress.yaml.md'; @@ -25,7 +25,7 @@ This guide will show you how to deploy Pomerium with [Helm] on [Kubernetes]. :::warning -After re-evaluating the complexity required to both use and manage Helm for Pomerium, we've opted not to continue updating our Helm chart. Instead we've created a simpler deployment method, which you can read about on our [Kubernetes Quickstart](/docs/k8s/quickstart) page. +After re-evaluating the complexity required to both use and manage Helm for Pomerium, we've opted not to continue updating our Helm chart. Instead we've created a simpler deployment method, which you can read about on our [Kubernetes Quickstart](/docs/deploy/k8s/quickstart) page. ::: @@ -267,11 +267,11 @@ Congratulations on installing Pomerium to your Kubernetes cluster! [cert-manager: installing with helm]: https://cert-manager.io/docs/installation/kubernetes/#installing-with-helm [helm]: https://helm.sh [install helm]: https://helm.sh/docs/using_helm/ -[identity provider]: /docs/identity-providers -[ingress controller]: /docs/k8s/ingress.md +[identity provider]: /docs/integrations/user-identity/identity-providers +[ingress controller]: /docs/deploy/k8s/ingress.md [install pomerium enterprise in helm]: /docs/guides/helm [install kubectl]: https://kubernetes.io/docs/tasks/tools/install-kubectl/ [kubernetes]: https://kubernetes.io [mkcert]: https://github.com/FiloSottile/mkcert [organizing cluster access using kubeconfig files]: https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/ -[tls certificates]: /docs/guides/certificates +[tls certificates]: /docs/internals/certificates-and-tls diff --git a/content/docs/guides/img/adguard/adguard-dashboard.png b/content/docs/guides/img/adguard/adguard-dashboard.png index e9fedab0b..264e36233 100644 Binary files a/content/docs/guides/img/adguard/adguard-dashboard.png and b/content/docs/guides/img/adguard/adguard-dashboard.png differ diff --git a/content/docs/guides/img/adguard/adguard-router-setup.png b/content/docs/guides/img/adguard/adguard-router-setup.png index ca120ba95..2c9ac3489 100644 Binary files a/content/docs/guides/img/adguard/adguard-router-setup.png and b/content/docs/guides/img/adguard/adguard-router-setup.png differ diff --git a/content/docs/guides/img/certificates/certificate-domain-challenge.png b/content/docs/guides/img/certificates/certificate-domain-challenge.png deleted file mode 100644 index 7f0dcc71c..000000000 Binary files a/content/docs/guides/img/certificates/certificate-domain-challenge.png and /dev/null differ diff --git a/content/docs/guides/img/certificates/certificate-wildcard-domain.png b/content/docs/guides/img/certificates/certificate-wildcard-domain.png deleted file mode 100644 index bf7b8c395..000000000 Binary files a/content/docs/guides/img/certificates/certificate-wildcard-domain.png and /dev/null differ diff --git a/content/docs/guides/img/certificates/certificates-ssl-report.png b/content/docs/guides/img/certificates/certificates-ssl-report.png deleted file mode 100644 index a56663a8d..000000000 Binary files a/content/docs/guides/img/certificates/certificates-ssl-report.png and /dev/null differ diff --git a/content/docs/guides/img/certificates/certificates-valid-secure-certificate.png b/content/docs/guides/img/certificates/certificates-valid-secure-certificate.png deleted file mode 100644 index 68fc6275e..000000000 Binary files a/content/docs/guides/img/certificates/certificates-valid-secure-certificate.png and /dev/null differ diff --git a/content/docs/guides/img/certificates/security-headers.png b/content/docs/guides/img/certificates/security-headers.png deleted file mode 100644 index d8833385a..000000000 Binary files a/content/docs/guides/img/certificates/security-headers.png and /dev/null differ diff --git a/content/docs/guides/img/client-cert-required.png b/content/docs/guides/img/client-cert-required.png index 2496dc71b..1c7f6d738 100644 Binary files a/content/docs/guides/img/client-cert-required.png and b/content/docs/guides/img/client-cert-required.png differ diff --git a/content/docs/guides/img/cloud-run/architecture.svg b/content/docs/guides/img/cloud-run/architecture.svg index 93023fb0c..b148934be 100644 --- a/content/docs/guides/img/cloud-run/architecture.svg +++ b/content/docs/guides/img/cloud-run/architecture.svg @@ -1,500 +1 @@ - - - - - - image/svg+xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + \ No newline at end of file diff --git a/content/docs/guides/img/cloud-run/cloudrun-domains.png b/content/docs/guides/img/cloud-run/cloudrun-domains.png index d5011e373..25a028d61 100644 Binary files a/content/docs/guides/img/cloud-run/cloudrun-domains.png and b/content/docs/guides/img/cloud-run/cloudrun-domains.png differ diff --git a/content/docs/guides/img/cloud-run/cloudrun-overview.png b/content/docs/guides/img/cloud-run/cloudrun-overview.png index 2b809521b..dd948b36f 100644 Binary files a/content/docs/guides/img/cloud-run/cloudrun-overview.png and b/content/docs/guides/img/cloud-run/cloudrun-overview.png differ diff --git a/content/docs/guides/img/cloud-run/headers.png b/content/docs/guides/img/cloud-run/headers.png index 0e62d13ab..5c6dc5492 100644 Binary files a/content/docs/guides/img/cloud-run/headers.png and b/content/docs/guides/img/cloud-run/headers.png differ diff --git a/content/docs/guides/img/cloud-run/hello-direct.png b/content/docs/guides/img/cloud-run/hello-direct.png index 463ceb9d6..d3c4a7f0b 100644 Binary files a/content/docs/guides/img/cloud-run/hello-direct.png and b/content/docs/guides/img/cloud-run/hello-direct.png differ diff --git a/content/docs/guides/img/cloud-run/hello-signin.png b/content/docs/guides/img/cloud-run/hello-signin.png index 626199627..029332de7 100644 Binary files a/content/docs/guides/img/cloud-run/hello-signin.png and b/content/docs/guides/img/cloud-run/hello-signin.png differ diff --git a/content/docs/guides/img/cloud-run/hello-success.png b/content/docs/guides/img/cloud-run/hello-success.png index c7e8858fa..bad3f1699 100644 Binary files a/content/docs/guides/img/cloud-run/hello-success.png and b/content/docs/guides/img/cloud-run/hello-success.png differ diff --git a/content/docs/guides/img/cockpit-login-screen.png b/content/docs/guides/img/cockpit-login-screen.png index 5aedb9018..91358a863 100644 Binary files a/content/docs/guides/img/cockpit-login-screen.png and b/content/docs/guides/img/cockpit-login-screen.png differ diff --git a/content/docs/guides/img/code-server/code-server-build-route.png b/content/docs/guides/img/code-server/code-server-build-route.png index 5294c7df7..7e43aacc7 100644 Binary files a/content/docs/guides/img/code-server/code-server-build-route.png and b/content/docs/guides/img/code-server/code-server-build-route.png differ diff --git a/content/docs/guides/img/code-server/code-server-edit-policy.png b/content/docs/guides/img/code-server/code-server-edit-policy.png index a811e1046..1b329e8d3 100644 Binary files a/content/docs/guides/img/code-server/code-server-edit-policy.png and b/content/docs/guides/img/code-server/code-server-edit-policy.png differ diff --git a/content/docs/guides/img/code-server/code-server-password-prompt.png b/content/docs/guides/img/code-server/code-server-password-prompt.png index 860e4fc50..6c999d150 100644 Binary files a/content/docs/guides/img/code-server/code-server-password-prompt.png and b/content/docs/guides/img/code-server/code-server-password-prompt.png differ diff --git a/content/docs/guides/img/code-server/vscode-helloworld.png b/content/docs/guides/img/code-server/vscode-helloworld.png index cc8a2ce5d..7c7624373 100644 Binary files a/content/docs/guides/img/code-server/vscode-helloworld.png and b/content/docs/guides/img/code-server/vscode-helloworld.png differ diff --git a/content/docs/guides/img/code-server/vscode-pomerium.png b/content/docs/guides/img/code-server/vscode-pomerium.png index 11d44718d..6e8a287be 100644 Binary files a/content/docs/guides/img/code-server/vscode-pomerium.png and b/content/docs/guides/img/code-server/vscode-pomerium.png differ diff --git a/content/docs/guides/img/gitlab/gitlab-desktop-connection.png b/content/docs/guides/img/gitlab/gitlab-desktop-connection.png index fd0739fbc..0b07b4263 100644 Binary files a/content/docs/guides/img/gitlab/gitlab-desktop-connection.png and b/content/docs/guides/img/gitlab/gitlab-desktop-connection.png differ diff --git a/content/docs/guides/img/grafana-server-admin-users.png b/content/docs/guides/img/grafana-server-admin-users.png index f41622652..1a1d07a15 100644 Binary files a/content/docs/guides/img/grafana-server-admin-users.png and b/content/docs/guides/img/grafana-server-admin-users.png differ diff --git a/content/docs/guides/img/grafana/grafana-allow-websockets.png b/content/docs/guides/img/grafana/grafana-allow-websockets.png index adc41994c..a1b1682de 100644 Binary files a/content/docs/guides/img/grafana/grafana-allow-websockets.png and b/content/docs/guides/img/grafana/grafana-allow-websockets.png differ diff --git a/content/docs/guides/img/grafana/grafana-create-policy.png b/content/docs/guides/img/grafana/grafana-create-policy.png index a54236cb4..4f70359ed 100644 Binary files a/content/docs/guides/img/grafana/grafana-create-policy.png and b/content/docs/guides/img/grafana/grafana-create-policy.png differ diff --git a/content/docs/guides/img/grafana/grafana-create-route.gif b/content/docs/guides/img/grafana/grafana-create-route.gif index 3ee31afb3..a7f95c9ef 100644 Binary files a/content/docs/guides/img/grafana/grafana-create-route.gif and b/content/docs/guides/img/grafana/grafana-create-route.gif differ diff --git a/content/docs/guides/img/grafana/grafana-set-headers.png b/content/docs/guides/img/grafana/grafana-set-headers.png index c6dbd1831..767de46d2 100644 Binary files a/content/docs/guides/img/grafana/grafana-set-headers.png and b/content/docs/guides/img/grafana/grafana-set-headers.png differ diff --git a/content/docs/guides/img/grafana/pass-identity-headers.png b/content/docs/guides/img/grafana/pass-identity-headers.png index 7cc9287de..ed43145e8 100644 Binary files a/content/docs/guides/img/grafana/pass-identity-headers.png and b/content/docs/guides/img/grafana/pass-identity-headers.png differ diff --git a/content/docs/guides/img/grafana/pz-grafana-user-preferences.png b/content/docs/guides/img/grafana/pz-grafana-user-preferences.png index abd8c793d..f542a7e62 100644 Binary files a/content/docs/guides/img/grafana/pz-grafana-user-preferences.png and b/content/docs/guides/img/grafana/pz-grafana-user-preferences.png differ diff --git a/content/docs/guides/img/guacamole/guacamole-dashboard.png b/content/docs/guides/img/guacamole/guacamole-dashboard.png index d0e43d8c4..c56da678b 100644 Binary files a/content/docs/guides/img/guacamole/guacamole-dashboard.png and b/content/docs/guides/img/guacamole/guacamole-dashboard.png differ diff --git a/content/docs/guides/img/hedgedoc/cognito-idp.png b/content/docs/guides/img/hedgedoc/cognito-idp.png index 2f8867f19..6bb8d4e2a 100644 Binary files a/content/docs/guides/img/hedgedoc/cognito-idp.png and b/content/docs/guides/img/hedgedoc/cognito-idp.png differ diff --git a/content/docs/guides/img/hedgedoc/hedgedoc-homepage.png b/content/docs/guides/img/hedgedoc/hedgedoc-homepage.png index 0a2c8da98..4f890ea01 100644 Binary files a/content/docs/guides/img/hedgedoc/hedgedoc-homepage.png and b/content/docs/guides/img/hedgedoc/hedgedoc-homepage.png differ diff --git a/content/docs/guides/img/hedgedoc/hedgedoc-note.png b/content/docs/guides/img/hedgedoc/hedgedoc-note.png index 3776796e2..13e849f2f 100644 Binary files a/content/docs/guides/img/hedgedoc/hedgedoc-note.png and b/content/docs/guides/img/hedgedoc/hedgedoc-note.png differ diff --git a/content/docs/guides/img/hedgedoc/hedgedoc-sign-in.png b/content/docs/guides/img/hedgedoc/hedgedoc-sign-in.png index e8be8a97b..fbc9d8802 100644 Binary files a/content/docs/guides/img/hedgedoc/hedgedoc-sign-in.png and b/content/docs/guides/img/hedgedoc/hedgedoc-sign-in.png differ diff --git a/content/docs/guides/img/hedgedoc/user-dashboard.png b/content/docs/guides/img/hedgedoc/user-dashboard.png index 17c5c2cb4..175026cd4 100644 Binary files a/content/docs/guides/img/hedgedoc/user-dashboard.png and b/content/docs/guides/img/hedgedoc/user-dashboard.png differ diff --git a/content/docs/guides/img/jenkins/1-jenkins-admin-pass.png b/content/docs/guides/img/jenkins/1-jenkins-admin-pass.png index be20f5e25..e0f68e547 100644 Binary files a/content/docs/guides/img/jenkins/1-jenkins-admin-pass.png and b/content/docs/guides/img/jenkins/1-jenkins-admin-pass.png differ diff --git a/content/docs/guides/img/jenkins/10-matrix-auth.png b/content/docs/guides/img/jenkins/10-matrix-auth.png index cf613483b..cfaefde85 100644 Binary files a/content/docs/guides/img/jenkins/10-matrix-auth.png and b/content/docs/guides/img/jenkins/10-matrix-auth.png differ diff --git a/content/docs/guides/img/jenkins/2-jenkins-dashboard.png b/content/docs/guides/img/jenkins/2-jenkins-dashboard.png index 5b37e3bce..a389af0ac 100644 Binary files a/content/docs/guides/img/jenkins/2-jenkins-dashboard.png and b/content/docs/guides/img/jenkins/2-jenkins-dashboard.png differ diff --git a/content/docs/guides/img/jenkins/3-jenkins-sign-in.png b/content/docs/guides/img/jenkins/3-jenkins-sign-in.png index 5738b94d8..6a28a4ce1 100644 Binary files a/content/docs/guides/img/jenkins/3-jenkins-sign-in.png and b/content/docs/guides/img/jenkins/3-jenkins-sign-in.png differ diff --git a/content/docs/guides/img/jenkins/4-jwt-auth-plugin.png b/content/docs/guides/img/jenkins/4-jwt-auth-plugin.png index 049c273dd..3e6f2ad44 100644 Binary files a/content/docs/guides/img/jenkins/4-jwt-auth-plugin.png and b/content/docs/guides/img/jenkins/4-jwt-auth-plugin.png differ diff --git a/content/docs/guides/img/jenkins/5-jwt-form.png b/content/docs/guides/img/jenkins/5-jwt-form.png index 23c34a6b6..8a178fe49 100644 Binary files a/content/docs/guides/img/jenkins/5-jwt-form.png and b/content/docs/guides/img/jenkins/5-jwt-form.png differ diff --git a/content/docs/guides/img/jenkins/6-enterprise-who-am-i.png b/content/docs/guides/img/jenkins/6-enterprise-who-am-i.png index 799eb855c..fdf49a184 100644 Binary files a/content/docs/guides/img/jenkins/6-enterprise-who-am-i.png and b/content/docs/guides/img/jenkins/6-enterprise-who-am-i.png differ diff --git a/content/docs/guides/img/jenkins/7-enterprise-jenkins-route.png b/content/docs/guides/img/jenkins/7-enterprise-jenkins-route.png index 05190535e..58e3cd784 100644 Binary files a/content/docs/guides/img/jenkins/7-enterprise-jenkins-route.png and b/content/docs/guides/img/jenkins/7-enterprise-jenkins-route.png differ diff --git a/content/docs/guides/img/jenkins/8-jenkins-email-policy.png b/content/docs/guides/img/jenkins/8-jenkins-email-policy.png index 2ae28b26c..8c2aa6f39 100644 Binary files a/content/docs/guides/img/jenkins/8-jenkins-email-policy.png and b/content/docs/guides/img/jenkins/8-jenkins-email-policy.png differ diff --git a/content/docs/guides/img/jenkins/9-enterprise-jenkins-headers.png b/content/docs/guides/img/jenkins/9-enterprise-jenkins-headers.png index 85f78ac35..148cccff1 100644 Binary files a/content/docs/guides/img/jenkins/9-enterprise-jenkins-headers.png and b/content/docs/guides/img/jenkins/9-enterprise-jenkins-headers.png differ diff --git a/content/docs/guides/img/jenkins/pz-add-user-to-matrix.png b/content/docs/guides/img/jenkins/pz-add-user-to-matrix.png index ceb889537..e7f60cabd 100644 Binary files a/content/docs/guides/img/jenkins/pz-add-user-to-matrix.png and b/content/docs/guides/img/jenkins/pz-add-user-to-matrix.png differ diff --git a/content/docs/guides/img/jenkins/pz-jenkins-policy.png b/content/docs/guides/img/jenkins/pz-jenkins-policy.png index a23c4ce81..079f40204 100644 Binary files a/content/docs/guides/img/jenkins/pz-jenkins-policy.png and b/content/docs/guides/img/jenkins/pz-jenkins-policy.png differ diff --git a/content/docs/guides/img/jenkins/pz-saving-jenkins-route.gif b/content/docs/guides/img/jenkins/pz-saving-jenkins-route.gif index 12a7f7870..e6d6cff0d 100644 Binary files a/content/docs/guides/img/jenkins/pz-saving-jenkins-route.gif and b/content/docs/guides/img/jenkins/pz-saving-jenkins-route.gif differ diff --git a/content/docs/guides/img/js-sdk/js-sdk-enterprise-policy.png b/content/docs/guides/img/js-sdk/js-sdk-enterprise-policy.png index 2c785c650..13adfedf8 100644 Binary files a/content/docs/guides/img/js-sdk/js-sdk-enterprise-policy.png and b/content/docs/guides/img/js-sdk/js-sdk-enterprise-policy.png differ diff --git a/content/docs/guides/img/js-sdk/js-sdk-enterprise-route.png b/content/docs/guides/img/js-sdk/js-sdk-enterprise-route.png index 42aeb158a..4be7ab215 100644 Binary files a/content/docs/guides/img/js-sdk/js-sdk-enterprise-route.png and b/content/docs/guides/img/js-sdk/js-sdk-enterprise-route.png differ diff --git a/content/docs/guides/img/js-sdk/js-sdk-jwt-error.png b/content/docs/guides/img/js-sdk/js-sdk-jwt-error.png index 6f4be621f..1f76ce56c 100644 Binary files a/content/docs/guides/img/js-sdk/js-sdk-jwt-error.png and b/content/docs/guides/img/js-sdk/js-sdk-jwt-error.png differ diff --git a/content/docs/guides/img/js-sdk/js-sdk-react-app-browser.png b/content/docs/guides/img/js-sdk/js-sdk-react-app-browser.png index c0edfb15c..1fe513a64 100644 Binary files a/content/docs/guides/img/js-sdk/js-sdk-react-app-browser.png and b/content/docs/guides/img/js-sdk/js-sdk-react-app-browser.png differ diff --git a/content/docs/guides/img/jwt/inspect-headers.png b/content/docs/guides/img/jwt/inspect-headers.png deleted file mode 100644 index 09c5bbf49..000000000 Binary files a/content/docs/guides/img/jwt/inspect-headers.png and /dev/null differ diff --git a/content/docs/guides/img/jwt/jwt-payload.png b/content/docs/guides/img/jwt/jwt-payload.png deleted file mode 100644 index 2f2ac9e39..000000000 Binary files a/content/docs/guides/img/jwt/jwt-payload.png and /dev/null differ diff --git a/content/docs/guides/img/jwt/verifying-headers-1.png b/content/docs/guides/img/jwt/verifying-headers-1.png deleted file mode 100644 index 087de50cd..000000000 Binary files a/content/docs/guides/img/jwt/verifying-headers-1.png and /dev/null differ diff --git a/content/docs/guides/img/k8s-dashboard-login.png b/content/docs/guides/img/k8s-dashboard-login.png index c79f851e8..83b020ad3 100644 Binary files a/content/docs/guides/img/k8s-dashboard-login.png and b/content/docs/guides/img/k8s-dashboard-login.png differ diff --git a/content/docs/guides/img/k8s-fresh-dashboard.png b/content/docs/guides/img/k8s-fresh-dashboard.png index 6aabfc4a3..2d1ceaa89 100644 Binary files a/content/docs/guides/img/k8s-fresh-dashboard.png and b/content/docs/guides/img/k8s-fresh-dashboard.png differ diff --git a/content/docs/guides/img/llm/1.png b/content/docs/guides/img/llm/1.png index a4f5051dd..53d1c13a3 100644 Binary files a/content/docs/guides/img/llm/1.png and b/content/docs/guides/img/llm/1.png differ diff --git a/content/docs/guides/img/llm/2.png b/content/docs/guides/img/llm/2.png index b3ae252df..0a7a39f3d 100644 Binary files a/content/docs/guides/img/llm/2.png and b/content/docs/guides/img/llm/2.png differ diff --git a/content/docs/guides/img/llm/3.png b/content/docs/guides/img/llm/3.png index c91cd70cc..55a7984c7 100644 Binary files a/content/docs/guides/img/llm/3.png and b/content/docs/guides/img/llm/3.png differ diff --git a/content/docs/guides/img/llm/4.png b/content/docs/guides/img/llm/4.png index 18c863a04..73150ca56 100644 Binary files a/content/docs/guides/img/llm/4.png and b/content/docs/guides/img/llm/4.png differ diff --git a/content/docs/guides/img/llm/llm.png b/content/docs/guides/img/llm/llm.png index 9b6e9903c..9f62b44d7 100644 Binary files a/content/docs/guides/img/llm/llm.png and b/content/docs/guides/img/llm/llm.png differ diff --git a/content/docs/guides/img/logged-in-as.png b/content/docs/guides/img/logged-in-as.png index 7de800a74..3eef6af88 100644 Binary files a/content/docs/guides/img/logged-in-as.png and b/content/docs/guides/img/logged-in-as.png differ diff --git a/content/docs/guides/img/synology/synology-certifciate-assignment.png b/content/docs/guides/img/synology/synology-certifciate-assignment.png index 89e9dbb25..099335080 100644 Binary files a/content/docs/guides/img/synology/synology-certifciate-assignment.png and b/content/docs/guides/img/synology/synology-certifciate-assignment.png differ diff --git a/content/docs/guides/img/synology/synology-docker-package-center.png b/content/docs/guides/img/synology/synology-docker-package-center.png index 2f53ab206..b3c366af2 100644 Binary files a/content/docs/guides/img/synology/synology-docker-package-center.png and b/content/docs/guides/img/synology/synology-docker-package-center.png differ diff --git a/content/docs/guides/img/synology/synology-docker-pomerium-done.png b/content/docs/guides/img/synology/synology-docker-pomerium-done.png index 52a254ac0..357cd4593 100644 Binary files a/content/docs/guides/img/synology/synology-docker-pomerium-done.png and b/content/docs/guides/img/synology/synology-docker-pomerium-done.png differ diff --git a/content/docs/guides/img/synology/synology-firewall-rules.png b/content/docs/guides/img/synology/synology-firewall-rules.png index a66e7b23e..0f65aa841 100644 Binary files a/content/docs/guides/img/synology/synology-firewall-rules.png and b/content/docs/guides/img/synology/synology-firewall-rules.png differ diff --git a/content/docs/guides/img/synology/synology-reverse-proxy.png b/content/docs/guides/img/synology/synology-reverse-proxy.png index 083c00be0..1540d58f8 100644 Binary files a/content/docs/guides/img/synology/synology-reverse-proxy.png and b/content/docs/guides/img/synology/synology-reverse-proxy.png differ diff --git a/content/docs/guides/img/synology/synology-step-1-redirect.png b/content/docs/guides/img/synology/synology-step-1-redirect.png index 83a0ef0ca..c8fab174b 100644 Binary files a/content/docs/guides/img/synology/synology-step-1-redirect.png and b/content/docs/guides/img/synology/synology-step-1-redirect.png differ diff --git a/content/docs/guides/img/synology/synology-step-2-mfa.png b/content/docs/guides/img/synology/synology-step-2-mfa.png index 7014a6b96..980f824f1 100644 Binary files a/content/docs/guides/img/synology/synology-step-2-mfa.png and b/content/docs/guides/img/synology/synology-step-2-mfa.png differ diff --git a/content/docs/guides/img/synology/synology-step-3-validate-header.png b/content/docs/guides/img/synology/synology-step-3-validate-header.png index f888f0ae7..06bd52911 100644 Binary files a/content/docs/guides/img/synology/synology-step-3-validate-header.png and b/content/docs/guides/img/synology/synology-step-3-validate-header.png differ diff --git a/content/docs/guides/img/synology/synology-step-4-unauthorized.png b/content/docs/guides/img/synology/synology-step-4-unauthorized.png index 2ff3b8df8..a3448ca1c 100644 Binary files a/content/docs/guides/img/synology/synology-step-4-unauthorized.png and b/content/docs/guides/img/synology/synology-step-4-unauthorized.png differ diff --git a/content/docs/guides/img/tiddlywiki/enterprise-tiddlywiki-jwt-headers.png b/content/docs/guides/img/tiddlywiki/enterprise-tiddlywiki-jwt-headers.png index 0faeb1d1a..b2a749433 100644 Binary files a/content/docs/guides/img/tiddlywiki/enterprise-tiddlywiki-jwt-headers.png and b/content/docs/guides/img/tiddlywiki/enterprise-tiddlywiki-jwt-headers.png differ diff --git a/content/docs/guides/img/tiddlywiki/tiddlywiki-enterprise-policy.png b/content/docs/guides/img/tiddlywiki/tiddlywiki-enterprise-policy.png index 0831b180e..8804030c0 100644 Binary files a/content/docs/guides/img/tiddlywiki/tiddlywiki-enterprise-policy.png and b/content/docs/guides/img/tiddlywiki/tiddlywiki-enterprise-policy.png differ diff --git a/content/docs/guides/img/tiddlywiki/tiddlywiki-enterprise-route.png b/content/docs/guides/img/tiddlywiki/tiddlywiki-enterprise-route.png index abe6244f6..4d44c7a2f 100644 Binary files a/content/docs/guides/img/tiddlywiki/tiddlywiki-enterprise-route.png and b/content/docs/guides/img/tiddlywiki/tiddlywiki-enterprise-route.png differ diff --git a/content/docs/guides/img/tiddlywiki/tiddlywiki-first-note.png b/content/docs/guides/img/tiddlywiki/tiddlywiki-first-note.png index a9423d6fc..74875c8cc 100644 Binary files a/content/docs/guides/img/tiddlywiki/tiddlywiki-first-note.png and b/content/docs/guides/img/tiddlywiki/tiddlywiki-first-note.png differ diff --git a/content/docs/guides/img/tooljet/add-policy.png b/content/docs/guides/img/tooljet/add-policy.png index 46ccf452d..03f6a6f25 100644 Binary files a/content/docs/guides/img/tooljet/add-policy.png and b/content/docs/guides/img/tooljet/add-policy.png differ diff --git a/content/docs/guides/img/tooljet/build-route.png b/content/docs/guides/img/tooljet/build-route.png index 6eb11a62a..f01d8157e 100644 Binary files a/content/docs/guides/img/tooljet/build-route.png and b/content/docs/guides/img/tooljet/build-route.png differ diff --git a/content/docs/guides/img/tooljet/invite-url.png b/content/docs/guides/img/tooljet/invite-url.png index 8a00ce718..2f6cd4afd 100644 Binary files a/content/docs/guides/img/tooljet/invite-url.png and b/content/docs/guides/img/tooljet/invite-url.png differ diff --git a/content/docs/guides/img/tooljet/join-workspace.png b/content/docs/guides/img/tooljet/join-workspace.png index 523bc8008..9bde17e00 100644 Binary files a/content/docs/guides/img/tooljet/join-workspace.png and b/content/docs/guides/img/tooljet/join-workspace.png differ diff --git a/content/docs/guides/img/tooljet/ready-to-use.png b/content/docs/guides/img/tooljet/ready-to-use.png index 646cd1ef6..da5f340af 100644 Binary files a/content/docs/guides/img/tooljet/ready-to-use.png and b/content/docs/guides/img/tooljet/ready-to-use.png differ diff --git a/content/docs/guides/img/tooljet/rewrite-headers.png b/content/docs/guides/img/tooljet/rewrite-headers.png index ea36f0d27..cd6bc000a 100644 Binary files a/content/docs/guides/img/tooljet/rewrite-headers.png and b/content/docs/guides/img/tooljet/rewrite-headers.png differ diff --git a/content/docs/guides/img/tooljet/set-up-admin.png b/content/docs/guides/img/tooljet/set-up-admin.png index 3bc8bcfc3..37f2cbf0c 100644 Binary files a/content/docs/guides/img/tooljet/set-up-admin.png and b/content/docs/guides/img/tooljet/set-up-admin.png differ diff --git a/content/docs/guides/img/tooljet/set-up-workspace.png b/content/docs/guides/img/tooljet/set-up-workspace.png index 6f3496de1..7f1772e36 100644 Binary files a/content/docs/guides/img/tooljet/set-up-workspace.png and b/content/docs/guides/img/tooljet/set-up-workspace.png differ diff --git a/content/docs/guides/img/transmission-demo.png b/content/docs/guides/img/transmission-demo.png index 1f45b2733..a3b447418 100644 Binary files a/content/docs/guides/img/transmission-demo.png and b/content/docs/guides/img/transmission-demo.png differ diff --git a/content/docs/guides/istio.mdx b/content/docs/guides/istio.mdx index 8a2f09401..369981bfb 100644 --- a/content/docs/guides/istio.mdx +++ b/content/docs/guides/istio.mdx @@ -18,7 +18,7 @@ keywords: description: Integrate the Pomerium Ingress controller with an Istio service mesh for full mutual authentication in your cluster. --- -import GrafanaIni from '../../examples/kubernetes/istio/grafana.ini.yml.md'; +import GrafanaIni from '/content/examples/kubernetes/istio/grafana.ini.yml.md'; Istio provides application-aware networking via a service mesh and control plane. When configured with the [Pomerium Ingress Controller] for kubernetes, this enables authorization (**[authZ]**) and authentication (**[authN]**) of [east-west traffic] in your internal network bringing you closer to complete [zero trust]. @@ -31,7 +31,7 @@ In this guide, we'll demonstrate how to configure Pomerium and Istio in a Kubern ## How it Works -In our [Mutual Authentication section on Sidecars](/docs/concepts/mutual-auth#mutual-authentication-with-a-sidecar), we detail how a single service can offload authN and authz to a sidecar service. In a service mesh, each service in an internal network is deployed with a sidecar, and the controller configures them to provide mutual authentication with each other: +In our [Mutual Authentication section on Sidecars](/docs/internals/mutual-auth#mutual-authentication-with-a-sidecar), we detail how a single service can offload authN and authz to a sidecar service. In a service mesh, each service in an internal network is deployed with a sidecar, and the controller configures them to provide mutual authentication with each other: ```mermaid flowchart LR @@ -66,7 +66,7 @@ end This is a simplified model that doesn't describe the additional traffic for authorization and authentication. -See our [Mutual Authentication](/docs/concepts/mutual-auth) page for more details. +See our [Mutual Authentication](/docs/internals/mutual-auth) page for more details. ::: @@ -112,7 +112,7 @@ Follow [Install Pomerium using Helm] to set up the Pomerium Ingress Controller a headless: false # send traffic to the Pomerium Databroker through the Istio service rather than to individual pods ``` -1. When [defining a test service](/docs/k8s/quickstart#test-service), you should now see two containers for the service pod: +1. When [defining a test service](/docs/deploy/k8s/quickstart#test-service), you should now see two containers for the service pod: ```shell-session $ kubectl get pods @@ -182,7 +182,7 @@ Now that Pomerium is installed in the cluster, we can define authentication and - **if** the request includes a JWT (already validated by `RequestAuthentication`) with the audience key `aud`, - **and** the value of the `aud` key matches our known route, `hello.localhost.pomerium.io`. - In other words, `RequestAuthentication` confirms that the incoming traffic to the sidecar has a signed and valid JWT, which confirms that the user has been authenticated and is authorized to access this service. The `AuthorizationPolicy` confirms that the traffic originated from a valid Pomerium route. The latter is especially important in Pomerium Enterprise, where a manager of a separate [Namespace](/docs/capabilities/namespacing) could create a second route to a service normally routed and managed in your namespace. + In other words, `RequestAuthentication` confirms that the incoming traffic to the sidecar has a signed and valid JWT, which confirms that the user has been authenticated and is authorized to access this service. The `AuthorizationPolicy` confirms that the traffic originated from a valid Pomerium route. The latter is especially important in Pomerium Enterprise, where a manager of a separate [Namespace](/docs/internals/namespacing) could create a second route to a service normally routed and managed in your namespace. 1. Apply the new resources with `kubectl`: @@ -327,6 +327,6 @@ To demonstrate complete authorization validation through to the upstream service [grafana-guide]: /docs/guides/grafana [east-west traffic]: /docs/internals/glossary.md#east-west-traffic [north-south traffic]: /docs/internals/glossary.md#north-south-traffic -[pomerium ingress controller]: /docs/k8s/ingress.md -[zero trust]: /docs/concepts/zero-trust#zero-trust-1 +[pomerium ingress controller]: /docs/deploy/k8s/ingress.md +[zero trust]: /docs/internals/zero-trust#zero-trust-1 [install pomerium using helm]: /docs/guides/helm diff --git a/content/docs/guides/jenkins.mdx b/content/docs/guides/jenkins.mdx index b39602959..2a6a8425b 100644 --- a/content/docs/guides/jenkins.mdx +++ b/content/docs/guides/jenkins.mdx @@ -19,13 +19,13 @@ Jenkins is an automation server you can use to build, test, and deploy applicati ## Why use Pomerium with Jenkins? -You can set up role-based permissions in Jenkins to control a user’s privileges with Jenkins’ built-in authorization matrix. However, this method requires username/password authentication, which relies on Jenkins’ user database to store credentials. +You can set up role-based permissions in Jenkins to control a user's privileges with Jenkins' built-in authorization matrix. However, this method requires username/password authentication, which relies on Jenkins' user database to store credentials. JWT authentication is a more secure method of identity verification that authenticates and authorizes users against an identity provider, eliminating the need to store or share credentials to access your Jenkins application. -Jenkins doesn’t support JWT authentication out of the box. It requires a JWT authentication plugin to communicate with Pomerium. With the plugin installed, you can configure Pomerium to forward a user's JWT to Jenkins to achieve SSO. +Jenkins doesn't support JWT authentication out of the box. It requires a JWT authentication plugin to communicate with Pomerium. With the plugin installed, you can configure Pomerium to forward a user's JWT to Jenkins to achieve SSO. -Once you’ve configured JWT authentication, you can assign permissions within Jenkins for a specific user, any authenticated user, anonymous users, or a user group. +Once you've configured JWT authentication, you can assign permissions within Jenkins for a specific user, any authenticated user, anonymous users, or a user group. ## Before you start diff --git a/content/docs/guides/jit.md b/content/docs/guides/jit.md index 3a28caec5..7954f1b74 100644 --- a/content/docs/guides/jit.md +++ b/content/docs/guides/jit.md @@ -16,7 +16,7 @@ Just-In-Time (JIT) access is an approach to security where access to application ## Implementing Just-In-Time Access with Pomerium PPL -The Pomerium Policy Language (PPL) supports time-limited access via the [`date`](/docs/capabilities/ppl#date-matcher) criterion. When coupled with a `user` or `email` criterion, users can be granted time-limited access: +The Pomerium Policy Language (PPL) supports time-limited access via the [`date`](/docs/internals/ppl#date-matcher) criterion. When coupled with a `user` or `email` criterion, users can be granted time-limited access: ```yaml allow: diff --git a/content/docs/guides/jwt-verification.md b/content/docs/guides/jwt-verification.md deleted file mode 100644 index 7a1aa2bee..000000000 --- a/content/docs/guides/jwt-verification.md +++ /dev/null @@ -1,260 +0,0 @@ ---- -# cSpell:ignore envoyproxy - -title: JWT Verification with Envoy -id: jwt-verification-with-envoy -lang: en-US -keywords: [pomerium, identity access proxy, envoy, jwt] -description: This example demonstrates how to verify the Pomerium JWT assertion header using Envoy. -sidebar_label: JWT Verification with Envoy -slug: jwt-verification-with-envoy ---- - -This example demonstrates how to verify the [Pomerium JWT assertion header](https://www.pomerium.io/reference/#pass-identity-headers) using [Envoy](https://www.envoyproxy.io/). This is useful for legacy or 3rd party applications which can't be modified to perform verification themselves. - -This guide is a practical demonstration of some of the topics discussed in [Mutual Authentication: A Component of Zero Trust]. - -## Requirements - -- [Docker](https://www.docker.com/) -- [Docker Compose](https://docs.docker.com/compose/) -- [mkcert](https://github.com/FiloSottile/mkcert) - -This guide assumes you already have a working IdP connection to provide user data. See our [Identity Provider](/docs/identity-providers) docs for more information. - -## Overview - -Three services are configured in a `docker-compose.yaml` file: - -- `pomerium` running an all-in-one deployment of Pomerium on `*.localhost.pomerium.io` -- `envoy-jwt-checker` running envoy with a JWT Authn filter -- `httpbin` as our example legacy application without JWT verification. - -In our Docker Compose configuration we'll define two networks. `pomerium` and `envoy-jwt-checker` will be on the `frontend` network, simulating your local area network (**LAN**). `envoy-jwt-checker` will also be on the `backend` network, along with `httpbin`. This means that `envoy-jwt-checker` is the only other service that can communicate with `httpbin`. - -For a detailed explanation of this security model, see [Mutual Authentication With a Sidecar] - -Once running, the user visits [verify.localhost.pomerium.io], is authenticated through [authenticate.localhost.pomerium.io], and then the HTTP request is sent to envoy which proxies it to the httpbin app. - -Before allowing the request Envoy will verify the signed JWT assertion header using the public key defined by `httpbin.localhost.pomerium.io/.well-known/pomerium/jwks.json`. - -## Setup - -The configuration presented here assumes a working route to the domain space `*.localhost.pomerium.io`. You can make entries in your `hosts` file for the domains used, or change this value to match your local environment. - -:::tip - -Mac and Linux users can use DNSMasq to map the `*.localhost.pomerium.io` domain (including all subdomains) to a specified test address: - -- [Local Development with Wildcard DNS] (macOS) -- [Local Development with Wildcard DNS on Linux] - -::: - -1. Create a `docker-compose.yaml` file containing: - - ```yaml title="docker-compose.yaml" - networks: - frontend: - driver: 'bridge' - backend: - driver: 'bridge' - services: - pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest - ports: - - '443:443' - volumes: - - type: bind - source: ./cfg/pomerium.yaml - target: /pomerium/config.yaml - - type: bind - source: ./certs/_wildcard.localhost.pomerium.io.pem - target: /pomerium/_wildcard.localhost.pomerium.io.pem - - type: bind - source: ./certs/_wildcard.localhost.pomerium.io-key.pem - target: /pomerium/_wildcard.localhost.pomerium.io-key.pem - networks: - - frontend - - envoy-jwt-checker: - image: envoyproxy/envoy:v1.17.1 - ports: - - '10000:10000' - volumes: - - type: bind - source: ./cfg/envoy.yaml - target: /etc/envoy/envoy.yaml - networks: - frontend: - aliases: - - 'httpbin-sidecar' - backend: - - httpbin: - image: kennethreitz/httpbin - ports: - - '80:80' - networks: - - backend - ``` - -1. Using [`mkcert`](https://github.com/FiloSottile/mkcert), generate a certificate for `*.localhost.pomerium.io` in a `certs` directory: - - ```bash - mkdir certs - cd certs - mkcert '*.localhost.pomerium.io' - ``` - -1. Create a `cfg` directory containing the following `envoy.yaml` file. Envoy configuration can be quite verbose, but the crucial bit is the HTTP filter (highlighted below): - - ```yaml title="envoy.yaml" {30-49} - admin: - access_log_path: /dev/null - address: - socket_address: {address: 127.0.0.1, port_value: 9901} - - static_resources: - listeners: - - name: ingress-http - address: - socket_address: {address: 0.0.0.0, port_value: 10000} - filter_chains: - - filters: - - name: envoy.filters.network.http_connection_manager - typed_config: - '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager - stat_prefix: ingress_http - codec_type: AUTO - route_config: - name: verify - virtual_hosts: - - name: httpbin - domains: ['httpbin-sidecar'] - routes: - - match: - prefix: '/' - route: - cluster: egress-httpbin - auto_host_rewrite: true - http_filters: - - name: envoy.filters.http.jwt_authn - typed_config: - '@type': type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication - providers: - pomerium: - issuer: httpbin.localhost.pomerium.io - audiences: - - httpbin.localhost.pomerium.io - from_headers: - - name: X-Pomerium-Jwt-Assertion - remote_jwks: - http_uri: - uri: https://httpbin.localhost.pomerium.io/.well-known/pomerium/jwks.json - cluster: egress-authenticate - timeout: 1s - rules: - - match: - prefix: / - requires: - provider_name: pomerium - - name: envoy.filters.http.router - clusters: - - name: egress-httpbin - connect_timeout: 0.25s - type: STRICT_DNS - lb_policy: ROUND_ROBIN - load_assignment: - cluster_name: httpbin - endpoints: - - lb_endpoints: - - endpoint: - address: - socket_address: - address: httpbin - port_value: 80 - - name: egress-authenticate - connect_timeout: '0.25s' - type: STRICT_DNS - lb_policy: ROUND_ROBIN - load_assignment: - cluster_name: authenticate - endpoints: - - lb_endpoints: - - endpoint: - address: - socket_address: - address: pomerium - port_value: 443 - transport_socket: - name: tls - typed_config: - '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext - sni: authenticate.localhost.pomerium.io - ``` - - This configuration pulls the JWT out of the `X-Pomerium-Jwt-Assertion` header, verifies the `iss` and `aud` claims and checks the signature via the public key defined at the `jwks.json` endpoint. Documentation for additional configuration options is available here: [Envoy JWT Authentication](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/jwt_authn_filter#config-http-filters-jwt-authn). - -
- Audience and issuer claims -
-Pomerium uses the claims provided by the identity provider's JWT to populate the `audience` and `issuer` claims in the attestation JWT. - -Audience is the URL of the target upstream application. The `aud` claim defines what application the JWT is intended for. - -Issuer is the URL of the domain that issued the JWT. The `iss` claim tells the target upstream application who the issuing authority is and provides context about the subject. - -
-
- -1. Create a `pomerium.yaml` file in the `cfg` directory containing: - - ```yaml title="pomerium.yaml" - authenticate_service_url: https://authenticate.localhost.pomerium.io - - certificate_file: '/pomerium/_wildcard.localhost.pomerium.io.pem' - certificate_key_file: '/pomerium/_wildcard.localhost.pomerium.io-key.pem' - - idp_provider: google - idp_client_id: REPLACE_ME - idp_client_secret: REPLACE_ME - - cookie_secret: REPLACE_ME - shared_secret: REPLACE_ME - signing_key: REPLACE_ME - - routes: - - from: https://httpbin.localhost.pomerium.io - to: http://httpbin-sidecar:10000 - pass_identity_headers: true - policy: - - allow: - or: - - domain: - is: example.com - ``` - -Replace the identity provider credentials, secrets, and signing key. Adjust the policy to match your configuration. - -## Run - -You should now be able to run the example with: - -1. Turn on the example configuration in Docker: - - ```bash - docker-compose up - ``` - -1. Visit [httpbin.localhost.pomerium.io](https://httpbin.localhost.pomerium.io). Login and you will be redirected to the httpbin page. - -1. In this network configuration you cannot access `httpbin` directly. However, visiting Envoy directly via [localhost.pomerium.io:10000/](http://localhost.pomerium.io:10000/) will return a `Jwt is missing` error, confirming that you must authenticate with Pomerium to access Envoy, and any services accessible through it. - -[authenticate.localhost.pomerium.io]: https://authenticate.localhost.pomerium.io -[httpbin.localhost.pomerium.io]: https://verify.localhost.pomerium.io -[local development with wildcard dns on linux]: https://sixfeetup.com/blog/local-development-with-wildcard-dns-on-linux -[local development with wildcard dns]: https://blog.thesparktree.com/local-development-with-wildcard-dns -[mutual authentication: a component of zero trust]: /docs/concepts/mutual-auth.md -[mutual authentication with a sidecar]: /docs/concepts/mutual-auth.md#mutual-authentication-with-a-sidecar -[verify.localhost.pomerium.io]: https://verify.localhost.pomerium.io diff --git a/content/docs/guides/llm.mdx b/content/docs/guides/llm.mdx index 08efa8774..80f0ec2ea 100644 --- a/content/docs/guides/llm.mdx +++ b/content/docs/guides/llm.mdx @@ -15,7 +15,7 @@ description: Secure a self-hosted LLM web interface (Open WebUI) behind Pomerium # Self-Hosted LLM Behind Pomerium -This guide shows how to run a self-hosted LLM web interface (e.g., [Open WebUI](https://github.com/open-webui/open-webui)) and protect it behind Pomerium. Similar to the [code-server guide](https://www.pomerium.com/docs/guides/code-server), this setup applies enterprise-grade access controls to a local LLM, while passing user identity information through trusted headers so the upstream application knows who’s accessing it. +This guide shows how to run a self-hosted LLM web interface (e.g., [Open WebUI](https://github.com/open-webui/open-webui)) and protect it behind Pomerium. Similar to the [code-server guide](https://www.pomerium.com/docs/guides/code-server), this setup applies enterprise-grade access controls to a local LLM, while passing user identity information through trusted headers so the upstream application knows who's accessing it. ## Why Use Open WebUI? @@ -47,7 +47,7 @@ Pomerium injects trusted identity information, so Open WebUI can recognize authe - Docker and Docker Compose - A machine capable of running your chosen LLM backend -For GPU acceleration, follow Open WebUI’s CUDA instructions. +For GPU acceleration, follow Open WebUI's CUDA instructions. ## Configure Pomerium Zero @@ -100,13 +100,13 @@ With these settings, Open WebUI trusts the identity headers and can attribute ac ## Example Docker Compose -Use placeholders for secrets and adjust `WEBUI_URL` to your external route. If you trust Pomerium’s headers, set `WEBUI_AUTH=False` in Open WebUI. +Use placeholders for secrets and adjust `WEBUI_URL` to your external route. If you trust Pomerium's headers, set `WEBUI_AUTH=False` in Open WebUI. ```yaml version: '3.9' services: pomerium: - image: pomerium/pomerium:v0.27.2 + image: pomerium/pomerium:latest ports: - 443:443 restart: always @@ -158,7 +158,7 @@ Visit `https://llm.your-domain.pomerium.app`. After authenticating via your IdP, - Load a model, prompt it, and interact. - Your identity is passed through; Open WebUI sees your user email. No extra passwords needed. -- The entire session is protected behind Pomerium’s authentication and authorization. +- The entire session is protected behind Pomerium's authentication and authorization. ### Example of a Secured UI @@ -170,4 +170,4 @@ Visit `https://llm.your-domain.pomerium.app`. After authenticating via your IdP, - Integrate different backends: Adjust `OLLAMA_BASE_URL` or `OPENAI_API_KEY`. - Add more routes behind Pomerium to scale your secure environment. -You’ve successfully secured a self-hosted LLM WebUI using Pomerium, with identity-aware access control and automatic user recognition upstream. +You've successfully secured a self-hosted LLM WebUI using Pomerium, with identity-aware access control and automatic user recognition upstream. diff --git a/content/docs/guides/synology.md b/content/docs/guides/synology.md index 0e9b18bda..e352b0f06 100644 --- a/content/docs/guides/synology.md +++ b/content/docs/guides/synology.md @@ -216,12 +216,12 @@ And just to be safe, try logging in from another google account to see what happ ![Synology done](img/synology/synology-step-4-unauthorized.png) -[certificate documentation]: /docs/guides/certificates +[certificate documentation]: /docs/internals/certificates-and-tls [configuration variable docs]: /docs/reference [diskstation manager]: https://www.synology.com/en-us/dsm [docker-capable]: https://www.synology.com/en-us/dsm/packages/Docker [httpbin]: https://httpbin.org -[identity provider]: /docs/identity-providers +[identity provider]: /docs/integrations/user-identity/identity-providers [letsencrypt]: https://letsencrypt.org/ [nginx]: https://www.nginx.com [self-hosted apps]: https://github.com/Kickball/awesome-selfhosted diff --git a/content/docs/guides/tiddlywiki.mdx b/content/docs/guides/tiddlywiki.mdx index bdf5578e2..6a9841c48 100644 --- a/content/docs/guides/tiddlywiki.mdx +++ b/content/docs/guides/tiddlywiki.mdx @@ -40,7 +40,7 @@ To configure TiddlyWiki, you'll set its [ListenCommand](https://tiddlywiki.com/s -If you completed our [Quickstart guide](/docs/quickstart), you should have a working Pomerium project with the following YAML files: +If you completed our [Quickstart guide](/docs/get-started/quickstart), you should have a working Pomerium project with the following YAML files: - `config.yaml` - `docker-compose.yaml` @@ -86,7 +86,7 @@ Add the following code in your `docker-compose.yaml` file: ```yaml title="docker-compose.yaml" services: pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest volumes: - ./config.yaml:/pomerium/config.yaml:ro ports: @@ -134,7 +134,7 @@ It also assumes you are using [Docker](https://www.docker.com/) and [Docker Comp The Docker Compose example below contains the minimal configuration required to run TiddlyWiki. It does not include the configuration for Pomerium Enterprise. -For an example Pomerium Enterprise configuration using Docker Compose, see the [**Enterprise Quickstart**](/docs/enterprise/quickstart) guide. +For an example Pomerium Enterprise configuration using Docker Compose, see the [**Enterprise Quickstart**](/docs/deploy/enterprise/quickstart) guide. ::: diff --git a/content/docs/guides/tooljet.mdx b/content/docs/guides/tooljet.mdx index 757cfcc67..0321d40b4 100644 --- a/content/docs/guides/tooljet.mdx +++ b/content/docs/guides/tooljet.mdx @@ -5,11 +5,11 @@ description: Secure ToolJet with Pomerium and build internal developer tools. keywords: [tooljet, pomerium, internal developer tools] --- -import ToolJetCompose from '../../examples/tooljet/docker-compose.yaml.md'; -import PomeriumCompose from '../../examples/tooljet/docker-compose.yaml.md'; -import PomeriumConfig from '../../examples/tooljet/config-tooljet.yaml.md'; -import ConsoleCompose from '../../examples/tooljet/console-compose.yaml.md'; -import ConfigConsole from '../../examples/tooljet/config-console.yaml.md'; +import ToolJetCompose from '/content/examples/tooljet/docker-compose.yaml.md'; +import PomeriumCompose from '/content/examples/tooljet/docker-compose.yaml.md'; +import PomeriumConfig from '/content/examples/tooljet/config-tooljet.yaml.md'; +import ConsoleCompose from '/content/examples/tooljet/console-compose.yaml.md'; +import ConfigConsole from '/content/examples/tooljet/config-console.yaml.md'; import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem'; @@ -32,7 +32,7 @@ ToolJet provides its own RBAC-based [permissions](https://docs.tooljet.com/docs/ To complete this guide, you need: - [Docker](https://docs.docker.com/install/) and [Docker Compose](https://docs.docker.com/compose/install/) -- An [identity provider](/docs/identity-providers) +- An [identity provider](/docs/integrations/user-identity/identity-providers) ## Set up Pomerium @@ -45,7 +45,7 @@ Create a `config.yaml` file and add the following code: Next, you need to: -- Update the IdP configuration variables with your own (See the [GitHub](/docs/identity-providers/github) guide for more information) +- Update the IdP configuration variables with your own (See the [GitHub](/docs/integrations/user-identity/github) guide for more information) - Replace user@example.com with the email associated with your IdP - Generate a signing key @@ -111,9 +111,9 @@ In your browser, go to the external ToolJet URL to set up your workspace. :::enterprise -This guide assumes you can access the [Enterprise Console](/docs/enterprise/install). +This guide assumes you can access the [Enterprise Console](/docs/deploy/enterprise/install). -The Docker Compose configuration in the Enterprise portion of this guide uses same implementation as the [Enterprise Quickstart](/docs/enterprise/quickstart). +The Docker Compose configuration in the Enterprise portion of this guide uses same implementation as the [Enterprise Quickstart](/docs/deploy/enterprise/quickstart). ::: @@ -129,7 +129,7 @@ In your `config.yaml` file, add the following code: Next, you need to: -- Update the IdP configuration variables with your own (See the [GitHub](/docs/identity-providers/github) guide for more information) +- Update the IdP configuration variables with your own (See the [GitHub](/docs/integrations/user-identity/github) guide for more information) - Replace user@example.com with the email associated with your IdP - Generate a signing key diff --git a/content/docs/guides/transmission.md b/content/docs/guides/transmission.md index 2f9868dde..7c96eb368 100644 --- a/content/docs/guides/transmission.md +++ b/content/docs/guides/transmission.md @@ -30,7 +30,7 @@ While there are software clients available to interact with the daemon over RPC, Because RPC traffic to and from a Transmission daemon is unencrypted, we strongly suggest you only communicate from Pomerium to Transmission on a trusted private network. Note that some cloud hosting providers differentiate "private networking" (which is visible to all hosts in a data center) from "VLANS" which are only visible to your hosts. While you can configure a local proxy on your Transmission host to provide TLS encryption, that configuration is outside of the scope of this guide. -Running Pomerium and Transmission on the same host, using [docker](/docs/quickstart) for example, negates this concern. +Running Pomerium and Transmission on the same host, using [docker](/docs/get-started/quickstart) for example, negates this concern. ::: @@ -120,4 +120,4 @@ You should now be able to authenticate and access your Transmission daemon remot In addition to the lock symbol in your browser's address bar, you can go to `/.pomerium` to view and confirm your session details. [transmission]: https://transmissionbt.com/ -[quick start]: /docs/quickstart +[quick start]: /docs/get-started/quickstart diff --git a/content/docs/guides/verify-jwt.md b/content/docs/guides/verify-jwt.md deleted file mode 100644 index 99bdaf495..000000000 --- a/content/docs/guides/verify-jwt.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -# cSpell:ignore Jklds, Tpai, Ibvjq, ecparam, pubout Lamda -title: JWT Verification -description: This guide provides several methods to validate the Pomerium JWT in an upstream application. -sidebar_label: JWT Verification ---- - -import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem'; import GoApp from '../../examples/go-sdk/go-app.md'; import ExpressApp from '../../examples/js-sdk/express-server.md'; - -This guide provides several methods to verify and validate the Pomerium JWT forwarded in signed the `X-Pomerium-Jwt-Assertion` header: - -- Verification in a [Go application](#verification-in-a-go-application) -- Verification in a [single-page application](#verification-in-a-single-page-application) -- [Manual verification](#manual-verification) - -## JWT validation requirements - -Before trusting any user identity information in the JWT, your application should verify: - -1. The JWT has a valid signature from a trusted source. -2. The JWT has not expired. -3. The JWT audience and issuer match your application's domain. - -See [JWT validation](/docs/capabilities/getting-users-identity#jwt-validation) for specific instructions on validating each of these requirements. - -## Verification in a Go application - -For an application written in Go, you can use the [Go SDK](https://github.com/pomerium/sdk-go) to perform the necessary verification steps. For example: - - - -## Verification in a Node.js application - -Pomerium's [JavaScript SDK](https://github.com/pomerium/js-sdk) provides a server-side solution to verify JWTs issued by the authorization service. - -### Requirements to use the JavaScript SDK - -The JavaScript SDK is available as an [NPM package](https://www.npmjs.com/package/@pomerium/js-sdk) and can be imported using CommonJS or ECMAScript modules. - -To use the JavaScript SDK, you need: - -- [Node.js](https://nodejs.org/en/download/) (version 18+) -- [NPM](https://www.npmjs.com/) (to install Node.js and Yarn) -- [Yarn](https://classic.yarnpkg.com/lang/en/docs/install/#mac-stable) (preferred package manager) - -The following code provides a minimum working example of how JWT verification works using the JavaScript SDK in a Node.js app: - - - -
- Trust on first use (TOFU) -
- -The `issuer` and `audience` parameters are optional. If you don’t define them, `PomeriumVerifier` applies `firstUse` by default to the JWT provided by the identity provider. `PomeriumVerifier` verifies subsequent requests with these claims. - -If you define the `issuer` and `audience` parameters, `PomeriumVerifier` verifies their values against the claims provided by the identity provider. - -The `issuer` and `audience` parameters should both be set to the domain of the **upstream application** without the prefixed protocol (for example, `httpbin.corp.example.com`). - -Note: We strongly recommend that you explicitly define the expected issuer and audience claims. Relying on a TOFU policy is dangerous in ephemeral serverless environments (such as AWS Lamda or Cloud Run), where applications are typically short-lived. - -
-
- -## Manual verification - -Though you will likely verify signed headers programmatically in your application's middleware with a third-party JWT library, if you are new to JWT it may be helpful to show what manual verification looks like. - -1. Provide Pomerium with a base64-encoded Elliptic Curve ([NIST P-256](https://csrc.nist.gov/csrc/media/events/)) Private Key. In production, you'd likely want to get these from your key management service (KMS). - - ```bash - openssl ecparam -genkey -name prime256v1 -noout -out ec_private.pem - openssl ec -in ec_private.pem -pubout -out ec_public.pem - # careful! this will output your private key in terminal - cat ec_private.pem | base64 - ``` - - Copy the base64-encoded value of your private key to Pomerium's environmental configuration variable `SIGNING_KEY`. - - ```bash - SIGNING_KEY=... - ``` - -1. Reload Pomerium. Navigate to httpbin (by default, `https://httpbin.corp.${YOUR-DOMAIN}.com`), and log in as usual. Click **request inspection**. Select `/headers`. Click **try it out** and then **execute**. You should see something like the following. - - ![httpbin displaying jwt headers](./img/jwt/inspect-headers.png) - -1. `X-Pomerium-Jwt-Assertion` is the signature value. It's less scary than it looks, and is basically just a compressed, JSON blob as described above. Navigate to [jwt.io](https://jwt.io/), which provides a helpful user interface to manually verify JWT values. - -1. Paste the value of `X-Pomerium-Jwt-Assertion` header token into the `Encoded` form. You should notice that the decoded values look much more familiar. - - ![httpbin displaying decoded jwt](./img/jwt/verifying-headers-1.png) - -1. Finally, we want to cryptographically verify the validity of the token. To do this, we will need the signer's public key. You can simply copy and paste the output of `cat ec_public.pem`. - - ![httpbin displaying verified jwt](./img/jwt/jwt-payload.png) - -**Voila!** Hopefully walking through a manual verification has helped give you a better feel for how signed JWT tokens are used as a secondary validation mechanism in pomerium. diff --git a/content/docs/identity-providers/_category_.json b/content/docs/identity-providers/_category_.json deleted file mode 100644 index 5af2e9eb4..000000000 --- a/content/docs/identity-providers/_category_.json +++ /dev/null @@ -1,3 +0,0 @@ -{ - "label": "Identity Providers" -} diff --git a/content/docs/identity-providers/img/apple/apple-download-key.png b/content/docs/identity-providers/img/apple/apple-download-key.png deleted file mode 100644 index c3bfb70dc..000000000 Binary files a/content/docs/identity-providers/img/apple/apple-download-key.png and /dev/null differ diff --git a/content/docs/identity-providers/img/apple/apple-register-app.png b/content/docs/identity-providers/img/apple/apple-register-app.png deleted file mode 100644 index 29bc449f8..000000000 Binary files a/content/docs/identity-providers/img/apple/apple-register-app.png and /dev/null differ diff --git a/content/docs/identity-providers/img/apple/apple-register-new-key.png b/content/docs/identity-providers/img/apple/apple-register-new-key.png deleted file mode 100644 index cdf0ec181..000000000 Binary files a/content/docs/identity-providers/img/apple/apple-register-new-key.png and /dev/null differ diff --git a/content/docs/identity-providers/img/apple/apple-sign-in-prompt.png b/content/docs/identity-providers/img/apple/apple-sign-in-prompt.png deleted file mode 100644 index bf94af4ff..000000000 Binary files a/content/docs/identity-providers/img/apple/apple-sign-in-prompt.png and /dev/null differ diff --git a/content/docs/identity-providers/img/apple/apple-web-authn-config.png b/content/docs/identity-providers/img/apple/apple-web-authn-config.png deleted file mode 100644 index b763714b3..000000000 Binary files a/content/docs/identity-providers/img/apple/apple-web-authn-config.png and /dev/null differ diff --git a/content/docs/identity-providers/img/auth0/action.png b/content/docs/identity-providers/img/auth0/action.png deleted file mode 100644 index 10945ea13..000000000 Binary files a/content/docs/identity-providers/img/auth0/action.png and /dev/null differ diff --git a/content/docs/identity-providers/img/auth0/auth0-idp.png b/content/docs/identity-providers/img/auth0/auth0-idp.png deleted file mode 100644 index f59d482ae..000000000 Binary files a/content/docs/identity-providers/img/auth0/auth0-idp.png and /dev/null differ diff --git a/content/docs/identity-providers/img/auth0/create-m2m.png b/content/docs/identity-providers/img/auth0/create-m2m.png deleted file mode 100644 index ee79eded2..000000000 Binary files a/content/docs/identity-providers/img/auth0/create-m2m.png and /dev/null differ diff --git a/content/docs/identity-providers/img/auth0/create.png b/content/docs/identity-providers/img/auth0/create.png deleted file mode 100644 index ffb83ec23..000000000 Binary files a/content/docs/identity-providers/img/auth0/create.png and /dev/null differ diff --git a/content/docs/identity-providers/img/auth0/dashboard.png b/content/docs/identity-providers/img/auth0/dashboard.png deleted file mode 100644 index bd25da603..000000000 Binary files a/content/docs/identity-providers/img/auth0/dashboard.png and /dev/null differ diff --git a/content/docs/identity-providers/img/auth0/flow.png b/content/docs/identity-providers/img/auth0/flow.png deleted file mode 100644 index 53b959ea7..000000000 Binary files a/content/docs/identity-providers/img/auth0/flow.png and /dev/null differ diff --git a/content/docs/identity-providers/img/auth0/m2m-scopes.png b/content/docs/identity-providers/img/auth0/m2m-scopes.png deleted file mode 100644 index 1c3cd655c..000000000 Binary files a/content/docs/identity-providers/img/auth0/m2m-scopes.png and /dev/null differ diff --git a/content/docs/identity-providers/img/cognito/cognito-app-client-create.png b/content/docs/identity-providers/img/cognito/cognito-app-client-create.png deleted file mode 100644 index 259e60a2a..000000000 Binary files a/content/docs/identity-providers/img/cognito/cognito-app-client-create.png and /dev/null differ diff --git a/content/docs/identity-providers/img/cognito/cognito-domain-name.png b/content/docs/identity-providers/img/cognito/cognito-domain-name.png deleted file mode 100644 index d0049f25d..000000000 Binary files a/content/docs/identity-providers/img/cognito/cognito-domain-name.png and /dev/null differ diff --git a/content/docs/identity-providers/img/cognito/cognito-group-claim.png b/content/docs/identity-providers/img/cognito/cognito-group-claim.png deleted file mode 100644 index 96bca5319..000000000 Binary files a/content/docs/identity-providers/img/cognito/cognito-group-claim.png and /dev/null differ diff --git a/content/docs/identity-providers/img/entra/azure-idp.png b/content/docs/identity-providers/img/entra/azure-idp.png deleted file mode 100644 index 4fe2ebb1d..000000000 Binary files a/content/docs/identity-providers/img/entra/azure-idp.png and /dev/null differ diff --git a/content/docs/identity-providers/img/entra/entra-add-app.png b/content/docs/identity-providers/img/entra/entra-add-app.png deleted file mode 100644 index 9e1c879c0..000000000 Binary files a/content/docs/identity-providers/img/entra/entra-add-app.png and /dev/null differ diff --git a/content/docs/identity-providers/img/entra/entra-api-permissions.png b/content/docs/identity-providers/img/entra/entra-api-permissions.png deleted file mode 100644 index 2c5071230..000000000 Binary files a/content/docs/identity-providers/img/entra/entra-api-permissions.png and /dev/null differ diff --git a/content/docs/identity-providers/img/entra/entra-app-secret-client-id.png b/content/docs/identity-providers/img/entra/entra-app-secret-client-id.png deleted file mode 100644 index 682a84eea..000000000 Binary files a/content/docs/identity-providers/img/entra/entra-app-secret-client-id.png and /dev/null differ diff --git a/content/docs/identity-providers/img/entra/entra-client-secret-value.png b/content/docs/identity-providers/img/entra/entra-client-secret-value.png deleted file mode 100644 index e7487f85f..000000000 Binary files a/content/docs/identity-providers/img/entra/entra-client-secret-value.png and /dev/null differ diff --git a/content/docs/identity-providers/img/entra/entra-create-client-secret.png b/content/docs/identity-providers/img/entra/entra-create-client-secret.png deleted file mode 100644 index 7bcd5750d..000000000 Binary files a/content/docs/identity-providers/img/entra/entra-create-client-secret.png and /dev/null differ diff --git a/content/docs/identity-providers/img/entra/entra-edit-groups-claim.png b/content/docs/identity-providers/img/entra/entra-edit-groups-claim.png deleted file mode 100644 index 8ae7a71d3..000000000 Binary files a/content/docs/identity-providers/img/entra/entra-edit-groups-claim.png and /dev/null differ diff --git a/content/docs/identity-providers/img/entra/entra-endpoint-metadata.png b/content/docs/identity-providers/img/entra/entra-endpoint-metadata.png deleted file mode 100644 index 84afa4931..000000000 Binary files a/content/docs/identity-providers/img/entra/entra-endpoint-metadata.png and /dev/null differ diff --git a/content/docs/identity-providers/img/entra/entra-endpoints-tab.png b/content/docs/identity-providers/img/entra/entra-endpoints-tab.png deleted file mode 100644 index 8b1b9fe32..000000000 Binary files a/content/docs/identity-providers/img/entra/entra-endpoints-tab.png and /dev/null differ diff --git a/content/docs/identity-providers/img/entra/entra-instance.png b/content/docs/identity-providers/img/entra/entra-instance.png deleted file mode 100644 index 5a4155c83..000000000 Binary files a/content/docs/identity-providers/img/entra/entra-instance.png and /dev/null differ diff --git a/content/docs/identity-providers/img/entra/entra-register-app.png b/content/docs/identity-providers/img/entra/entra-register-app.png deleted file mode 100644 index 5e080ee13..000000000 Binary files a/content/docs/identity-providers/img/entra/entra-register-app.png and /dev/null differ diff --git a/content/docs/identity-providers/img/entra/entra-token-configuration.png b/content/docs/identity-providers/img/entra/entra-token-configuration.png deleted file mode 100644 index d99a9c273..000000000 Binary files a/content/docs/identity-providers/img/entra/entra-token-configuration.png and /dev/null differ diff --git a/content/docs/identity-providers/img/github/github-idp.png b/content/docs/identity-providers/img/github/github-idp.png deleted file mode 100644 index 4d1fe43ba..000000000 Binary files a/content/docs/identity-providers/img/github/github-idp.png and /dev/null differ diff --git a/content/docs/identity-providers/img/github/github-oauth-creation.png b/content/docs/identity-providers/img/github/github-oauth-creation.png deleted file mode 100644 index 1d14902ce..000000000 Binary files a/content/docs/identity-providers/img/github/github-oauth-creation.png and /dev/null differ diff --git a/content/docs/identity-providers/img/github/github-personal-access-token.png b/content/docs/identity-providers/img/github/github-personal-access-token.png deleted file mode 100644 index 432c0f9fa..000000000 Binary files a/content/docs/identity-providers/img/github/github-personal-access-token.png and /dev/null differ diff --git a/content/docs/identity-providers/img/github/github-signon-page.png b/content/docs/identity-providers/img/github/github-signon-page.png deleted file mode 100644 index 460132199..000000000 Binary files a/content/docs/identity-providers/img/github/github-signon-page.png and /dev/null differ diff --git a/content/docs/identity-providers/img/gitlab/gitlab-create-applications.png b/content/docs/identity-providers/img/gitlab/gitlab-create-applications.png deleted file mode 100644 index 5f00f3a46..000000000 Binary files a/content/docs/identity-providers/img/gitlab/gitlab-create-applications.png and /dev/null differ diff --git a/content/docs/identity-providers/img/gitlab/gitlab-credentials.png b/content/docs/identity-providers/img/gitlab/gitlab-credentials.png deleted file mode 100644 index 8a7f1db99..000000000 Binary files a/content/docs/identity-providers/img/gitlab/gitlab-credentials.png and /dev/null differ diff --git a/content/docs/identity-providers/img/gitlab/gitlab-idp.png b/content/docs/identity-providers/img/gitlab/gitlab-idp.png deleted file mode 100644 index 69f8521a6..000000000 Binary files a/content/docs/identity-providers/img/gitlab/gitlab-idp.png and /dev/null differ diff --git a/content/docs/identity-providers/img/gitlab/gitlab-personal-access-token.png b/content/docs/identity-providers/img/gitlab/gitlab-personal-access-token.png deleted file mode 100644 index ed7162f48..000000000 Binary files a/content/docs/identity-providers/img/gitlab/gitlab-personal-access-token.png and /dev/null differ diff --git a/content/docs/identity-providers/img/gitlab/gitlab-verify-access.png b/content/docs/identity-providers/img/gitlab/gitlab-verify-access.png deleted file mode 100644 index b2512bf66..000000000 Binary files a/content/docs/identity-providers/img/gitlab/gitlab-verify-access.png and /dev/null differ diff --git a/content/docs/identity-providers/img/google/google-create-client-id-config.png b/content/docs/identity-providers/img/google/google-create-client-id-config.png deleted file mode 100644 index 7bde34077..000000000 Binary files a/content/docs/identity-providers/img/google/google-create-client-id-config.png and /dev/null differ diff --git a/content/docs/identity-providers/img/google/google-gsuite-add-scopes.png b/content/docs/identity-providers/img/google/google-gsuite-add-scopes.png deleted file mode 100644 index f8037e226..000000000 Binary files a/content/docs/identity-providers/img/google/google-gsuite-add-scopes.png and /dev/null differ diff --git a/content/docs/identity-providers/img/google/google-idp-console-settings.png b/content/docs/identity-providers/img/google/google-idp-console-settings.png deleted file mode 100644 index 22d892003..000000000 Binary files a/content/docs/identity-providers/img/google/google-idp-console-settings.png and /dev/null differ diff --git a/content/docs/identity-providers/img/google/google-oauth-client-id-secret.png b/content/docs/identity-providers/img/google/google-oauth-client-id-secret.png deleted file mode 100644 index 7a33274ed..000000000 Binary files a/content/docs/identity-providers/img/google/google-oauth-client-id-secret.png and /dev/null differ diff --git a/content/docs/identity-providers/img/google/google-service-account-create-key.png b/content/docs/identity-providers/img/google/google-service-account-create-key.png deleted file mode 100644 index ec4e69ecb..000000000 Binary files a/content/docs/identity-providers/img/google/google-service-account-create-key.png and /dev/null differ diff --git a/content/docs/identity-providers/img/oidc/keycloak-access-settings.png b/content/docs/identity-providers/img/oidc/keycloak-access-settings.png deleted file mode 100644 index be2554e6d..000000000 Binary files a/content/docs/identity-providers/img/oidc/keycloak-access-settings.png and /dev/null differ diff --git a/content/docs/identity-providers/img/oidc/keycloak-admin-console.png b/content/docs/identity-providers/img/oidc/keycloak-admin-console.png deleted file mode 100644 index bef425ad2..000000000 Binary files a/content/docs/identity-providers/img/oidc/keycloak-admin-console.png and /dev/null differ diff --git a/content/docs/identity-providers/img/oidc/keycloak-capability-config.png b/content/docs/identity-providers/img/oidc/keycloak-capability-config.png deleted file mode 100644 index 9e76cb12f..000000000 Binary files a/content/docs/identity-providers/img/oidc/keycloak-capability-config.png and /dev/null differ diff --git a/content/docs/identity-providers/img/oidc/keycloak-client-credentials.png b/content/docs/identity-providers/img/oidc/keycloak-client-credentials.png deleted file mode 100644 index 890d86cbf..000000000 Binary files a/content/docs/identity-providers/img/oidc/keycloak-client-credentials.png and /dev/null differ diff --git a/content/docs/identity-providers/img/oidc/keycloak-client-general-settings.png b/content/docs/identity-providers/img/oidc/keycloak-client-general-settings.png deleted file mode 100644 index 05589ac08..000000000 Binary files a/content/docs/identity-providers/img/oidc/keycloak-client-general-settings.png and /dev/null differ diff --git a/content/docs/identity-providers/img/oidc/keycloak-create-a-user.gif b/content/docs/identity-providers/img/oidc/keycloak-create-a-user.gif deleted file mode 100644 index 44d796bce..000000000 Binary files a/content/docs/identity-providers/img/oidc/keycloak-create-a-user.gif and /dev/null differ diff --git a/content/docs/identity-providers/img/oidc/keycloak-create-client.gif b/content/docs/identity-providers/img/oidc/keycloak-create-client.gif deleted file mode 100644 index 6a80e0f57..000000000 Binary files a/content/docs/identity-providers/img/oidc/keycloak-create-client.gif and /dev/null differ diff --git a/content/docs/identity-providers/img/oidc/keycloak-login.png b/content/docs/identity-providers/img/oidc/keycloak-login.png deleted file mode 100644 index 58f07f843..000000000 Binary files a/content/docs/identity-providers/img/oidc/keycloak-login.png and /dev/null differ diff --git a/content/docs/identity-providers/img/oidc/keycloak-realm.gif b/content/docs/identity-providers/img/oidc/keycloak-realm.gif deleted file mode 100644 index e6ea4f7a2..000000000 Binary files a/content/docs/identity-providers/img/oidc/keycloak-realm.gif and /dev/null differ diff --git a/content/docs/identity-providers/img/oidc/keycloak-set-password.png b/content/docs/identity-providers/img/oidc/keycloak-set-password.png deleted file mode 100644 index ca7bbec7d..000000000 Binary files a/content/docs/identity-providers/img/oidc/keycloak-set-password.png and /dev/null differ diff --git a/content/docs/identity-providers/img/oidc/keycloak-verify-app.png b/content/docs/identity-providers/img/oidc/keycloak-verify-app.png deleted file mode 100644 index b26721210..000000000 Binary files a/content/docs/identity-providers/img/oidc/keycloak-verify-app.png and /dev/null differ diff --git a/content/docs/identity-providers/img/okta/okta-authorization-servers.png b/content/docs/identity-providers/img/okta/okta-authorization-servers.png deleted file mode 100644 index 080cd4d84..000000000 Binary files a/content/docs/identity-providers/img/okta/okta-authorization-servers.png and /dev/null differ diff --git a/content/docs/identity-providers/img/okta/okta-idp.png b/content/docs/identity-providers/img/okta/okta-idp.png deleted file mode 100644 index 7f0dbad65..000000000 Binary files a/content/docs/identity-providers/img/okta/okta-idp.png and /dev/null differ diff --git a/content/docs/identity-providers/img/onelogin/one-login-add-app.png b/content/docs/identity-providers/img/onelogin/one-login-add-app.png deleted file mode 100644 index a6aab5ae3..000000000 Binary files a/content/docs/identity-providers/img/onelogin/one-login-add-app.png and /dev/null differ diff --git a/content/docs/identity-providers/img/onelogin/one-login-add-open-id.png b/content/docs/identity-providers/img/onelogin/one-login-add-open-id.png deleted file mode 100644 index 4a0e24a60..000000000 Binary files a/content/docs/identity-providers/img/onelogin/one-login-add-open-id.png and /dev/null differ diff --git a/content/docs/identity-providers/img/onelogin/one-login-api-access.png b/content/docs/identity-providers/img/onelogin/one-login-api-access.png deleted file mode 100644 index 0cc81395b..000000000 Binary files a/content/docs/identity-providers/img/onelogin/one-login-api-access.png and /dev/null differ diff --git a/content/docs/identity-providers/img/onelogin/one-login-app-access.png b/content/docs/identity-providers/img/onelogin/one-login-app-access.png deleted file mode 100644 index 1eec93e57..000000000 Binary files a/content/docs/identity-providers/img/onelogin/one-login-app-access.png and /dev/null differ diff --git a/content/docs/identity-providers/img/onelogin/one-login-callback-url.png b/content/docs/identity-providers/img/onelogin/one-login-callback-url.png deleted file mode 100644 index 5509dd56d..000000000 Binary files a/content/docs/identity-providers/img/onelogin/one-login-callback-url.png and /dev/null differ diff --git a/content/docs/identity-providers/img/onelogin/one-login-events.png b/content/docs/identity-providers/img/onelogin/one-login-events.png deleted file mode 100644 index c11d24795..000000000 Binary files a/content/docs/identity-providers/img/onelogin/one-login-events.png and /dev/null differ diff --git a/content/docs/identity-providers/img/onelogin/one-login-idp.png b/content/docs/identity-providers/img/onelogin/one-login-idp.png deleted file mode 100644 index 99434837a..000000000 Binary files a/content/docs/identity-providers/img/onelogin/one-login-idp.png and /dev/null differ diff --git a/content/docs/identity-providers/img/onelogin/one-login-select-logo.png b/content/docs/identity-providers/img/onelogin/one-login-select-logo.png deleted file mode 100644 index 689405d67..000000000 Binary files a/content/docs/identity-providers/img/onelogin/one-login-select-logo.png and /dev/null differ diff --git a/content/docs/identity-providers/img/onelogin/one-login-sso-settings.png b/content/docs/identity-providers/img/onelogin/one-login-sso-settings.png deleted file mode 100644 index 23d77e108..000000000 Binary files a/content/docs/identity-providers/img/onelogin/one-login-sso-settings.png and /dev/null differ diff --git a/content/docs/identity-providers/img/ping/ping-add-groups-attribute.png b/content/docs/identity-providers/img/ping/ping-add-groups-attribute.png deleted file mode 100644 index 2ee927e10..000000000 Binary files a/content/docs/identity-providers/img/ping/ping-add-groups-attribute.png and /dev/null differ diff --git a/content/docs/identity-providers/img/ping/ping-add-oidc-web-app.png b/content/docs/identity-providers/img/ping/ping-add-oidc-web-app.png deleted file mode 100644 index e11ce8474..000000000 Binary files a/content/docs/identity-providers/img/ping/ping-add-oidc-web-app.png and /dev/null differ diff --git a/content/docs/identity-providers/img/ping/ping-attribute-settings.png b/content/docs/identity-providers/img/ping/ping-attribute-settings.png deleted file mode 100644 index 2606d4833..000000000 Binary files a/content/docs/identity-providers/img/ping/ping-attribute-settings.png and /dev/null differ diff --git a/content/docs/identity-providers/img/ping/ping-enable-app.png b/content/docs/identity-providers/img/ping/ping-enable-app.png deleted file mode 100644 index 4de21d2f5..000000000 Binary files a/content/docs/identity-providers/img/ping/ping-enable-app.png and /dev/null differ diff --git a/content/docs/identity-providers/img/ping/ping-enterprise-idp-config.png b/content/docs/identity-providers/img/ping/ping-enterprise-idp-config.png deleted file mode 100644 index 553beb4d3..000000000 Binary files a/content/docs/identity-providers/img/ping/ping-enterprise-idp-config.png and /dev/null differ diff --git a/content/docs/identity-providers/img/ping/ping-redirect-uri.png b/content/docs/identity-providers/img/ping/ping-redirect-uri.png deleted file mode 100644 index 663de1cbf..000000000 Binary files a/content/docs/identity-providers/img/ping/ping-redirect-uri.png and /dev/null differ diff --git a/content/docs/identity-providers/img/ping/ping-worker-app.png b/content/docs/identity-providers/img/ping/ping-worker-app.png deleted file mode 100644 index 9daf3319d..000000000 Binary files a/content/docs/identity-providers/img/ping/ping-worker-app.png and /dev/null differ diff --git a/content/docs/identity-providers/img/ping/ping-zero-idp-config.png b/content/docs/identity-providers/img/ping/ping-zero-idp-config.png deleted file mode 100644 index 20286c5d8..000000000 Binary files a/content/docs/identity-providers/img/ping/ping-zero-idp-config.png and /dev/null differ diff --git a/content/docs/identity-providers/oidc.mdx b/content/docs/identity-providers/oidc.mdx deleted file mode 100644 index 334b8ce04..000000000 --- a/content/docs/identity-providers/oidc.mdx +++ /dev/null @@ -1,202 +0,0 @@ ---- -# cSpell:ignore keycloak, mykeycloak, mynewclient -id: oidc -title: OIDC -description: Learn how integrate a generic OIDC provider with Pomerium. -keywords: [keycloak, pomerium, oidc, generic oidc] -lang: en-US ---- - -import SelfSignedCertWarning from '@site/content/docs/admonitions/_handle-self-signed-certificate-warning.mdx'; - -# Generic OIDC - -This guide covers how to configure a generic OpenID Connect (**OIDC**) provider to work with Pomerium. - -## Background - -Pomerium provides default [identity provider settings](/docs/reference/identity-provider-settings) that allow you to seamlessly connect with a number of well-known identity provider (**IdP**) solutions. However, Pomerium can also connect with any generic OIDC provider if both Pomerium and the OIDC provider are properly configured. - -To learn how a generic [OIDC](https://openid.net/specs/openid-connect-core-1_0.html) implementation works with Pomerium, you will configure [Keycloak](https://www.keycloak.org/) as your OIDC provider. - -## Before you start - -This guide requires you to self-host the Keycloak server. To minimize set up time, you will deploy Pomerium, Keycloak, and the Pomerium Verify service in Docker containers. - -To complete this guide, you need: - -- [Docker](https://docs.docker.com/install/) -- [Docker Compose](https://docs.docker.com/compose/install/) - -## Set up Docker Compose - -Create a `docker-compose.yaml` file and add the following configuration: - -```yaml title="docker-compose.yaml" -services: - mykeycloak: - image: quay.io/keycloak/keycloak:22.0.1 - command: - - start-dev - environment: - - KEYCLOAK_ADMIN=admin - - KEYCLOAK_ADMIN_PASSWORD=admin - ports: - - 8080:8080 - networks: - default: - aliases: - - keycloak.localhost.pomerium.io - pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest - volumes: - - ./config.yaml:/pomerium/config.yaml:ro - ports: - - 443:443 - verify: - image: cr.pomerium.com/pomerium/verify:latest - environment: - JWKS_ENDPOINT: https://pomerium/.well-known/pomerium/jwks.json -``` - -Note the following points about this configuration: - -- `start-dev` runs the Keycloak server in Development mode -- The admin console username and password are both `admin` -- The Keycloak server is assigned a network alias (`keycloak.localhost.pomerium.io`) so Pomerium can generate a sign-in redirect URL that resolves to the Keycloak container on the host machine - -## Set up Keycloak - -In your terminal, run Docker Compose: - -```yaml -docker compose up -``` - -When Keycloak is ready, navigate to [http://localhost:8080](http://localhost:8080) to access the **Administration Console:** - -![Access the Keycloak admin console](./img/oidc/keycloak-admin-console.png) - -Sign in with the admin credentials. - -### Create a realm - -Keycloak uses realms to manage sets of users, credentials, roles, and groups. When you start Keycloak, your instance comes with an admin realm called `master`. - -To create a new non-admin group, create a new realm in the admin dashboard: - -1. Select the **master** dropdown -1. Select **Create Realm** -1. In the **Realm name** field, enter a name, like "Pomerium" -1. Select **Create** - -![Create a new realm](./img/oidc/keycloak-realm.gif) - -### Create a user - -Your realm has no users at first. To add a user: - -1. Go to the admin console ([http://localhost:8080/admin](http://localhost:8080/admin)) -1. Select **Users** -1. Select **Add users** -1. Enter a **Username**, a **First name**, and **Last name** -1. Select **Create** - -![Create a user](./img/oidc/keycloak-create-a-user.gif) - -Now, assign the user a password: - -1. Select the **Credentials** tab -1. Select **Set password** -1. Enter a password and confirm it -1. Set **Temporary** to **Off** so the user doesn't have to reset the password at the first login -1. Select **Save** - -![Set the user's password](./img/oidc/keycloak-set-password.png) - -### Create a client - -Lastly, you need to create a **Client** for the realm you just created: - -1. Go to the admin console ([http://localhost:8080/admin](http://localhost:8080/admin)) -1. Select **Clients**, then **Create client** -1. Keep **Client type** as **OpenID Connect** -1. In the **Client ID** field, enter a name like `mynewclient` -1. In the **Authentication flow** field, select **Standard flow** and **Direct access grants** -1. Leave **Login settings** empty, and select **Save** - -![Create a client](./img/oidc/keycloak-create-client.gif) - -Update the client you created: - -1. Under **General Settings** in the **Name** field, enter your Client ID in template literals (for example, `${mynewclient}`) ![Enter client ID](./img/oidc/keycloak-client-general-settings.png) -1. Go to **Access settings** -1. In **Root URL**, enter `${authBaseUrl}` -1. In **Home URL**, enter `/realms///` -1. In **Valid redirect URIs**, enter `https://authenticate.localhost.pomerium.io/oauth2/callback` -1. In **Web Origins**, enter `https://authenticate.localhost.pomerium.io` ![Add access settings](./img/oidc/keycloak-access-settings.png) -1. Under **Capabilities config**, turn on **Client authentication** ![Turn on client authentication](./img/oidc/keycloak-capability-config.png) - -Save your settings. - -### Get the client secret - -In the client details page: - -1. select the **Credentials** tab -1. Copy the **Client secret** ![Get client secret](./img/oidc/keycloak-client-credentials.png) - -You need to include the client secret in your Pomerium configuration file. - -## Set up Pomerium - -Create a YAML file and add the following configuration: - -```yaml title="config.yaml" -authenticate_service_url: https://authenticate.localhost.pomerium.io - -idp_provider: oidc -idp_client_id: 'mynewclient' -idp_client_secret: 'your_client_secret' # enter your client secret here -idp_provider_url: 'http://keycloak.localhost.pomerium.io:8080/realms/Pomerium' - -signing_key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSVA2TUN5UFI5OUNmSEVkU0s4cVdzbk51Q0RyMVZ3ay93RER1RVhyQitELzZvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFQ0JTK3gyQnJRNVJqNHJFcU5PSEVsUFVESXJiRlNhRitoWEhEL1RYby9rQWVKU1lJSjJHVwpZMnE0a0NPNTU4RmdoYmxDTUplYVdjV1luT3JuZkpxeXRnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - -routes: - - from: https://verify.localhost.pomerium.io - to: http://verify:8000 - allow_any_authenticated_user: true - pass_identity_headers: true -``` - -First, add your **client secret** to the configuration file. - -Note the following points: - -- The `idp_provider_url` should match the Keycloak network alias in your Docker Compose file. So that it's valid, add the protocol (`http://`) and the correct path (`/realms/`) to the URL. -- The `signing_key` is used by Pomerium to cryptographically sign the user's JWT, and is required for [identity verification](/docs/capabilities/getting-users-identity) -- The [`pass_identity_headers`](/docs/reference/routes/pass-identity-headers-per-route) setting forwards the JWT Assertion Header to the upstream application - -:::caution - -Do not use the **signing key** in the example above in a production environment. See [**Signing Keys**](/docs/reference/signing-key) for more information on generating and using signing keys. - -::: - -### Access the Verify app - -Access the **Verify URL** in your configuration file. - -:::tip - - - -::: - -Pomerium should redirect you to the sign-in page of the Keycloak realm you created. Sign in with your user's credentials. - -![Sign in to Keycloak Realm](./img/oidc/keycloak-login.png) - -Once you sign in, you can verify that Pomerium handled the JWT and included the OIDC claims from Keycloak: - -![Access Verify app](./img/oidc/keycloak-verify-app.png) diff --git a/content/docs/img/logged-in-as.png b/content/docs/img/logged-in-as.png deleted file mode 100644 index 7de800a74..000000000 Binary files a/content/docs/img/logged-in-as.png and /dev/null differ diff --git a/content/docs/img/quickstart/cluster-certs.png b/content/docs/img/quickstart/cluster-certs.png deleted file mode 100644 index 5c0bafaaa..000000000 Binary files a/content/docs/img/quickstart/cluster-certs.png and /dev/null differ diff --git a/content/docs/img/quickstart/pz-identity-verified.png b/content/docs/img/quickstart/pz-identity-verified.png deleted file mode 100644 index 15c953506..000000000 Binary files a/content/docs/img/quickstart/pz-identity-verified.png and /dev/null differ diff --git a/content/docs/img/quickstart/pz-quickstart-policy.png b/content/docs/img/quickstart/pz-quickstart-policy.png deleted file mode 100644 index e3b87cfd8..000000000 Binary files a/content/docs/img/quickstart/pz-quickstart-policy.png and /dev/null differ diff --git a/content/docs/img/quickstart/pz-quickstart-routes.png b/content/docs/img/quickstart/pz-quickstart-routes.png deleted file mode 100644 index 05c472083..000000000 Binary files a/content/docs/img/quickstart/pz-quickstart-routes.png and /dev/null differ diff --git a/content/docs/img/quickstart/pz-starter-certificates.png b/content/docs/img/quickstart/pz-starter-certificates.png deleted file mode 100644 index cde97effa..000000000 Binary files a/content/docs/img/quickstart/pz-starter-certificates.png and /dev/null differ diff --git a/content/docs/img/quickstart/self-signed-warning.png b/content/docs/img/quickstart/self-signed-warning.png deleted file mode 100644 index 51371a8e6..000000000 Binary files a/content/docs/img/quickstart/self-signed-warning.png and /dev/null differ diff --git a/content/docs/img/quickstart/starter-domain.png b/content/docs/img/quickstart/starter-domain.png deleted file mode 100644 index 09bf53eb8..000000000 Binary files a/content/docs/img/quickstart/starter-domain.png and /dev/null differ diff --git a/content/docs/img/quickstart/zero-quickstart-connection.png b/content/docs/img/quickstart/zero-quickstart-connection.png deleted file mode 100644 index 6b4410396..000000000 Binary files a/content/docs/img/quickstart/zero-quickstart-connection.png and /dev/null differ diff --git a/content/docs/img/recovery-token.png b/content/docs/img/recovery-token.png deleted file mode 100644 index 17c97ad51..000000000 Binary files a/content/docs/img/recovery-token.png and /dev/null differ diff --git a/content/docs/img/troubleshooting/polling-delays/adjust-polling-delay-settings.gif b/content/docs/img/troubleshooting/polling-delays/adjust-polling-delay-settings.gif deleted file mode 100644 index e09cb1362..000000000 Binary files a/content/docs/img/troubleshooting/polling-delays/adjust-polling-delay-settings.gif and /dev/null differ diff --git a/content/docs/img/troubleshooting/polling-delays/last-error-and-request-duration.gif b/content/docs/img/troubleshooting/polling-delays/last-error-and-request-duration.gif deleted file mode 100644 index aad87c481..000000000 Binary files a/content/docs/img/troubleshooting/polling-delays/last-error-and-request-duration.gif and /dev/null differ diff --git a/content/docs/img/troubleshooting/self-signed-warning/pomerium-proceed-to-verify.png b/content/docs/img/troubleshooting/self-signed-warning/pomerium-proceed-to-verify.png deleted file mode 100644 index 9b049e8ff..000000000 Binary files a/content/docs/img/troubleshooting/self-signed-warning/pomerium-proceed-to-verify.png and /dev/null differ diff --git a/content/docs/index.mdx b/content/docs/index.mdx index 5e05cd3b1..46cb9633d 100644 --- a/content/docs/index.mdx +++ b/content/docs/index.mdx @@ -2,7 +2,7 @@ title: 'What is Pomerium?' lang: en-US hide_table_of_contents: true -sidebar_label: What is Pomerium? +sidebar_label: 'Overview' pagination_prev: null keywords: [ @@ -17,22 +17,72 @@ keywords: ] --- -import VideoCards from '@site/src/components/HomepageLayout/VideoCards.js'; - # What is Pomerium? -Pomerium builds secure, clientless connections to internal web apps and services without a corporate VPN. +Pomerium is an open source identity-aware proxy built around the principles of [BeyondCorp](https://research.google/pubs/pub43231) and [zero trust](https://www.nist.gov/publications/zero-trust-architecture). It secures your internal applications, servers, services, and workloads by continually verifying a user's **identity**, **device state**, and **request context** before granting access. + +Unlike VPN or tunnel-based approaches, Pomerium provides a scalable, modern alternative that centralizes access policy **without requiring client software**. + +Key benefits: + +- **Seamless, clientless access**: No corporate VPN to install or maintain. +- **Granular enforcement**: Every request is authenticated and authorized. +- **Extensible**: Works across multiple environments (cloud, on-prem, hybrid). +- **Open source**: Built on the BeyondCorp model. Transparent, with an active community. + +## How does it work? + +Pomerium intercepts and routes user traffic to protected services through an identity-aware access layer, ensuring every request is validated against your configured identity provider, policies, and device context. + +```mermaid +flowchart LR + subgraph Internet + U((User)) + end + + subgraph Identity + IdP((Identity Provider)) + end + + subgraph Pomerium + Proxy(Pomerium Proxy) + Policy(Policy Engine) + Proxy --> Policy + end + + subgraph Internal + S(Protected Service) + end + + U -->|Request Access| Proxy + Proxy -->|Authenticate| IdP + IdP -->|Return Claims| Proxy + Policy -->|Allow or Deny| Proxy + Proxy -->|Forward Request| S +``` + +In practice: + +1. **Authenticate**: Users sign in through your identity provider. +2. **Authorize**: Pomerium checks policies to decide who gets access. +3. **Proxy**: Traffic to internal apps flows through a secure, policy-enforced route. + +This approach simplifies managing access to internal services—no more network-level trust. Instead, trust is tied to identity, context, and a dynamic access policy. -Pomerium is: +## Why Pomerium? -- **Easier** because you don’t have to maintain a client or software. -- **Faster** because it’s deployed directly where your apps and services are. No more expensive data backhauling. -- **Safer** because every single action is verified for trusted identity, device, and context. +- **Streamlined**: No need to juggle separate VPN clients or network ACLs. +- **Future-proof**: Native zero trust posture that's ready for remote work, BYOD, or multi-cloud. +- **Fast**: Deploy where your apps run; no heavy routing or hardware dependencies. +- **Secure by default**: Continuous authentication and authorization ensures only valid requests get through. -It’s not a VPN alternative – it’s the trusted, foolproof way to protect your business. +## Community - +- **Get updates**: Join [pomerium-announce](https://groups.google.com/forum/#!forum/pomerium-announce) or follow us on [Twitter](https://twitter.com/pomerium_io). +- **Get help**: Visit [Discuss](https://discuss.pomerium.com/) for Q&A and best practices. +- **Report bugs**: Search [GitHub issues](https://github.com/pomerium/pomerium/issues) or open a new one if you don't see yours listed. +- **Suggest features**: Check for existing feature requests, then open a new issue if needed. -## Capabilities +## Next steps -For a full list of features, see the capabilities sidebar. +Ready to try it out? [Check out the Quick Start](/docs/get-started/quickstart) to spin up Pomerium and secure your first application. diff --git a/content/docs/integrations.mdx b/content/docs/integrations.mdx index 1eb220780..00b3641d0 100644 --- a/content/docs/integrations.mdx +++ b/content/docs/integrations.mdx @@ -7,7 +7,7 @@ slug: capabilities/integrations :::enterprise -This article describes a use case only available to [Pomerium Enterprise](/docs/enterprise) customers. +This article describes a use case only available to [Pomerium Enterprise](/docs/deploy/enterprise) customers. ::: @@ -104,7 +104,7 @@ To match against an IP address range, add a special `$index` key to your externa } ``` -See the [GeoIP Ranges](/docs/integrations/geoip) and [Well-Known IP Ranges](/docs/integrations/ip-ranges) guides for specific examples. +See the [GeoIP Ranges](/docs/integrations/request-context/geoip) and [Well-Known IP Ranges](/docs/integrations/request-context/ip-ranges) guides for specific examples. ### Headers @@ -126,4 +126,4 @@ If a job may not complete within the `min delay` period, it would be interrupted ### Client TLS Key -For data sources using mTLS, you can select a [client certificate](/docs/guides/certificates) (added under **Manage** → **Certificates**) to provide to the data source. +For data sources using mTLS, you can select a [client certificate](/docs/internals/certificates-and-tls) (added under **Manage** → **Certificates**) to provide to the data source. diff --git a/content/docs/integrations/device-context/_category_.json b/content/docs/integrations/device-context/_category_.json new file mode 100644 index 000000000..cd36c32b7 --- /dev/null +++ b/content/docs/integrations/device-context/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Device Context", + "position": 3 +} diff --git a/content/docs/concepts/device-identity.md b/content/docs/integrations/device-context/device-identity.mdx similarity index 81% rename from content/docs/concepts/device-identity.md rename to content/docs/integrations/device-context/device-identity.mdx index 84514df76..e169cf386 100644 --- a/content/docs/concepts/device-identity.md +++ b/content/docs/integrations/device-context/device-identity.mdx @@ -16,7 +16,10 @@ keywords: ] --- -A core component of Pomerium's zero trust security model is **device identity**, which is the ability for a device to have a unique, unclonable identity string that can be authenticated and factored into access control decisions. This topic page covers the concept of device identity, and how it applies to the zero trust model. To understand how Pomerium's device identity feature works, see our [documentation here](/docs/capabilities/device-identity). +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; + +A core component of Pomerium's zero trust security model is **device identity**, which is the ability for a device to have a unique, unclonable identity string that can be authenticated and factored into access control decisions. This topic page covers the concept of device identity, and how it applies to the zero trust model. To understand how Pomerium's device identity feature works, see our [documentation here](/docs/integrations/device-context/device-identity). ## Why Device Identity Is Important @@ -24,7 +27,7 @@ The history of IT security has, until recently, mostly focused on user identity Hardware-backed device identity is becoming more widely discussed as more products begin to implement or require it across all tech industries. For example, Windows 11 generated a lot of news by [requiring TPM 2.0][win11-reqs], and Apple is taking steps to [eliminate passwords][apple-passkeys] : -| ![Verge Article Header and Apple Video Page](./img/verge-apple.png) | +| ![Verge Article Header and Apple Video Page](./img/device-identity/verge-apple.png) | | :-- | | **Sources:**
- https://www.theverge.com/2021/6/25/22550376/microsoft-windows-11-tpm-chips-requirement-security
- https://developer.apple.com/videos/play/wwdc2021/10106 | @@ -62,17 +65,7 @@ The nature of cross-platform keys mean they are not associated with a single end ::: -## Looking Ahead: Device Posture - -Even if access is restricted to known devices, what happens when a user is found to have a vulnerable OS or browser version? How can an administrator ensure their network is not exposed, and that the user's system is promptly patched and remediated? As secure enclave technologies evolve, **device posture** -- which is sometimes referred to as device state -- will play an increasingly important role in not only authorization decisions but also in helping to quickly remediate vulnerable corporate devices. Device posture is a more complex superset of device identity, with more information about the device and software being used to generate the resulting identifier. - -Designing your security model to use device identity also primes your infrastructure to implement advanced security rules based on device posture down the road. - -**Read more about how device identity works with Pomerium:** - -- Incorporate [device identity](/docs/capabilities/device-identity) into your authorization policies with Pomerium Enterprise -- Learn about [device management](/docs/capabilities/authorization#manage-devices) with Pomerium -- [How Context Drives Full-Access Decision Making](https://www.pomerium.com/blog/context-drives-full-access-decision-making/) +Device identity is the unique ID associated with a device. In the context of zero trust, device identity can be used to authenticate and authorize users and to determine if a device can be trusted before granting a user access to a protected application or service. [android-keystore]: https://source.android.com/security/keystore [apple-enclave]: https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/web diff --git a/content/docs/integrations/fleetdm.mdx b/content/docs/integrations/device-context/fleetdm.mdx similarity index 94% rename from content/docs/integrations/fleetdm.mdx rename to content/docs/integrations/device-context/fleetdm.mdx index 943758077..5a43920c3 100644 --- a/content/docs/integrations/fleetdm.mdx +++ b/content/docs/integrations/device-context/fleetdm.mdx @@ -9,7 +9,7 @@ FleetDM provides an open-source, scalable device management (MDM) solution that The FleetDM integration with Pomerium Enterprise enables you to build policies in Pomerium that express Fleet conditions as Pomerium policy language (PPL). -When Pomerium receives a request from a Fleet-managed device, Pomerium will make an authorization decision based on the device’s state and the applied policy criteria. +When Pomerium receives a request from a Fleet-managed device, Pomerium will make an authorization decision based on the device's state and the applied policy criteria. ## Video Demo @@ -52,13 +52,13 @@ Pomerium Enterprise continuously syncs [host](https://fleetdm.com/docs/rest-api/ Pomerium provides a custom FleetDM criterion that points to records collected from the FleetDM plugin. -Custom FleetDM operators enable you to build policies that enforce Fleet conditions. Only [deny](/docs/capabilities/ppl#actions) actions are supported. +Custom FleetDM operators enable you to build policies that enforce Fleet conditions. Only [deny](/docs/internals/ppl#actions) actions are supported. Custom FleetDM operators include: | **Key name** | **Value type** | **Description** | | --- | --- | --- | -| `last_seen_over` | string | Denies access if a Fleet agent hasn’t updated host data in the specified time. | +| `last_seen_over` | string | Denies access if a Fleet agent hasn't updated host data in the specified time. | | `vulnerabilities` | array(string) | Denies access if a host is affected by a specific CVE. | | `failing_policies` | array(int) | Denies access if a host fails a specific Fleet policy. | | `failing_critical_policy` | boolean | Denies access if a host fails any critical Fleet policies. | @@ -70,8 +70,8 @@ This guide shows you how to configure FleetDM to work with the FleetDM plugin in To complete this guide, you need: -- [Pomerium Enterprise](https://www.pomerium.com/docs/enterprise) -- [Pomerium Core](https://www.pomerium.com/docs/core) +- [Pomerium Enterprise](https://www.pomerium.com/docs/deploy/enterprise) +- [Pomerium Core](https://www.pomerium.com/docs/deploy/core) - A deployed [Fleet instance](https://github.com/fleetdm/fleet/tree/main/infrastructure/render) - A configured certificate authority (CA) and client certificate - A test environment to install a Fleet agent @@ -133,7 +133,7 @@ To enroll a host, download the Fleet agent: ### Configure certificate query -Fleet agents provide a [certificates](https://fleetdm.com/tables/certificates) query that scans a device’s local key store for installed certificates. This query exposes certificates data, including the client certificate SHA-1 fingerprint installed on an enrolled host. +Fleet agents provide a [certificates](https://fleetdm.com/tables/certificates) query that scans a device's local key store for installed certificates. This query exposes certificates data, including the client certificate SHA-1 fingerprint installed on an enrolled host. To configure the certificate query, in the Fleet dashboard: @@ -282,4 +282,4 @@ Next, attach these policies to your route: ![Attaching policies to route](./img/fleet/enterprise-attach-policies.png) -Save your changes. When you access a Pomerium route with a Fleet-managed host, Pomerium will authorize access based on the host’s compliance to Fleet policies and vulnerability status. +Save your changes. When you access a Pomerium route with a Fleet-managed host, Pomerium will authorize access based on the host's compliance to Fleet policies and vulnerability status. diff --git a/content/docs/integrations/device-context/img/device-identity/verge-apple.png b/content/docs/integrations/device-context/img/device-identity/verge-apple.png new file mode 100644 index 000000000..806a77d8d Binary files /dev/null and b/content/docs/integrations/device-context/img/device-identity/verge-apple.png differ diff --git a/content/docs/integrations/device-context/img/fleet/enterprise-attach-policies.png b/content/docs/integrations/device-context/img/fleet/enterprise-attach-policies.png new file mode 100644 index 000000000..3b6d088e8 Binary files /dev/null and b/content/docs/integrations/device-context/img/fleet/enterprise-attach-policies.png differ diff --git a/content/docs/integrations/device-context/img/fleet/enterprise-fleet-ppl.png b/content/docs/integrations/device-context/img/fleet/enterprise-fleet-ppl.png new file mode 100644 index 000000000..25cd83f69 Binary files /dev/null and b/content/docs/integrations/device-context/img/fleet/enterprise-fleet-ppl.png differ diff --git a/content/docs/integrations/device-context/img/fleet/enterprise-import-cert.png b/content/docs/integrations/device-context/img/fleet/enterprise-import-cert.png new file mode 100644 index 000000000..8feeabb7f Binary files /dev/null and b/content/docs/integrations/device-context/img/fleet/enterprise-import-cert.png differ diff --git a/content/docs/integrations/device-context/img/fleet/enterprise-tls-setting.png b/content/docs/integrations/device-context/img/fleet/enterprise-tls-setting.png new file mode 100644 index 000000000..427022c63 Binary files /dev/null and b/content/docs/integrations/device-context/img/fleet/enterprise-tls-setting.png differ diff --git a/content/docs/integrations/device-context/img/fleet/enterprise-verify-service.png b/content/docs/integrations/device-context/img/fleet/enterprise-verify-service.png new file mode 100644 index 000000000..cef6261c8 Binary files /dev/null and b/content/docs/integrations/device-context/img/fleet/enterprise-verify-service.png differ diff --git a/content/docs/integrations/device-context/img/fleet/fleet-add-hosts.png b/content/docs/integrations/device-context/img/fleet/fleet-add-hosts.png new file mode 100644 index 000000000..28f9d397c Binary files /dev/null and b/content/docs/integrations/device-context/img/fleet/fleet-add-hosts.png differ diff --git a/content/docs/integrations/device-context/img/fleet/fleet-certificate-query.png b/content/docs/integrations/device-context/img/fleet/fleet-certificate-query.png new file mode 100644 index 000000000..3dc707001 Binary files /dev/null and b/content/docs/integrations/device-context/img/fleet/fleet-certificate-query.png differ diff --git a/content/docs/integrations/device-context/img/fleet/fleet-certs-query-dashboard.png b/content/docs/integrations/device-context/img/fleet/fleet-certs-query-dashboard.png new file mode 100644 index 000000000..eb14e87ca Binary files /dev/null and b/content/docs/integrations/device-context/img/fleet/fleet-certs-query-dashboard.png differ diff --git a/content/docs/integrations/device-context/img/fleet/fleet-dashboard.png b/content/docs/integrations/device-context/img/fleet/fleet-dashboard.png new file mode 100644 index 000000000..c1cd4c741 Binary files /dev/null and b/content/docs/integrations/device-context/img/fleet/fleet-dashboard.png differ diff --git a/content/docs/integrations/device-context/img/fleet/fleet-enrolled-host-vm.png b/content/docs/integrations/device-context/img/fleet/fleet-enrolled-host-vm.png new file mode 100644 index 000000000..d5ea9149d Binary files /dev/null and b/content/docs/integrations/device-context/img/fleet/fleet-enrolled-host-vm.png differ diff --git a/content/docs/integrations/device-context/img/fleet/fleet-policy.png b/content/docs/integrations/device-context/img/fleet/fleet-policy.png new file mode 100644 index 000000000..947acb9f8 Binary files /dev/null and b/content/docs/integrations/device-context/img/fleet/fleet-policy.png differ diff --git a/content/docs/integrations/device-context/img/fleet/ppl-vulnerability.png b/content/docs/integrations/device-context/img/fleet/ppl-vulnerability.png new file mode 100644 index 000000000..90418f4c5 Binary files /dev/null and b/content/docs/integrations/device-context/img/fleet/ppl-vulnerability.png differ diff --git a/content/docs/integrations/device-context/img/webauthn/450-error.png b/content/docs/integrations/device-context/img/webauthn/450-error.png new file mode 100644 index 000000000..461ce1f34 Binary files /dev/null and b/content/docs/integrations/device-context/img/webauthn/450-error.png differ diff --git a/content/docs/integrations/device-context/img/webauthn/admin-enroll-1.png b/content/docs/integrations/device-context/img/webauthn/admin-enroll-1.png new file mode 100644 index 000000000..4fafce68d Binary files /dev/null and b/content/docs/integrations/device-context/img/webauthn/admin-enroll-1.png differ diff --git a/content/docs/integrations/device-context/img/webauthn/device-credentials-empty-highlight.png b/content/docs/integrations/device-context/img/webauthn/device-credentials-empty-highlight.png new file mode 100644 index 000000000..7c9ee073c Binary files /dev/null and b/content/docs/integrations/device-context/img/webauthn/device-credentials-empty-highlight.png differ diff --git a/content/docs/integrations/device-context/img/webauthn/device-id-list.png b/content/docs/integrations/device-context/img/webauthn/device-id-list.png new file mode 100644 index 000000000..076935c1a Binary files /dev/null and b/content/docs/integrations/device-context/img/webauthn/device-id-list.png differ diff --git a/content/docs/integrations/device-context/img/webauthn/enrollment-created.png b/content/docs/integrations/device-context/img/webauthn/enrollment-created.png new file mode 100644 index 000000000..79bf4f642 Binary files /dev/null and b/content/docs/integrations/device-context/img/webauthn/enrollment-created.png differ diff --git a/content/docs/integrations/device-context/img/webauthn/new-enrollment.png b/content/docs/integrations/device-context/img/webauthn/new-enrollment.png new file mode 100644 index 000000000..4e7d2940b Binary files /dev/null and b/content/docs/integrations/device-context/img/webauthn/new-enrollment.png differ diff --git a/content/docs/integrations/device-context/img/webauthn/no-device.png b/content/docs/integrations/device-context/img/webauthn/no-device.png new file mode 100644 index 000000000..ab6b2963f Binary files /dev/null and b/content/docs/integrations/device-context/img/webauthn/no-device.png differ diff --git a/content/docs/integrations/device-context/img/webauthn/security-key-chromebook.png b/content/docs/integrations/device-context/img/webauthn/security-key-chromebook.png new file mode 100644 index 000000000..9fc450991 Binary files /dev/null and b/content/docs/integrations/device-context/img/webauthn/security-key-chromebook.png differ diff --git a/content/docs/integrations/device-context/img/webauthn/security-key-firefox.png b/content/docs/integrations/device-context/img/webauthn/security-key-firefox.png new file mode 100644 index 000000000..c7bda2c42 Binary files /dev/null and b/content/docs/integrations/device-context/img/webauthn/security-key-firefox.png differ diff --git a/content/docs/integrations/device-context/img/webauthn/security-key-google.png b/content/docs/integrations/device-context/img/webauthn/security-key-google.png new file mode 100644 index 000000000..eb80f81a2 Binary files /dev/null and b/content/docs/integrations/device-context/img/webauthn/security-key-google.png differ diff --git a/content/docs/integrations/device-context/img/webauthn/security-key-windows.png b/content/docs/integrations/device-context/img/webauthn/security-key-windows.png new file mode 100644 index 000000000..15d498eba Binary files /dev/null and b/content/docs/integrations/device-context/img/webauthn/security-key-windows.png differ diff --git a/content/docs/integrations/device-context/webauthn.mdx b/content/docs/integrations/device-context/webauthn.mdx new file mode 100644 index 000000000..eea9ea36e --- /dev/null +++ b/content/docs/integrations/device-context/webauthn.mdx @@ -0,0 +1,209 @@ +--- +title: 'WebAuthn Device Identity (Clientless, Zero-Trust Integration)' +description: "Use Pomerium's clientless, WebAuthn-based device identity to authenticate hardware- and TPM-backed devices for zero-trust security." +keywords: + [ + pomerium, + device identity, + clientless, + zero trust, + webauthn, + hardware security, + TPM, + enclaves, + passkeys, + ] +sidebar_label: WebAuthn +lang: en-US +--- + +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; + +# WebAuthn Device Identity + +Device identity links a cryptographically unique ID to each device, letting you enforce zero-trust principles by verifying _who_ a user is logging in as **and** _which device_ they're using. Pomerium uses [WebAuthn](https://www.w3.org/TR/webauthn-2/#registration-extension) to enable **clientless zero trust device identity**, so you can authenticate devices without requiring an agent or proprietary driver. + +- **Clientless**: No additional agent or client software needed. +- **Hardware & TPM-backed**: Ideal for strong hardware security modules like TPM, Secure Enclave, or YubiKey. +- **Open Standards**: Uses the W3C WebAuthn spec, bridging broad browser support with modern authentication. +- **Privacy-protecting**: Because WebAuthn is designed for user authentication, direct “device identity” is partially obfuscated, which can be both a feature (protecting user privacy) and a limitation (less direct correlation to a single OS/hardware setup). + + + +## Device Identity with Pomerium + +As of [Pomerium v0.16.0](/docs/deploy/upgrading.mdx#policy-for-device-identity) and higher, you can require [WebAuthn](https://www.w3.org/TR/webauthn-2) for device identity checks. This means: + +- Users can register their devices as a [trusted execution environment](/docs/integrations/device-context/device-identity#authenticated-device-types). +- Admins can configure policy restricting route access to _only_ devices that have been authenticated through WebAuthn. +- In **Enterprise**, enrollment can be self-service or admin-driven, with optional device approvals. + +> **Note**: Because WebAuthn is designed primarily for user/browser authentication, it has robust privacy protections. This can limit direct OS-level or hardware-level “fingerprinting.” While beneficial for end-user privacy, it means purely WebAuthn-based flows may not _always_ match a 1:1 device identity. Organizations needing deeper OS-level posture checks might consider separate or complementary solutions. + +## Comparing Device Enrollment Methods + +**Agent-based solutions** typically rely on proprietary software installed on each endpoint, providing full OS posture checks but increasing maintenance overhead. + +**Mobile device management (MDM)** offers wide insight and control but can be intrusive and complex. + +**WebAuthn** stands out for: + +- **Clientless Zero Trust**: No agent required; the browser implements WebAuthn. +- **Hardware & TPM**: Leverages built-in security keys (e.g., Windows Hello, YubiKey, Touch ID, TPM) for cryptographic assurance. +- **Open & Standardized**: Works across major browsers and platforms. +- **Privacy-Focused**: The user's real device hardware details are masked behind ephemeral keys, limiting tracking but also reducing direct device fingerprinting. + +As a result, WebAuthn-based device identity can be a sweet spot for many zero-trust deployments: strong security, minimal friction, wide compatibility. But it _is_ more “browser identity” than a fully OS-level solution. + +## Device Identity Features + +Pomerium **Core** and **Enterprise** support WebAuthn-based device identity. However, Enterprise provides additional management features: + +| Features (Enterprise) | WebAuthn Device Identity | +| --- | :-: | +| **Pre-approved device enrollment** | Admins can enroll a new device, generating a user-specific registration link. | +| **Device management** | View, approve, or delete devices in the Enterprise Console. | +| **User-initiated device enrollment** | Users can register their device if a route requires device identity. The device remains pending until approved. | + +| Features (Core) | Device Identity | +| --- | :-: | +| **User-initiated device enrollment** | Users can register and immediately access routes that require device identity (no approval flow). | + +## New Enrollment (Enterprise) + +Pomerium implements a **trust on first use** (TOFU) approach for device identity: + +- Admins generate a registration link for a specific user. +- When a user registers a device via the link, that device is automatically approved (TOFU). + +## Manage Devices (Enterprise) + +Administrators can track device status in the **Enterprise Console**. New devices begin as **Pending Enrollment** and become **Approved** upon successful registration. + +If a device is **Deleted**, it's effectively revoked. Any associated link becomes invalid. + +## Enroll Devices as an Administrator (Enterprise) + +In **Enterprise**, you can enforce policies that only allow routes to approved devices. (See [Device Matcher](/docs/internals/ppl#device-matcher).) + +The **Manage Devices** GUI lets you create enrollment links for directory-synced users. + +:::enterprise Ensure [directory sync](/docs/integrations/user-standing/directory-sync) is configured to populate user data. ::: + +**Steps**: + +1. In the Console sidebar, select **Devices**. +2. Click **NEW ENROLLMENT**: + + ![Enroll devices](./img/webauthn/admin-enroll-1.png) + +3. Fill out **New Enrollment**: + + - **Select Users**: A user from your directory (the link is only valid for them). + - **Route**: Choose a Pomerium route; your custom link will point here. + - **Redirect URL**: (Optional) A route to send users after enrollment. + - **Enrollment Type**: + - **Any**: Any WebAuthn-compatible device (hardware keys, OS biometrics). + - **Secure Enclave Only**: Limit registration to platform-based secure enclaves (e.g. iOS Secure Enclave, Windows Hello TPM). + + ![Select new enrollment](./img/webauthn/new-enrollment.png) + +4. Select **SUBMIT** to generate the enrollment link, then share it with the user: + + ![Enrollment created](./img/webauthn/enrollment-created.png) + +## Enroll Device as a User + +If a Pomerium route [requires device identity](/docs/internals/ppl#device-matcher), users will be prompted to register a device. This flow is similar in **Core** and **Enterprise** (though Enterprise can also allow admin pre-approval). + +1. When visiting a route requiring device identity, users see a device registration screen: + + ![The WebAuthn Registration page with no devices registered](img/webauthn/no-device.png) + +2. Users can also open the `.pomerium` endpoint for any route to access **Device Credentials**: + + ![Device Credentials in .pomerium endpoint](img/webauthn/device-credentials-empty-highlight.png) + +3. Select **Register New Device**. The browser prompts for hardware or biometric verification. The prompts vary by OS or browser: + + + + Windows device authentication prompt + + + Chrome device authentication prompt + + + Firefox device authentication prompt + + + Chrome OS device authentication prompt + + + +--- + +### Find the Device ID + +If a route policy specifically requires a certain device ID, you might see a `450 device not authorized` error even after registering: + +![450 device not authorized error screen](img/webauthn/450-error.png) + +From the `.pomerium` endpoint, you can copy your device ID and share it with your admin: + +![Device ID list at /.pomerium](img/webauthn/device-id-list.png) + +You can also remove any device you no longer want associated with your account. + +--- + +## Summary + +WebAuthn enables **clientless zero trust device identity** in Pomerium: + +- **No agent**: Achieve strong hardware-backed verification with standard browsers. +- **TPM/Enclave**: Tied to user gestures (PIN, biometric) or physical tokens (YubiKey). +- **Privacy-Focused**: WebAuthn conceals hardware details, limiting direct OS posture checks. +- **Enterprise**: Gain streamlined enrollment, approval, and device management in the Console. +- **Core**: Basic user-driven enrollment. + +With WebAuthn, you balance user privacy and security convenience while raising the trust level of your routes—an excellent fit for zero-trust approaches. + +## Related Links + +- [**WebAuthn specification**](https://www.w3.org/TR/webauthn-2) +- [**Trusted Platform Module (TPM)**](https://docs.microsoft.com/en-us/windows/security/information-protection/tpm/tpm-recommendations) +- [**Secure enclaves** and cross-platform keys](https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Platform_vs_Cross-Platform.html) +- [**Apple passkeys**](https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication/supporting_passkeys) +- [**FIDO Alliance** specs](https://fidoalliance.org/specifications/) +- [**Pomerium Device Concepts**](/docs/integrations/device-context/device-identity.mdx) + +[android-keystore]: https://source.android.com/security/keystore +[apple-enclave]: https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/web +[apple-passkeys]: https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication/supporting_passkeys +[fido-spec]: https://fidoalliance.org/specifications/ +[secure enclaves and cross-platform security keys]: https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Platform_vs_Cross-Platform.html +[toms-hardware-tpm]: https://www.tomshardware.com/reviews/tpm-trusted-platform-module-header,5766.html +[verge-tpm]: https://www.theverge.com/2021/6/25/22550376/microsoft-windows-11-tpm-chips-requirement-security +[webauthn-api]: https://www.w3.org/TR/webauthn-2/#registration-extension +[win11-reqs]: https://www.microsoft.com/en-us/windows/windows-11-specifications +[yubikey-products]: https://www.yubico.com/products/ diff --git a/content/docs/integrations/img/bamboohr-policy.png b/content/docs/integrations/img/bamboohr-policy.png deleted file mode 100644 index bafa8f2d0..000000000 Binary files a/content/docs/integrations/img/bamboohr-policy.png and /dev/null differ diff --git a/content/docs/integrations/img/external-data-gui.gif b/content/docs/integrations/img/external-data-gui.gif index d1d842942..827c2eee4 100644 Binary files a/content/docs/integrations/img/external-data-gui.gif and b/content/docs/integrations/img/external-data-gui.gif differ diff --git a/content/docs/integrations/img/fleet/enterprise-attach-policies.png b/content/docs/integrations/img/fleet/enterprise-attach-policies.png deleted file mode 100644 index b132b63f3..000000000 Binary files a/content/docs/integrations/img/fleet/enterprise-attach-policies.png and /dev/null differ diff --git a/content/docs/integrations/img/fleet/enterprise-fleet-ppl.png b/content/docs/integrations/img/fleet/enterprise-fleet-ppl.png deleted file mode 100644 index 66ad93617..000000000 Binary files a/content/docs/integrations/img/fleet/enterprise-fleet-ppl.png and /dev/null differ diff --git a/content/docs/integrations/img/fleet/enterprise-import-cert.png b/content/docs/integrations/img/fleet/enterprise-import-cert.png deleted file mode 100644 index f0fd4458c..000000000 Binary files a/content/docs/integrations/img/fleet/enterprise-import-cert.png and /dev/null differ diff --git a/content/docs/integrations/img/fleet/enterprise-tls-setting.png b/content/docs/integrations/img/fleet/enterprise-tls-setting.png deleted file mode 100644 index 055ad8f2a..000000000 Binary files a/content/docs/integrations/img/fleet/enterprise-tls-setting.png and /dev/null differ diff --git a/content/docs/integrations/img/fleet/enterprise-verify-service.png b/content/docs/integrations/img/fleet/enterprise-verify-service.png deleted file mode 100644 index 0f4ab56b5..000000000 Binary files a/content/docs/integrations/img/fleet/enterprise-verify-service.png and /dev/null differ diff --git a/content/docs/integrations/img/fleet/fleet-add-hosts.png b/content/docs/integrations/img/fleet/fleet-add-hosts.png deleted file mode 100644 index 9d2b681d9..000000000 Binary files a/content/docs/integrations/img/fleet/fleet-add-hosts.png and /dev/null differ diff --git a/content/docs/integrations/img/fleet/fleet-certificate-query.png b/content/docs/integrations/img/fleet/fleet-certificate-query.png deleted file mode 100644 index 78ff7e540..000000000 Binary files a/content/docs/integrations/img/fleet/fleet-certificate-query.png and /dev/null differ diff --git a/content/docs/integrations/img/fleet/fleet-certs-query-dashboard.png b/content/docs/integrations/img/fleet/fleet-certs-query-dashboard.png deleted file mode 100644 index b4dc122a5..000000000 Binary files a/content/docs/integrations/img/fleet/fleet-certs-query-dashboard.png and /dev/null differ diff --git a/content/docs/integrations/img/fleet/fleet-dashboard.png b/content/docs/integrations/img/fleet/fleet-dashboard.png deleted file mode 100644 index 82adbdc7a..000000000 Binary files a/content/docs/integrations/img/fleet/fleet-dashboard.png and /dev/null differ diff --git a/content/docs/integrations/img/fleet/fleet-enrolled-host-vm.png b/content/docs/integrations/img/fleet/fleet-enrolled-host-vm.png deleted file mode 100644 index 9812f4301..000000000 Binary files a/content/docs/integrations/img/fleet/fleet-enrolled-host-vm.png and /dev/null differ diff --git a/content/docs/integrations/img/fleet/fleet-policy.png b/content/docs/integrations/img/fleet/fleet-policy.png deleted file mode 100644 index 83f350ff0..000000000 Binary files a/content/docs/integrations/img/fleet/fleet-policy.png and /dev/null differ diff --git a/content/docs/integrations/img/fleet/ppl-vulnerability.png b/content/docs/integrations/img/fleet/ppl-vulnerability.png deleted file mode 100644 index 3afda0634..000000000 Binary files a/content/docs/integrations/img/fleet/ppl-vulnerability.png and /dev/null differ diff --git a/content/docs/integrations/img/geoip-policy.png b/content/docs/integrations/img/geoip-policy.png deleted file mode 100644 index 85e235c9e..000000000 Binary files a/content/docs/integrations/img/geoip-policy.png and /dev/null differ diff --git a/content/docs/integrations/img/tor-exit-node-policy.png b/content/docs/integrations/img/tor-exit-node-policy.png deleted file mode 100644 index c8ae33292..000000000 Binary files a/content/docs/integrations/img/tor-exit-node-policy.png and /dev/null differ diff --git a/content/docs/integrations/img/vpn-node-policy.png b/content/docs/integrations/img/vpn-node-policy.png deleted file mode 100644 index f106f8db0..000000000 Binary files a/content/docs/integrations/img/vpn-node-policy.png and /dev/null differ diff --git a/content/docs/integrations/img/well-known-ip-range-policy.png b/content/docs/integrations/img/well-known-ip-range-policy.png deleted file mode 100644 index 0f66313d7..000000000 Binary files a/content/docs/integrations/img/well-known-ip-range-policy.png and /dev/null differ diff --git a/content/docs/integrations/img/zenefits-policy.png b/content/docs/integrations/img/zenefits-policy.png deleted file mode 100644 index 34b7e69d2..000000000 Binary files a/content/docs/integrations/img/zenefits-policy.png and /dev/null differ diff --git a/content/docs/integrations/request-context/_category_.json b/content/docs/integrations/request-context/_category_.json new file mode 100644 index 000000000..29b47c55d --- /dev/null +++ b/content/docs/integrations/request-context/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Request Context", + "position": 4 +} diff --git a/content/docs/integrations/geoip.mdx b/content/docs/integrations/request-context/geoip.mdx similarity index 98% rename from content/docs/integrations/geoip.mdx rename to content/docs/integrations/request-context/geoip.mdx index b295d2336..59d333c66 100644 --- a/content/docs/integrations/geoip.mdx +++ b/content/docs/integrations/request-context/geoip.mdx @@ -112,7 +112,7 @@ An example policy to restrict access to IP addresses within the United States wo -![GeoIP Policy in the Builder view](./img/geoip-policy.png) +![GeoIP Policy in the Builder view](./img/geoip/geoip-policy.png) diff --git a/content/docs/integrations/request-context/img/geoip/geoip-policy.png b/content/docs/integrations/request-context/img/geoip/geoip-policy.png new file mode 100644 index 000000000..7edb139d5 Binary files /dev/null and b/content/docs/integrations/request-context/img/geoip/geoip-policy.png differ diff --git a/content/docs/integrations/request-context/img/ip-range/well-known-ip-range-policy.png b/content/docs/integrations/request-context/img/ip-range/well-known-ip-range-policy.png new file mode 100644 index 000000000..3acec94a6 Binary files /dev/null and b/content/docs/integrations/request-context/img/ip-range/well-known-ip-range-policy.png differ diff --git a/content/docs/integrations/request-context/img/tor/tor-exit-node-policy.png b/content/docs/integrations/request-context/img/tor/tor-exit-node-policy.png new file mode 100644 index 000000000..2f4f24f31 Binary files /dev/null and b/content/docs/integrations/request-context/img/tor/tor-exit-node-policy.png differ diff --git a/content/docs/integrations/request-context/img/vpn/vpn-node-policy.png b/content/docs/integrations/request-context/img/vpn/vpn-node-policy.png new file mode 100644 index 000000000..f302fc875 Binary files /dev/null and b/content/docs/integrations/request-context/img/vpn/vpn-node-policy.png differ diff --git a/content/docs/integrations/ip-ranges.mdx b/content/docs/integrations/request-context/ip-ranges.mdx similarity index 97% rename from content/docs/integrations/ip-ranges.mdx rename to content/docs/integrations/request-context/ip-ranges.mdx index db0d35310..18b97cbc1 100644 --- a/content/docs/integrations/ip-ranges.mdx +++ b/content/docs/integrations/request-context/ip-ranges.mdx @@ -110,7 +110,7 @@ A policy requiring a well known IP address would look something like this: -![WellKnownIPRange Policy in the Builder view](./img/well-known-ip-range-policy.png) +![WellKnownIPRange Policy in the Builder view](./img/ip-range/well-known-ip-range-policy.png) diff --git a/content/docs/integrations/tor-exit-nodes.mdx b/content/docs/integrations/request-context/tor-exit-nodes.mdx similarity index 94% rename from content/docs/integrations/tor-exit-nodes.mdx rename to content/docs/integrations/request-context/tor-exit-nodes.mdx index fd65c8224..d82afa708 100644 --- a/content/docs/integrations/tor-exit-nodes.mdx +++ b/content/docs/integrations/request-context/tor-exit-nodes.mdx @@ -32,7 +32,7 @@ A policy excluding exit nodes would look something like this: -![TorExitNode Policy in the Builder view](./img/tor-exit-node-policy.png) +![TorExitNode Policy in the Builder view](./img/tor/tor-exit-node-policy.png) diff --git a/content/docs/integrations/vpn-providers.mdx b/content/docs/integrations/request-context/vpn-providers.mdx similarity index 96% rename from content/docs/integrations/vpn-providers.mdx rename to content/docs/integrations/request-context/vpn-providers.mdx index a308a18f3..4a6a7572d 100644 --- a/content/docs/integrations/vpn-providers.mdx +++ b/content/docs/integrations/request-context/vpn-providers.mdx @@ -47,7 +47,7 @@ A policy excluding VPN nodes would look something like this: -![VPNNode Policy in the Builder view](./img/vpn-node-policy.png) +![VPNNode Policy in the Builder view](./img/vpn/vpn-node-policy.png) diff --git a/content/docs/integrations/user-identity/_category_.json b/content/docs/integrations/user-identity/_category_.json new file mode 100644 index 000000000..95d7ca3ca --- /dev/null +++ b/content/docs/integrations/user-identity/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "User Identity", + "position": 0 +} diff --git a/content/docs/identity-providers/apple.md b/content/docs/integrations/user-identity/apple.md similarity index 98% rename from content/docs/identity-providers/apple.md rename to content/docs/integrations/user-identity/apple.md index c0defe70d..e19e95683 100644 --- a/content/docs/identity-providers/apple.md +++ b/content/docs/integrations/user-identity/apple.md @@ -14,7 +14,7 @@ Integrate Apple as an identity provider with Pomerium using Apple's **Sign in wi To complete this guide: -- [Install Pomerium](/docs/zero/install) +- [Install Pomerium](/docs/get-started/quickstart) - Enroll in Apple's [Developer Program](https://apps.apple.com/us/app/wwdc/id640199958) :::caution diff --git a/content/docs/identity-providers/auth0.mdx b/content/docs/integrations/user-identity/auth0.mdx similarity index 98% rename from content/docs/identity-providers/auth0.mdx rename to content/docs/integrations/user-identity/auth0.mdx index cf3823290..a2b6aa72d 100644 --- a/content/docs/identity-providers/auth0.mdx +++ b/content/docs/integrations/user-identity/auth0.mdx @@ -9,7 +9,7 @@ pagination_next: null import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem'; -This page documents configuring an [Auth0] Web Application and Machine to Machine Application for Pomerium to read user data. It assumes you have already [installed Pomerium](/docs/zero/install). +This page documents configuring an [Auth0] Web Application and Machine to Machine Application for Pomerium to read user data. It assumes you have already [installed Pomerium](/docs/get-started/quickstart). :::caution diff --git a/content/docs/identity-providers/azure.mdx b/content/docs/integrations/user-identity/azure.mdx similarity index 97% rename from content/docs/identity-providers/azure.mdx rename to content/docs/integrations/user-identity/azure.mdx index c49cf99bd..89b2926c9 100644 --- a/content/docs/identity-providers/azure.mdx +++ b/content/docs/integrations/user-identity/azure.mdx @@ -35,7 +35,7 @@ While we do our best to keep our documentation up to date, changes to third-part To complete this guide, you must: -- Install [Pomerium](/docs/zero/install) +- Install [Pomerium](/docs/get-started/quickstart) - Create a free [Microsoft 365 administration account](https://www.microsoft.com/en-us/microsoft-365/business/office-365-administration) (or have admin privileges with an existing Microsoft 365 account) ## Access your Entra ID instance @@ -167,7 +167,7 @@ To authorize users based on their group membership, add a `group` claim to the i ### Apply custom claims to a policy -You can use the [Claim PPL criterion](/docs/capabilities/ppl#criteria) to factor in the `groups` value in your authorization policy. +You can use the [Claim PPL criterion](/docs/internals/ppl#criteria) to factor in the `groups` value in your authorization policy. For example: @@ -192,7 +192,7 @@ The **`groups`** claim contains group IDs, not group names. ### Directory Sync (Enterprise) -Entra ID uses the same Client ID and Client Secret used in [Pomerium Core](/docs/core). +Entra ID uses the same Client ID and Client Secret used in [Pomerium Core](/docs/deploy/core). ### Configure Pomerium Enterprise Console diff --git a/content/docs/identity-providers/cognito.mdx b/content/docs/integrations/user-identity/cognito.mdx similarity index 99% rename from content/docs/identity-providers/cognito.mdx rename to content/docs/integrations/user-identity/cognito.mdx index 97cc566c3..3f07d6542 100644 --- a/content/docs/identity-providers/cognito.mdx +++ b/content/docs/integrations/user-identity/cognito.mdx @@ -11,7 +11,7 @@ pagination_next: null import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem'; -This document describes the use of AWS Cognito as an identity provider with Pomerium. It assumes you have already [installed Pomerium](/docs/zero/install) +This document describes the use of AWS Cognito as an identity provider with Pomerium. It assumes you have already [installed Pomerium](/docs/get-started/quickstart) :::caution diff --git a/content/docs/identity-providers/github.mdx b/content/docs/integrations/user-identity/github.mdx similarity index 99% rename from content/docs/identity-providers/github.mdx rename to content/docs/integrations/user-identity/github.mdx index eedb5c69a..3dc2aa17e 100644 --- a/content/docs/identity-providers/github.mdx +++ b/content/docs/integrations/user-identity/github.mdx @@ -11,7 +11,7 @@ pagination_next: null import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem'; -This document describes the use of GitHub as an identity provider for Pomerium. It assumes you have already [installed Pomerium](/docs/zero/install). +This document describes the use of GitHub as an identity provider for Pomerium. It assumes you have already [installed Pomerium](/docs/get-started/quickstart). :::caution diff --git a/content/docs/identity-providers/gitlab.mdx b/content/docs/integrations/user-identity/gitlab.mdx similarity index 99% rename from content/docs/identity-providers/gitlab.mdx rename to content/docs/integrations/user-identity/gitlab.mdx index 7f9817044..355ffd52b 100644 --- a/content/docs/identity-providers/gitlab.mdx +++ b/content/docs/integrations/user-identity/gitlab.mdx @@ -9,7 +9,7 @@ pagination_next: null import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem'; -This document details how to use GitLab as an identity provider with Pomerium. It assumes you have already [installed Pomerium](/docs/zero/install). +This document details how to use GitLab as an identity provider with Pomerium. It assumes you have already [installed Pomerium](/docs/get-started/quickstart). :::caution diff --git a/content/docs/identity-providers/google.mdx b/content/docs/integrations/user-identity/google.mdx similarity index 98% rename from content/docs/identity-providers/google.mdx rename to content/docs/integrations/user-identity/google.mdx index 37f1fd849..39a1ef120 100644 --- a/content/docs/identity-providers/google.mdx +++ b/content/docs/integrations/user-identity/google.mdx @@ -96,7 +96,7 @@ Unfortunately, Google doesn't support getting groups data with a custom claim. T :::enterprise -See the [**Directory Sync**](/docs/capabilities/directory-sync) page for more information about syncing directory data in the Enterprise Console. +See the [**Directory Sync**](/docs/integrations/user-standing/directory-sync) page for more information about syncing directory data in the Enterprise Console. Or, [contact sales](https://www.pomerium.com/enterprise-sales/) if you want to learn more about Pomerium Enterprise. diff --git a/content/docs/identity-providers/index.mdx b/content/docs/integrations/user-identity/identity-providers.mdx similarity index 92% rename from content/docs/identity-providers/index.mdx rename to content/docs/integrations/user-identity/identity-providers.mdx index c16258691..9159b66ef 100644 --- a/content/docs/identity-providers/index.mdx +++ b/content/docs/integrations/user-identity/identity-providers.mdx @@ -36,14 +36,10 @@ See the guides in this section for specific steps to integrate your IdP with Pom :::tip -If you want to try out Pomerium without configuring an IdP, you can use our [Hosted Authenticate Service](/docs/capabilities/hosted-authenticate-service) instead. +If you want to try out Pomerium without configuring an IdP, you can use our [Hosted Authenticate Service](/docs/capabilities/authentication) instead. ::: -## Identity provider guides - - - [client id]: /docs/reference/identity-provider-settings#identity-provider-client-id [client secret]: /docs/reference/identity-provider-settings#identity-provider-client-secret [environmental variables]: https://en.wikipedia.org/wiki/Environment_variable diff --git a/content/docs/integrations/user-identity/img/apple/apple-download-key.png b/content/docs/integrations/user-identity/img/apple/apple-download-key.png new file mode 100644 index 000000000..768c2f56a Binary files /dev/null and b/content/docs/integrations/user-identity/img/apple/apple-download-key.png differ diff --git a/content/docs/integrations/user-identity/img/apple/apple-register-app.png b/content/docs/integrations/user-identity/img/apple/apple-register-app.png new file mode 100644 index 000000000..c1eb27719 Binary files /dev/null and b/content/docs/integrations/user-identity/img/apple/apple-register-app.png differ diff --git a/content/docs/integrations/user-identity/img/apple/apple-register-new-key.png b/content/docs/integrations/user-identity/img/apple/apple-register-new-key.png new file mode 100644 index 000000000..37e62f7ef Binary files /dev/null and b/content/docs/integrations/user-identity/img/apple/apple-register-new-key.png differ diff --git a/content/docs/integrations/user-identity/img/apple/apple-sign-in-prompt.png b/content/docs/integrations/user-identity/img/apple/apple-sign-in-prompt.png new file mode 100644 index 000000000..23ab611f9 Binary files /dev/null and b/content/docs/integrations/user-identity/img/apple/apple-sign-in-prompt.png differ diff --git a/content/docs/integrations/user-identity/img/apple/apple-web-authn-config.png b/content/docs/integrations/user-identity/img/apple/apple-web-authn-config.png new file mode 100644 index 000000000..535538de8 Binary files /dev/null and b/content/docs/integrations/user-identity/img/apple/apple-web-authn-config.png differ diff --git a/content/docs/integrations/user-identity/img/auth0/action.png b/content/docs/integrations/user-identity/img/auth0/action.png new file mode 100644 index 000000000..b36f38585 Binary files /dev/null and b/content/docs/integrations/user-identity/img/auth0/action.png differ diff --git a/content/docs/integrations/user-identity/img/auth0/auth0-idp.png b/content/docs/integrations/user-identity/img/auth0/auth0-idp.png new file mode 100644 index 000000000..c8bd888f0 Binary files /dev/null and b/content/docs/integrations/user-identity/img/auth0/auth0-idp.png differ diff --git a/content/docs/integrations/user-identity/img/auth0/create-m2m.png b/content/docs/integrations/user-identity/img/auth0/create-m2m.png new file mode 100644 index 000000000..45aa27894 Binary files /dev/null and b/content/docs/integrations/user-identity/img/auth0/create-m2m.png differ diff --git a/content/docs/integrations/user-identity/img/auth0/create.png b/content/docs/integrations/user-identity/img/auth0/create.png new file mode 100644 index 000000000..3fe2339ef Binary files /dev/null and b/content/docs/integrations/user-identity/img/auth0/create.png differ diff --git a/content/docs/integrations/user-identity/img/auth0/dashboard.png b/content/docs/integrations/user-identity/img/auth0/dashboard.png new file mode 100644 index 000000000..4f469a3bd Binary files /dev/null and b/content/docs/integrations/user-identity/img/auth0/dashboard.png differ diff --git a/content/docs/integrations/user-identity/img/auth0/flow.png b/content/docs/integrations/user-identity/img/auth0/flow.png new file mode 100644 index 000000000..cc5618a07 Binary files /dev/null and b/content/docs/integrations/user-identity/img/auth0/flow.png differ diff --git a/content/docs/integrations/user-identity/img/auth0/m2m-scopes.png b/content/docs/integrations/user-identity/img/auth0/m2m-scopes.png new file mode 100644 index 000000000..669285123 Binary files /dev/null and b/content/docs/integrations/user-identity/img/auth0/m2m-scopes.png differ diff --git a/content/docs/integrations/user-identity/img/cognito/cognito-app-client-create.png b/content/docs/integrations/user-identity/img/cognito/cognito-app-client-create.png new file mode 100644 index 000000000..8cdb43e97 Binary files /dev/null and b/content/docs/integrations/user-identity/img/cognito/cognito-app-client-create.png differ diff --git a/content/docs/identity-providers/img/cognito/cognito-app-client-details.png b/content/docs/integrations/user-identity/img/cognito/cognito-app-client-details.png similarity index 100% rename from content/docs/identity-providers/img/cognito/cognito-app-client-details.png rename to content/docs/integrations/user-identity/img/cognito/cognito-app-client-details.png diff --git a/content/docs/identity-providers/img/cognito/cognito-create-pool.png b/content/docs/integrations/user-identity/img/cognito/cognito-create-pool.png similarity index 100% rename from content/docs/identity-providers/img/cognito/cognito-create-pool.png rename to content/docs/integrations/user-identity/img/cognito/cognito-create-pool.png diff --git a/content/docs/integrations/user-identity/img/cognito/cognito-domain-name.png b/content/docs/integrations/user-identity/img/cognito/cognito-domain-name.png new file mode 100644 index 000000000..c2789e1bd Binary files /dev/null and b/content/docs/integrations/user-identity/img/cognito/cognito-domain-name.png differ diff --git a/content/docs/integrations/user-identity/img/cognito/cognito-group-claim.png b/content/docs/integrations/user-identity/img/cognito/cognito-group-claim.png new file mode 100644 index 000000000..65f35eff3 Binary files /dev/null and b/content/docs/integrations/user-identity/img/cognito/cognito-group-claim.png differ diff --git a/content/docs/identity-providers/img/cognito/cognito-pool-settings.png b/content/docs/integrations/user-identity/img/cognito/cognito-pool-settings.png similarity index 100% rename from content/docs/identity-providers/img/cognito/cognito-pool-settings.png rename to content/docs/integrations/user-identity/img/cognito/cognito-pool-settings.png diff --git a/content/docs/identity-providers/img/cognito/cognito-pools.png b/content/docs/integrations/user-identity/img/cognito/cognito-pools.png similarity index 100% rename from content/docs/identity-providers/img/cognito/cognito-pools.png rename to content/docs/integrations/user-identity/img/cognito/cognito-pools.png diff --git a/content/docs/identity-providers/img/cognito/cognito-service.png b/content/docs/integrations/user-identity/img/cognito/cognito-service.png similarity index 100% rename from content/docs/identity-providers/img/cognito/cognito-service.png rename to content/docs/integrations/user-identity/img/cognito/cognito-service.png diff --git a/content/docs/identity-providers/img/cognito/cognito-side-menu.png b/content/docs/integrations/user-identity/img/cognito/cognito-side-menu.png similarity index 100% rename from content/docs/identity-providers/img/cognito/cognito-side-menu.png rename to content/docs/integrations/user-identity/img/cognito/cognito-side-menu.png diff --git a/content/docs/identity-providers/img/cognito/cognito-user-pool-name.png b/content/docs/integrations/user-identity/img/cognito/cognito-user-pool-name.png similarity index 100% rename from content/docs/identity-providers/img/cognito/cognito-user-pool-name.png rename to content/docs/integrations/user-identity/img/cognito/cognito-user-pool-name.png diff --git a/content/docs/integrations/user-identity/img/entra/azure-idp.png b/content/docs/integrations/user-identity/img/entra/azure-idp.png new file mode 100644 index 000000000..8824f4c52 Binary files /dev/null and b/content/docs/integrations/user-identity/img/entra/azure-idp.png differ diff --git a/content/docs/integrations/user-identity/img/entra/entra-add-app.png b/content/docs/integrations/user-identity/img/entra/entra-add-app.png new file mode 100644 index 000000000..0928a56a9 Binary files /dev/null and b/content/docs/integrations/user-identity/img/entra/entra-add-app.png differ diff --git a/content/docs/integrations/user-identity/img/entra/entra-api-permissions.png b/content/docs/integrations/user-identity/img/entra/entra-api-permissions.png new file mode 100644 index 000000000..48b893372 Binary files /dev/null and b/content/docs/integrations/user-identity/img/entra/entra-api-permissions.png differ diff --git a/content/docs/integrations/user-identity/img/entra/entra-app-secret-client-id.png b/content/docs/integrations/user-identity/img/entra/entra-app-secret-client-id.png new file mode 100644 index 000000000..259f5c041 Binary files /dev/null and b/content/docs/integrations/user-identity/img/entra/entra-app-secret-client-id.png differ diff --git a/content/docs/integrations/user-identity/img/entra/entra-client-secret-value.png b/content/docs/integrations/user-identity/img/entra/entra-client-secret-value.png new file mode 100644 index 000000000..b29d69725 Binary files /dev/null and b/content/docs/integrations/user-identity/img/entra/entra-client-secret-value.png differ diff --git a/content/docs/integrations/user-identity/img/entra/entra-create-client-secret.png b/content/docs/integrations/user-identity/img/entra/entra-create-client-secret.png new file mode 100644 index 000000000..29786f5cb Binary files /dev/null and b/content/docs/integrations/user-identity/img/entra/entra-create-client-secret.png differ diff --git a/content/docs/integrations/user-identity/img/entra/entra-edit-groups-claim.png b/content/docs/integrations/user-identity/img/entra/entra-edit-groups-claim.png new file mode 100644 index 000000000..2dd78ec6c Binary files /dev/null and b/content/docs/integrations/user-identity/img/entra/entra-edit-groups-claim.png differ diff --git a/content/docs/integrations/user-identity/img/entra/entra-endpoint-metadata.png b/content/docs/integrations/user-identity/img/entra/entra-endpoint-metadata.png new file mode 100644 index 000000000..85c9cc3a6 Binary files /dev/null and b/content/docs/integrations/user-identity/img/entra/entra-endpoint-metadata.png differ diff --git a/content/docs/integrations/user-identity/img/entra/entra-endpoints-tab.png b/content/docs/integrations/user-identity/img/entra/entra-endpoints-tab.png new file mode 100644 index 000000000..1d101dee4 Binary files /dev/null and b/content/docs/integrations/user-identity/img/entra/entra-endpoints-tab.png differ diff --git a/content/docs/integrations/user-identity/img/entra/entra-instance.png b/content/docs/integrations/user-identity/img/entra/entra-instance.png new file mode 100644 index 000000000..b40fe1d80 Binary files /dev/null and b/content/docs/integrations/user-identity/img/entra/entra-instance.png differ diff --git a/content/docs/integrations/user-identity/img/entra/entra-register-app.png b/content/docs/integrations/user-identity/img/entra/entra-register-app.png new file mode 100644 index 000000000..ea70ef294 Binary files /dev/null and b/content/docs/integrations/user-identity/img/entra/entra-register-app.png differ diff --git a/content/docs/integrations/user-identity/img/entra/entra-token-configuration.png b/content/docs/integrations/user-identity/img/entra/entra-token-configuration.png new file mode 100644 index 000000000..90d0030d1 Binary files /dev/null and b/content/docs/integrations/user-identity/img/entra/entra-token-configuration.png differ diff --git a/content/docs/integrations/user-identity/img/github/github-idp.png b/content/docs/integrations/user-identity/img/github/github-idp.png new file mode 100644 index 000000000..d58986a16 Binary files /dev/null and b/content/docs/integrations/user-identity/img/github/github-idp.png differ diff --git a/content/docs/integrations/user-identity/img/github/github-oauth-creation.png b/content/docs/integrations/user-identity/img/github/github-oauth-creation.png new file mode 100644 index 000000000..5a4d3d3e5 Binary files /dev/null and b/content/docs/integrations/user-identity/img/github/github-oauth-creation.png differ diff --git a/content/docs/integrations/user-identity/img/github/github-personal-access-token.png b/content/docs/integrations/user-identity/img/github/github-personal-access-token.png new file mode 100644 index 000000000..16427485b Binary files /dev/null and b/content/docs/integrations/user-identity/img/github/github-personal-access-token.png differ diff --git a/content/docs/integrations/user-identity/img/github/github-signon-page.png b/content/docs/integrations/user-identity/img/github/github-signon-page.png new file mode 100644 index 000000000..7ca9de5e0 Binary files /dev/null and b/content/docs/integrations/user-identity/img/github/github-signon-page.png differ diff --git a/content/docs/integrations/user-identity/img/gitlab/gitlab-create-applications.png b/content/docs/integrations/user-identity/img/gitlab/gitlab-create-applications.png new file mode 100644 index 000000000..c5cc940f9 Binary files /dev/null and b/content/docs/integrations/user-identity/img/gitlab/gitlab-create-applications.png differ diff --git a/content/docs/integrations/user-identity/img/gitlab/gitlab-credentials.png b/content/docs/integrations/user-identity/img/gitlab/gitlab-credentials.png new file mode 100644 index 000000000..c83c5ac62 Binary files /dev/null and b/content/docs/integrations/user-identity/img/gitlab/gitlab-credentials.png differ diff --git a/content/docs/integrations/user-identity/img/gitlab/gitlab-idp.png b/content/docs/integrations/user-identity/img/gitlab/gitlab-idp.png new file mode 100644 index 000000000..6917d4650 Binary files /dev/null and b/content/docs/integrations/user-identity/img/gitlab/gitlab-idp.png differ diff --git a/content/docs/integrations/user-identity/img/gitlab/gitlab-personal-access-token.png b/content/docs/integrations/user-identity/img/gitlab/gitlab-personal-access-token.png new file mode 100644 index 000000000..d473ed31b Binary files /dev/null and b/content/docs/integrations/user-identity/img/gitlab/gitlab-personal-access-token.png differ diff --git a/content/docs/integrations/user-identity/img/gitlab/gitlab-verify-access.png b/content/docs/integrations/user-identity/img/gitlab/gitlab-verify-access.png new file mode 100644 index 000000000..33d22b7b3 Binary files /dev/null and b/content/docs/integrations/user-identity/img/gitlab/gitlab-verify-access.png differ diff --git a/content/docs/integrations/user-identity/img/google/google-create-client-id-config.png b/content/docs/integrations/user-identity/img/google/google-create-client-id-config.png new file mode 100644 index 000000000..ef1ca6384 Binary files /dev/null and b/content/docs/integrations/user-identity/img/google/google-create-client-id-config.png differ diff --git a/content/docs/identity-providers/img/google/google-credentials.png b/content/docs/integrations/user-identity/img/google/google-credentials.png similarity index 100% rename from content/docs/identity-providers/img/google/google-credentials.png rename to content/docs/integrations/user-identity/img/google/google-credentials.png diff --git a/content/docs/integrations/user-identity/img/google/google-gsuite-add-scopes.png b/content/docs/integrations/user-identity/img/google/google-gsuite-add-scopes.png new file mode 100644 index 000000000..fd4c1e980 Binary files /dev/null and b/content/docs/integrations/user-identity/img/google/google-gsuite-add-scopes.png differ diff --git a/content/docs/integrations/user-identity/img/google/google-idp-console-settings.png b/content/docs/integrations/user-identity/img/google/google-idp-console-settings.png new file mode 100644 index 000000000..2e81dc41e Binary files /dev/null and b/content/docs/integrations/user-identity/img/google/google-idp-console-settings.png differ diff --git a/content/docs/integrations/user-identity/img/google/google-oauth-client-id-secret.png b/content/docs/integrations/user-identity/img/google/google-oauth-client-id-secret.png new file mode 100644 index 000000000..aa9480780 Binary files /dev/null and b/content/docs/integrations/user-identity/img/google/google-oauth-client-id-secret.png differ diff --git a/content/docs/integrations/user-identity/img/google/google-service-account-create-key.png b/content/docs/integrations/user-identity/img/google/google-service-account-create-key.png new file mode 100644 index 000000000..fa12caa0d Binary files /dev/null and b/content/docs/integrations/user-identity/img/google/google-service-account-create-key.png differ diff --git a/content/docs/integrations/user-identity/img/keycloak/keycloak-access-settings.png b/content/docs/integrations/user-identity/img/keycloak/keycloak-access-settings.png new file mode 100644 index 000000000..4894d8de3 Binary files /dev/null and b/content/docs/integrations/user-identity/img/keycloak/keycloak-access-settings.png differ diff --git a/content/docs/integrations/user-identity/img/keycloak/keycloak-admin-console.png b/content/docs/integrations/user-identity/img/keycloak/keycloak-admin-console.png new file mode 100644 index 000000000..3d36de0ce Binary files /dev/null and b/content/docs/integrations/user-identity/img/keycloak/keycloak-admin-console.png differ diff --git a/content/docs/integrations/user-identity/img/keycloak/keycloak-capability-config.png b/content/docs/integrations/user-identity/img/keycloak/keycloak-capability-config.png new file mode 100644 index 000000000..47c6f5e07 Binary files /dev/null and b/content/docs/integrations/user-identity/img/keycloak/keycloak-capability-config.png differ diff --git a/content/docs/integrations/user-identity/img/keycloak/keycloak-client-credentials.png b/content/docs/integrations/user-identity/img/keycloak/keycloak-client-credentials.png new file mode 100644 index 000000000..ab88c91bb Binary files /dev/null and b/content/docs/integrations/user-identity/img/keycloak/keycloak-client-credentials.png differ diff --git a/content/docs/integrations/user-identity/img/keycloak/keycloak-client-general-settings.png b/content/docs/integrations/user-identity/img/keycloak/keycloak-client-general-settings.png new file mode 100644 index 000000000..d7ade8f0e Binary files /dev/null and b/content/docs/integrations/user-identity/img/keycloak/keycloak-client-general-settings.png differ diff --git a/content/docs/integrations/user-identity/img/keycloak/keycloak-create-a-user.gif b/content/docs/integrations/user-identity/img/keycloak/keycloak-create-a-user.gif new file mode 100644 index 000000000..16692d9e6 Binary files /dev/null and b/content/docs/integrations/user-identity/img/keycloak/keycloak-create-a-user.gif differ diff --git a/content/docs/integrations/user-identity/img/keycloak/keycloak-create-client.gif b/content/docs/integrations/user-identity/img/keycloak/keycloak-create-client.gif new file mode 100644 index 000000000..54017419b Binary files /dev/null and b/content/docs/integrations/user-identity/img/keycloak/keycloak-create-client.gif differ diff --git a/content/docs/integrations/user-identity/img/keycloak/keycloak-login.png b/content/docs/integrations/user-identity/img/keycloak/keycloak-login.png new file mode 100644 index 000000000..1df96128d Binary files /dev/null and b/content/docs/integrations/user-identity/img/keycloak/keycloak-login.png differ diff --git a/content/docs/integrations/user-identity/img/keycloak/keycloak-realm.gif b/content/docs/integrations/user-identity/img/keycloak/keycloak-realm.gif new file mode 100644 index 000000000..ff1aad67a Binary files /dev/null and b/content/docs/integrations/user-identity/img/keycloak/keycloak-realm.gif differ diff --git a/content/docs/integrations/user-identity/img/keycloak/keycloak-set-password.png b/content/docs/integrations/user-identity/img/keycloak/keycloak-set-password.png new file mode 100644 index 000000000..080f9e75a Binary files /dev/null and b/content/docs/integrations/user-identity/img/keycloak/keycloak-set-password.png differ diff --git a/content/docs/integrations/user-identity/img/keycloak/keycloak-verify-app.png b/content/docs/integrations/user-identity/img/keycloak/keycloak-verify-app.png new file mode 100644 index 000000000..d02f8aa45 Binary files /dev/null and b/content/docs/integrations/user-identity/img/keycloak/keycloak-verify-app.png differ diff --git a/content/docs/identity-providers/img/okta/okta-api-token.png b/content/docs/integrations/user-identity/img/okta/okta-api-token.png similarity index 100% rename from content/docs/identity-providers/img/okta/okta-api-token.png rename to content/docs/integrations/user-identity/img/okta/okta-api-token.png diff --git a/content/docs/identity-providers/img/okta/okta-app-dashboard.png b/content/docs/integrations/user-identity/img/okta/okta-app-dashboard.png similarity index 100% rename from content/docs/identity-providers/img/okta/okta-app-dashboard.png rename to content/docs/integrations/user-identity/img/okta/okta-app-dashboard.png diff --git a/content/docs/identity-providers/img/okta/okta-app-settings.png b/content/docs/integrations/user-identity/img/okta/okta-app-settings.png similarity index 100% rename from content/docs/identity-providers/img/okta/okta-app-settings.png rename to content/docs/integrations/user-identity/img/okta/okta-app-settings.png diff --git a/content/docs/integrations/user-identity/img/okta/okta-authorization-servers.png b/content/docs/integrations/user-identity/img/okta/okta-authorization-servers.png new file mode 100644 index 000000000..d766e8275 Binary files /dev/null and b/content/docs/integrations/user-identity/img/okta/okta-authorization-servers.png differ diff --git a/content/docs/identity-providers/img/okta/okta-client-id-and-secret.png b/content/docs/integrations/user-identity/img/okta/okta-client-id-and-secret.png similarity index 100% rename from content/docs/identity-providers/img/okta/okta-client-id-and-secret.png rename to content/docs/integrations/user-identity/img/okta/okta-client-id-and-secret.png diff --git a/content/docs/identity-providers/img/okta/okta-create-app-settings.png b/content/docs/integrations/user-identity/img/okta/okta-create-app-settings.png similarity index 100% rename from content/docs/identity-providers/img/okta/okta-create-app-settings.png rename to content/docs/integrations/user-identity/img/okta/okta-create-app-settings.png diff --git a/content/docs/integrations/user-identity/img/okta/okta-idp.png b/content/docs/integrations/user-identity/img/okta/okta-idp.png new file mode 100644 index 000000000..5d4057ea7 Binary files /dev/null and b/content/docs/integrations/user-identity/img/okta/okta-idp.png differ diff --git a/content/docs/integrations/user-identity/img/onelogin/one-login-add-app.png b/content/docs/integrations/user-identity/img/onelogin/one-login-add-app.png new file mode 100644 index 000000000..50b767803 Binary files /dev/null and b/content/docs/integrations/user-identity/img/onelogin/one-login-add-app.png differ diff --git a/content/docs/integrations/user-identity/img/onelogin/one-login-add-open-id.png b/content/docs/integrations/user-identity/img/onelogin/one-login-add-open-id.png new file mode 100644 index 000000000..587e73c0b Binary files /dev/null and b/content/docs/integrations/user-identity/img/onelogin/one-login-add-open-id.png differ diff --git a/content/docs/integrations/user-identity/img/onelogin/one-login-api-access.png b/content/docs/integrations/user-identity/img/onelogin/one-login-api-access.png new file mode 100644 index 000000000..74db54ba8 Binary files /dev/null and b/content/docs/integrations/user-identity/img/onelogin/one-login-api-access.png differ diff --git a/content/docs/integrations/user-identity/img/onelogin/one-login-app-access.png b/content/docs/integrations/user-identity/img/onelogin/one-login-app-access.png new file mode 100644 index 000000000..08187c2bb Binary files /dev/null and b/content/docs/integrations/user-identity/img/onelogin/one-login-app-access.png differ diff --git a/content/docs/integrations/user-identity/img/onelogin/one-login-callback-url.png b/content/docs/integrations/user-identity/img/onelogin/one-login-callback-url.png new file mode 100644 index 000000000..f214ba74f Binary files /dev/null and b/content/docs/integrations/user-identity/img/onelogin/one-login-callback-url.png differ diff --git a/content/docs/integrations/user-identity/img/onelogin/one-login-events.png b/content/docs/integrations/user-identity/img/onelogin/one-login-events.png new file mode 100644 index 000000000..eb89dfed2 Binary files /dev/null and b/content/docs/integrations/user-identity/img/onelogin/one-login-events.png differ diff --git a/content/docs/integrations/user-identity/img/onelogin/one-login-idp.png b/content/docs/integrations/user-identity/img/onelogin/one-login-idp.png new file mode 100644 index 000000000..6cda3a2db Binary files /dev/null and b/content/docs/integrations/user-identity/img/onelogin/one-login-idp.png differ diff --git a/content/docs/integrations/user-identity/img/onelogin/one-login-select-logo.png b/content/docs/integrations/user-identity/img/onelogin/one-login-select-logo.png new file mode 100644 index 000000000..0ea70e21d Binary files /dev/null and b/content/docs/integrations/user-identity/img/onelogin/one-login-select-logo.png differ diff --git a/content/docs/integrations/user-identity/img/onelogin/one-login-sso-settings.png b/content/docs/integrations/user-identity/img/onelogin/one-login-sso-settings.png new file mode 100644 index 000000000..f9171e6a9 Binary files /dev/null and b/content/docs/integrations/user-identity/img/onelogin/one-login-sso-settings.png differ diff --git a/content/docs/integrations/user-identity/img/ping/ping-add-groups-attribute.png b/content/docs/integrations/user-identity/img/ping/ping-add-groups-attribute.png new file mode 100644 index 000000000..6e7a740ea Binary files /dev/null and b/content/docs/integrations/user-identity/img/ping/ping-add-groups-attribute.png differ diff --git a/content/docs/integrations/user-identity/img/ping/ping-add-oidc-web-app.png b/content/docs/integrations/user-identity/img/ping/ping-add-oidc-web-app.png new file mode 100644 index 000000000..59a0d8e94 Binary files /dev/null and b/content/docs/integrations/user-identity/img/ping/ping-add-oidc-web-app.png differ diff --git a/content/docs/integrations/user-identity/img/ping/ping-attribute-settings.png b/content/docs/integrations/user-identity/img/ping/ping-attribute-settings.png new file mode 100644 index 000000000..70180e51c Binary files /dev/null and b/content/docs/integrations/user-identity/img/ping/ping-attribute-settings.png differ diff --git a/content/docs/integrations/user-identity/img/ping/ping-enable-app.png b/content/docs/integrations/user-identity/img/ping/ping-enable-app.png new file mode 100644 index 000000000..6d3761d7d Binary files /dev/null and b/content/docs/integrations/user-identity/img/ping/ping-enable-app.png differ diff --git a/content/docs/integrations/user-identity/img/ping/ping-enterprise-idp-config.png b/content/docs/integrations/user-identity/img/ping/ping-enterprise-idp-config.png new file mode 100644 index 000000000..422273299 Binary files /dev/null and b/content/docs/integrations/user-identity/img/ping/ping-enterprise-idp-config.png differ diff --git a/content/docs/integrations/user-identity/img/ping/ping-redirect-uri.png b/content/docs/integrations/user-identity/img/ping/ping-redirect-uri.png new file mode 100644 index 000000000..a448c13cc Binary files /dev/null and b/content/docs/integrations/user-identity/img/ping/ping-redirect-uri.png differ diff --git a/content/docs/integrations/user-identity/img/ping/ping-worker-app.png b/content/docs/integrations/user-identity/img/ping/ping-worker-app.png new file mode 100644 index 000000000..3454a3918 Binary files /dev/null and b/content/docs/integrations/user-identity/img/ping/ping-worker-app.png differ diff --git a/content/docs/integrations/user-identity/img/ping/ping-zero-idp-config.png b/content/docs/integrations/user-identity/img/ping/ping-zero-idp-config.png new file mode 100644 index 000000000..6c784e304 Binary files /dev/null and b/content/docs/integrations/user-identity/img/ping/ping-zero-idp-config.png differ diff --git a/content/docs/integrations/user-identity/keycloak.mdx b/content/docs/integrations/user-identity/keycloak.mdx new file mode 100644 index 000000000..50c4f687f --- /dev/null +++ b/content/docs/integrations/user-identity/keycloak.mdx @@ -0,0 +1,152 @@ +--- +id: oidc +title: 'Keycloak + Pomerium: Configuring an Identity-Aware Proxy' +description: 'Learn how to set up Keycloak as your OpenID Connect (OIDC) provider and integrate it with Pomerium for a secure, identity-aware proxy configuration.' +keywords: + [ + keycloak, + pomerium, + identity aware proxy, + oidc, + generic oidc, + zero trust, + openid connect, + ] +sidebar_label: Keycloak +lang: en-US +--- + +import SelfSignedCertWarning from '@site/content/docs/admonitions/_handle-self-signed-certificate-warning.mdx'; + +# Keycloak + Pomerium (OIDC) + +[Keycloak](https://www.keycloak.org/) is an open-source identity and access management solution that supports the [OpenID Connect (OIDC) specification](https://openid.net/specs/openid-connect-core-1_0.html). With [Pomerium](https://www.pomerium.com/) as your identity-aware proxy, you can authenticate and authorize requests to your applications while letting Keycloak handle user sign-in, tokens, and sessions. + +This guide shows how to integrate a self-hosted Keycloak instance as your OIDC provider for Pomerium. The steps focus on Keycloak but apply to most [generic OIDC](https://openid.net/specs/openid-connect-core-1_0.html) providers. + +## Prerequisites + +- [Docker](https://docs.docker.com/install/) +- [Docker Compose](https://docs.docker.com/compose/install/) + +## Docker Compose Configuration + +Create a file named `docker-compose.yaml`: + +```yaml title="docker-compose.yaml" +services: + mykeycloak: + image: quay.io/keycloak/keycloak:22.0.1 + command: + - start-dev + environment: + - KEYCLOAK_ADMIN=admin + - KEYCLOAK_ADMIN_PASSWORD=admin + ports: + - 8080:8080 + networks: + default: + aliases: + - keycloak.localhost.pomerium.io + + pomerium: + image: pomerium.com/pomerium/pomerium:latest + volumes: + - ./config.yaml:/pomerium/config.yaml:ro + ports: + - 443:443 + + verify: + image: pomerium.com/pomerium/verify:latest + environment: + JWKS_ENDPOINT: https://pomerium/.well-known/pomerium/jwks.json +``` + +Run `docker compose up`. When Keycloak starts, visit [http://localhost:8080](http://localhost:8080) to open the **Keycloak Admin Console**. + +## Keycloak Setup + +![Access the Keycloak admin console](./img/keycloak/keycloak-admin-console.png) + +Sign in with `admin` / `admin`. + +### Create a Realm + +1. Select **master** (top-left) and **Create Realm**. +1. Enter a name (for example, `Pomerium`) and select **Create**. + +![Create a new realm](./img/keycloak/keycloak-realm.gif) + +### Create a User + +1. Go to **Users** and **Add users**. +1. Enter a username and **Create**. +1. Select **Credentials**, then **Set password** and disable **Temporary**. + +![Create a user](./img/keycloak/keycloak-create-a-user.gif) ![Set the user's password](./img/keycloak/keycloak-set-password.png) + +### Create a Client + +1. Go to **Clients** > **Create client**. +1. **Client type**: **OpenID Connect**. +1. **Client ID**: `mynewclient`. +1. Enable **Standard flow** and **Direct access grants**. +1. **Save**. + +![Create a client](./img/keycloak/keycloak-create-client.gif) + +In **Access settings**: + +- **Valid redirect URIs**: `https://authenticate.localhost.pomerium.io/oauth2/callback` +- **Web Origins**: `https://authenticate.localhost.pomerium.io` +- Turn on **Client authentication**. + +Save. Under **Credentials**, copy the **Client secret**: + +![Get client secret](./img/keycloak/keycloak-client-credentials.png) + +## Pomerium Configuration + +Create `config.yaml`: + +```yaml title="config.yaml" +authenticate_service_url: https://authenticate.localhost.pomerium.io + +idp_provider: oidc +idp_client_id: 'mynewclient' +idp_client_secret: 'your_client_secret' # Replace with the actual secret +idp_provider_url: 'http://keycloak.localhost.pomerium.io:8080/realms/Pomerium' + +signing_key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSVA2TUN5UFI5OUNmSEVkU0s4cVdzbk51Q0RyMVZ3ay93RER1RVhyQitELzZvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFQ0JTK3gyQnJRNVJqNHJFcU5PSEVsUFVESXJiRlNhRitoWEhEL1RYby9rQWVKU1lJSjJHVwpZMnE0a0NPNTU4RmdoYmxDTUplYVdjV1luT3JuZkpxeXRnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= + +routes: + - from: https://verify.localhost.pomerium.io + to: http://verify:8000 + allow_any_authenticated_user: true + pass_identity_headers: true +``` + +:::caution Do **not** reuse this sample `signing_key` in production. ::: + +## Test the Integration + +Visit [https://verify.localhost.pomerium.io](https://verify.localhost.pomerium.io). + +:::tip + + +::: + +You'll be redirected to Keycloak to sign in, then back to the Verify service: + +![Sign in to Keycloak Realm](./img/keycloak/keycloak-login.png) ![Access Verify app](./img/keycloak/keycloak-verify-app.png) + +You can see user claims from Keycloak in the JWT payload, confirming that Pomerium has authenticated and authorized your request. + +## Additional Resources + +- [Identity Provider Settings](/docs/reference/identity-provider-settings) +- [Signing Keys](/docs/reference/signing-key) +- [Routes and Policies](/docs/reference/routes) +- [Keycloak Documentation](https://www.keycloak.org/documentation/) +- [Pomerium Verify](https://github.com/pomerium/verify) diff --git a/content/docs/identity-providers/okta.mdx b/content/docs/integrations/user-identity/okta.mdx similarity index 99% rename from content/docs/identity-providers/okta.mdx rename to content/docs/integrations/user-identity/okta.mdx index 8477d861b..79509ea8f 100644 --- a/content/docs/identity-providers/okta.mdx +++ b/content/docs/integrations/user-identity/okta.mdx @@ -127,5 +127,5 @@ Under **Settings → Identity Providers**, select "Okta" as the identity provide [environmental variables]: https://en.wikipedia.org/wiki/Environment_variable [oauth2]: https://oauth.net/2/ [openid connect]: https://en.wikipedia.org/wiki/OpenID_Connect -[pomerium-install]: /docs/zero/install +[pomerium-install]: /docs/get-started/quickstart [group id]: https://developer.okta.com/docs/reference/api/groups/ diff --git a/content/docs/identity-providers/one-login.mdx b/content/docs/integrations/user-identity/one-login.mdx similarity index 99% rename from content/docs/identity-providers/one-login.mdx rename to content/docs/integrations/user-identity/one-login.mdx index e1541d6ed..a65163aee 100644 --- a/content/docs/identity-providers/one-login.mdx +++ b/content/docs/integrations/user-identity/one-login.mdx @@ -142,4 +142,4 @@ Under **Settings → Identity Providers**, select "Onelogin" as the identity pro [oauth2]: https://oauth.net/2/ [openid connect]: https://en.wikipedia.org/wiki/OpenID_Connect [onelogin]: https://www.onelogin.com/ -[installed pomerium]: /docs/zero/install +[installed pomerium]: /docs/get-started/quickstart diff --git a/content/docs/identity-providers/ping.mdx b/content/docs/integrations/user-identity/ping.mdx similarity index 96% rename from content/docs/identity-providers/ping.mdx rename to content/docs/integrations/user-identity/ping.mdx index 275fd73c1..579ddb72c 100644 --- a/content/docs/identity-providers/ping.mdx +++ b/content/docs/integrations/user-identity/ping.mdx @@ -24,7 +24,7 @@ While we do our best to keep our documentation up to date, changes to third-part To complete this guide: -- Install [Pomerium](/docs/zero). +- Install [Pomerium](/docs/get-started/quickstart). - Create a free [PingOne account](https://www.pingidentity.com/en/try-ping.html). (This guide uses a [PingOne for Workforce](https://www.pingidentity.com/en/platform/solutions/pingone-for-workforce.html) account.) ## Configure PingOne @@ -130,7 +130,7 @@ The `groups` claim contains group IDs, not group names. :::enterprise -[Directory Sync](/docs/capabilities/directory-sync) is a feature available only in Pomerium Enterprise. +[Directory Sync](/docs/integrations/user-standing/directory-sync) is a feature available only in Pomerium Enterprise. ::: diff --git a/content/docs/integrations/user-standing/_category_.json b/content/docs/integrations/user-standing/_category_.json new file mode 100644 index 000000000..564d254fa --- /dev/null +++ b/content/docs/integrations/user-standing/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "User Standing", + "position": 1 +} diff --git a/content/docs/integrations/bamboohr.mdx b/content/docs/integrations/user-standing/bamboohr.mdx similarity index 100% rename from content/docs/integrations/bamboohr.mdx rename to content/docs/integrations/user-standing/bamboohr.mdx diff --git a/content/docs/capabilities/directory-sync.mdx b/content/docs/integrations/user-standing/directory-sync.mdx similarity index 82% rename from content/docs/capabilities/directory-sync.mdx rename to content/docs/integrations/user-standing/directory-sync.mdx index cf1612b57..8b73cf252 100644 --- a/content/docs/capabilities/directory-sync.mdx +++ b/content/docs/integrations/user-standing/directory-sync.mdx @@ -43,15 +43,15 @@ See [**Identity Provider Min/Max Delay**](/docs/reference/identity-provider-sett The requirements and instructions for directory sync vary depending on the identity provider. You can view the **IDP Options** for an identity provider in the Enterprise Console, or refer to the relevant identity provider guide for vendor-specific steps: -- [Auth0](/docs/identity-providers/auth0) -- [Cognito](/docs/identity-providers/cognito) -- [Microsoft Entra ID (Azure AD)](/docs/identity-providers/azure) -- [GitHub](/docs/identity-providers/github) -- [GitLab](/docs/identity-providers/gitlab) -- [Google](/docs/identity-providers/google) -- [Okta](/docs/identity-providers/okta) -- [OneLogin](/docs/identity-providers/one-login) -- [Ping](/docs/identity-providers/ping) +- [Auth0](/docs/integrations/user-identity/auth0) +- [Cognito](/docs/integrations/user-identity/cognito) +- [Microsoft Entra ID (Azure AD)](/docs/integrations/user-identity/azure) +- [GitHub](/docs/integrations/user-identity/github) +- [GitLab](/docs/integrations/user-identity/gitlab) +- [Google](/docs/integrations/user-identity/google) +- [Okta](/docs/integrations/user-identity/okta) +- [OneLogin](/docs/integrations/user-identity/one-login) +- [Ping](/docs/integrations/user-identity/ping) ## How to use directory sync @@ -65,6 +65,6 @@ Administrators can generate custom device registration links for users within th :::enterprise -See [**Device Identity**](/docs/capabilities/device-identity) for more information on how to enroll and manage devices in the Enterprise Console. +See [**Device Identity**](/docs/integrations/device-context/device-identity) for more information on how to enroll and manage devices in the Enterprise Console. ::: diff --git a/content/docs/integrations/user-standing/img/bamboohr-policy.png b/content/docs/integrations/user-standing/img/bamboohr-policy.png new file mode 100644 index 000000000..7e394c97e Binary files /dev/null and b/content/docs/integrations/user-standing/img/bamboohr-policy.png differ diff --git a/content/docs/integrations/user-standing/img/directory-sync/device-enrollment.png b/content/docs/integrations/user-standing/img/directory-sync/device-enrollment.png new file mode 100644 index 000000000..24c5e8372 Binary files /dev/null and b/content/docs/integrations/user-standing/img/directory-sync/device-enrollment.png differ diff --git a/content/docs/integrations/user-standing/img/directory-sync/directory-sync-group-criteria.png b/content/docs/integrations/user-standing/img/directory-sync/directory-sync-group-criteria.png new file mode 100644 index 000000000..bccff99ec Binary files /dev/null and b/content/docs/integrations/user-standing/img/directory-sync/directory-sync-group-criteria.png differ diff --git a/content/docs/integrations/user-standing/img/directory-sync/directory-sync-idp-tab.gif b/content/docs/integrations/user-standing/img/directory-sync/directory-sync-idp-tab.gif new file mode 100644 index 000000000..fbb8cb46a Binary files /dev/null and b/content/docs/integrations/user-standing/img/directory-sync/directory-sync-idp-tab.gif differ diff --git a/content/docs/integrations/user-standing/img/zenefits-policy.png b/content/docs/integrations/user-standing/img/zenefits-policy.png new file mode 100644 index 000000000..a249a55b8 Binary files /dev/null and b/content/docs/integrations/user-standing/img/zenefits-policy.png differ diff --git a/content/docs/integrations/zenefits.mdx b/content/docs/integrations/user-standing/zenefits.mdx similarity index 96% rename from content/docs/integrations/zenefits.mdx rename to content/docs/integrations/user-standing/zenefits.mdx index 5e7c4b47a..c1a6d58e1 100644 --- a/content/docs/integrations/zenefits.mdx +++ b/content/docs/integrations/user-standing/zenefits.mdx @@ -1,7 +1,7 @@ --- -title: Zenefits HR systems -sidebar_label: Zenefits -description: Configure the Zenefits external data provider to extend your access policies. +title: TriNet Zenefits HR systems +sidebar_label: TriNet Zenefits +description: Configure the TriNet Zenefits external data provider to extend your access policies. --- import Tabs from '@theme/Tabs'; diff --git a/content/docs/internals/architecture.md b/content/docs/internals/architecture.md index 2a06e1cbe..249729b7d 100644 --- a/content/docs/internals/architecture.md +++ b/content/docs/internals/architecture.md @@ -23,9 +23,9 @@ The following steps outline how the Proxy service handles a request at a high le 1. The client makes a request to access the target resource 1. The Proxy service receives the request and sends a gRPC call to the Authorization service, which evaluates policy -1. If the Authorization service doesn’t see a session cookie, the Proxy service redirects the request to the Authentication service to verify the client’s identity -1. After the Authentication service verifies the client’s identity and saves a local session cookie, the Proxy service sends the session data to the Databroker service over a gRPC call -1. Before redirecting the client to the target resource, the Proxy service checks permissions with the Authorization service, then maps a route based on the internal and external routes defined in the route’s policy +1. If the Authorization service doesn't see a session cookie, the Proxy service redirects the request to the Authentication service to verify the client's identity +1. After the Authentication service verifies the client's identity and saves a local session cookie, the Proxy service sends the session data to the Databroker service over a gRPC call +1. Before redirecting the client to the target resource, the Proxy service checks permissions with the Authorization service, then maps a route based on the internal and external routes defined in the route's policy ### Authentication service @@ -44,7 +44,7 @@ The Authorization service processes policies to determine what permissions the c When the Authorization service receives a request from the Proxy service, the following actions take place: -1. The Authorization service first looks for a session cookie, which contains the client’s JWT. If no session cookie is present, the Authorization service returns a redirect response, prompting the browser to authenticate through the Authentication service to establish session identity. +1. The Authorization service first looks for a session cookie, which contains the client's JWT. If no session cookie is present, the Authorization service returns a redirect response, prompting the browser to authenticate through the Authentication service to establish session identity. 1. Once a session cookie is in place, the Proxy service makes a gRPC call to the Authorization service so it can determine permissions based on JWT claims and policy. 1. The Authorization service then constructs security headers based on JWT claims, which the Proxy service forwards to upstream applications. 1. With each subsequent request, the Authorization service employs on-demand caching to query the Databroker service for updates to session state. @@ -53,7 +53,7 @@ When the Authorization service receives a request from the Proxy service, the fo The Databroker service persists session and identity-related data. It also functions as an identity manager in that it's responsible for refreshing user sessions against the IdP until a Pomerium session has expired. -The points below outline the Databroker’s role in the request and session lifecycle: +The points below outline the Databroker's role in the request and session lifecycle: - Once a client is authenticated, the Proxy server makes a gRPC call to the Databroker to persist session data and identity information. - The Authorization service queries the Databroker on-demand to keep the two services in sync. diff --git a/content/docs/internals/certificates-and-tls.mdx b/content/docs/internals/certificates-and-tls.mdx new file mode 100644 index 000000000..08c2912d6 --- /dev/null +++ b/content/docs/internals/certificates-and-tls.mdx @@ -0,0 +1,214 @@ +--- +title: 'Certificates and TLS with Pomerium' +description: 'Learn how to configure Pomerium for both downstream and upstream TLS, including mutual authentication with custom certificate authorities.' +sidebar_label: 'Certificates & TLS' +lang: en-US +keywords: + - pomerium + - identity access proxy + - mtls + - client certificate + - mutual authentication + - upstream mTLS + - downstream mTLS +--- + +# Certificates and TLS with Pomerium + +This page covers **downstream TLS** (the connection between end users and Pomerium) and **upstream TLS** (the connection between Pomerium and the services behind it). Both can leverage mutual TLS (mTLS) for additional security in a zero-trust environment. + +## Downstream TLS + +Downstream mTLS refers to a requirement that **end users present a trusted client certificate** when connecting to services secured by Pomerium. With ordinary TLS, only the server presents a certificate. With mTLS, the client must also present a certificate, and the server will only allow requests if the client's certificate is trusted. + +:::note + +Pomerium uses the term “downstream mTLS” for the client-to-Pomerium connection, and **“upstream mTLS”** for the connection between Pomerium and protected services. See [Upstream TLS](#upstream-tls) below for details on securing the connection to your upstream services. + +::: + +### Why use downstream mTLS? + +- **Stronger Client Authentication**: Each connecting user or device has its own certificate. +- **Zero-Trust**: Certificates verify user identity at the network level, not just via credentials/SSO. +- **Compliance**: Many security standards (e.g., PCI-DSS, HIPAA) recommend or require mutual authentication for sensitive data transport. + +### Before You Begin (Downstream TLS) + +You will need: + +- A working Pomerium instance. Complete the [Pomerium Core quickstart](/docs/get-started/quickstart) with Docker for a quick proof of concept. +- [`mkcert`](https://github.com/FiloSottile/mkcert#installation), to issue certificates from a locally-trusted certificate authority (CA). + +:::caution + +`mkcert` is designed for local testing. Production environments require a more advanced certificate management system. + +::: + +### Configure Pomerium with a server certificate + +If Pomerium already has a server certificate configured, you can skip to [Create a client certificate](#create-a-client-certificate). + +1. **Create a Root CA** + Install `mkcert`, then run: + + ```bash + mkcert -install + ``` + + This creates a trusted root CA for local development. + +2. **Create a Wildcard TLS Certificate** + + ```bash + mkcert '*.localhost.pomerium.io' + ``` + + This produces `_wildcard.localhost.pomerium.io.pem` (certificate) and `_wildcard.localhost.pomerium.io-key.pem` (key). + +3. **Update Pomerium Configuration** + Point `certificate_file` and `certificate_key_file` to these files: + ```yaml + certificate_file: '_wildcard.localhost.pomerium.io.pem' + certificate_key_file: '_wildcard.localhost.pomerium.io-key.pem' + ``` + Make sure the paths align with your environment (e.g., Docker bind mounts). + +### Create a client certificate + +```bash +mkcert -client -pkcs12 "yourUsername@localhost.pomerium.io" +``` + +This produces a file like `yourUsername@localhost.pomerium.io-client.p12`, containing both the client certificate and its private key. + +### Require mTLS in Pomerium + +Add the `downstream_mtls` key to your `config.yaml` or environment variables, pointing to the `rootCA.pem` created by `mkcert`: + +```yaml +downstream_mtls: + ca_file: '/YOUR/MKCERT/CAROOT/rootCA.pem' +``` + +Pomerium now requires a client certificate for any route. Browsers without a valid client certificate will see a Pomerium error page. + +### Installing the client certificate (example: Chrome on Linux) + +1. Navigate to `chrome://settings/certificates`. +2. Under **Your Certificates**, click **Import** and select `yourUsername@localhost.pomerium.io-client.p12`. +3. Enter the default password **`changeit`** (from mkcert). +4. A new “org-mkcert development certificate” entry appears in your certificate list. + +When you visit a route like `https://verify.localhost.pomerium.io`, Chrome should prompt you to select the newly imported certificate. If everything is correct, you'll be granted access. + +![chrome settings](img/mtls/01-chrome-settings-certificates.png) + +![import client certificate](img/mtls/02-import-client-certificate.png) + +![enter certificate password](img/mtls/03-enter-certificate-password.png) + +![certificate list](img/mtls/04-certificate-list.png) + +![choose client certificate](img/mtls/05-select-client-certificate.png) + +## Upstream TLS + +Upstream TLS ensures that **Pomerium and your protected services authenticate each other**. By default, Pomerium authenticates user traffic but does not require or verify the identity of the upstream service. For zero-trust consistency, the upstream service should also present a valid TLS certificate, and Pomerium can optionally present its own client certificate (mTLS) to the service. + + + +### How Pomerium verifies upstream services + +- **Custom CA**: Point Pomerium to a trusted certificate authority using [`tls_custom_ca_file` or `tls_upstream_server_name`](/docs/reference/routes/tls). This ensures Pomerium will only trust upstreams signed by your preferred internal CA or other recognized CAs. +- **Client Certificate**: If required by the upstream, Pomerium can present its own certificate and key (`tls_client_cert_file` and `tls_client_key_file`) to complete an mTLS handshake. + +### Example: mkcert + OpenSSL + +This guide demonstrates a proof-of-concept using `mkcert` to generate self-signed certificates and an [OpenSSL s_server](https://www.openssl.org/docs/manmaster/man1/openssl-s_server.html) as the upstream application. + +#### Prerequisites + +- A root CA created by `mkcert` (as above). +- A Pomerium configuration already set up (in all-in-one mode). +- `openssl` installed on your system. + +#### Steps + +1. **Create Upstream Certificates** + + ```bash + mkcert openssl.localhost + mkcert -client "pomerium@localhost" + ``` + + Move the resulting files to appropriate locations (e.g., `/etc/pomerium/`) and adjust ownership as needed. + +2. **Start an OpenSSL Server** + + ```bash + openssl s_server \ + -key ./openssl.localhost-key.pem \ + -cert ./openssl.localhost.pem \ + -accept 44330 \ + -www + ``` + + This listens on port 44330 for TLS connections. + +3. **Configure a Pomerium Route** + + ```yaml + - from: https://openssl.localhost.pomerium.io + to: https://localhost:44330 + tls_upstream_server_name: openssl.localhost + policy: + - allow: + or: + - email: + is: user@example.com + ``` + + Visiting `https://openssl.localhost.pomerium.io` should show the following notice in your browser: + + ![OpenSSL Upstream without client certificate verification](./img/mtls/openssl-test1.png) + + “no client certificate available” indicates that Pomerium is connecting but not supplying a certificate to the upstream yet. + +4. **Require mTLS on the Upstream** + Restart the OpenSSL server with `-Verify 1`: + + ```bash + openssl s_server \ + -Verify 1 \ + -key ./openssl.localhost-key.pem \ + -cert ./openssl.localhost.pem \ + -accept 44330 \ + -www + ``` + + Now the upstream expects a client certificate from its connection peer. + +5. **Provide Pomerium's Client Certificate** + Update the route to include: + ```yaml + tls_client_cert_file: /etc/pomerium/pomerium@localhost-client.pem + tls_client_key_file: /etc/pomerium/pomerium@localhost-client-key.pem + ``` + Refresh `https://openssl.localhost.pomerium.io`. The OpenSSL server's output should now show a validated client certificate from Pomerium. + +### More Resources + +- [Mutual Authentication: A Component of Zero Trust](/docs/internals/mutual-auth) +- [Client-Side mTLS With Pomerium](/docs/internals/mutual-auth.md) +- [JWT Verification](/docs/capabilities/getting-users-identity) + +With both **downstream TLS** and **upstream TLS** in place, Pomerium ensures secure connections at every hop—users prove their identity to Pomerium, and Pomerium proves its identity to the protected services (and vice versa, if the service requires a client certificate). This consistent end-to-end encryption and mutual authentication is a key building block for a robust zero-trust architecture. diff --git a/content/docs/concepts/clusters.mdx b/content/docs/internals/clusters.mdx similarity index 56% rename from content/docs/concepts/clusters.mdx rename to content/docs/internals/clusters.mdx index 9d11b92fd..973c232ac 100644 --- a/content/docs/concepts/clusters.mdx +++ b/content/docs/internals/clusters.mdx @@ -6,7 +6,6 @@ title: Clusters description: This document describes Clusters in Pomerium Zero. keywords: [clusters, pomerium zero] sidebar_label: Clusters -sidebar_position: 1 --- import Tabs from '@theme/Tabs'; @@ -18,7 +17,7 @@ This document provides an overview of Clusters in Pomerium Zero. ## Overview -When you install Pomerium Zero, you get your own **Cluster**. A cluster consists of one or more replicas of [Pomerium Core](/docs/core), the primary server component that secures your services. Clusters are deployed locally and managed through Pomerium Zero's hosted control plane. +When you install Pomerium Zero, you get your own **Cluster**. A cluster consists of one or more replicas of [Pomerium Core](/docs/deploy/core), the primary server component that secures your services. Clusters are deployed locally and managed through Pomerium Zero's hosted control plane. ## Why clusters? @@ -133,7 +132,7 @@ curl https://console.pomerium.app/install.bash | env POMERIUM_ZERO_TOKEN= - - -
Proxy
Proxy
Authenticate
Authenticate
Authorize
Authorize
Identity
Provider
Identity...
redirect with session token
redirect with session token
Secured Application
Secured A...
request
request
redirect to IdP sign-in
redirect to IdP sign-in
check authorization
check authoriz...
unauthorized
unauthorized
redirect for session cookie
redirect for session cookie
redirect with authorization code
redirect with authorization code
exchange code for tokens
exchange code...
return id/access tokens
return id/access tokens
session syncronized
session syncronized
set session cookie
set session cookie
check authorization
check authorization
authorized
authorized
proxied request
proxied request
Databroker
Databroker
Databroker
Databroker
store session and tokens
store session and tokens
Text is not SVG - cannot display
\ No newline at end of file +
Proxy
Proxy
Authenticate
Authenticate
Authorize
Authorize
Identity
Provider
Identity...
redirect with session token
redirect with session token
Secured Application
Secured A...
request
request
redirect to IdP sign-in
redirect to IdP sign-in
check authorization
check authoriz...
unauthorized
unauthorized
redirect for session cookie
redirect for session cookie
redirect with authorization code
redirect with authorization code
exchange code for tokens
exchange code...
return id/access tokens
return id/access tokens
session syncronized
session syncronized
set session cookie
set session cookie
check authorization
check authorization
authorized
authorized
proxied request
proxied request
Databroker
Databroker
Databroker
Databroker
store session and tokens
store session and tokens
Text is not SVG - cannot display
\ No newline at end of file diff --git a/content/docs/internals/img/architecture/pomerium-auth-flow.svg b/content/docs/internals/img/architecture/pomerium-auth-flow.svg index d49d5758e..752669942 100644 --- a/content/docs/internals/img/architecture/pomerium-auth-flow.svg +++ b/content/docs/internals/img/architecture/pomerium-auth-flow.svg @@ -1,3 +1 @@ - - -
Proxy
Proxy
Authenticate
Authenticate
Authorize
Authorize
Identity
Provider
Identity...
Secured Application
Secured A...
request
request
redirect to IdP sign-in
redirect to IdP sign-in
check authorization
check authoriz...
unauthorized
unauthorized
redirect for session cookie
redirect for session cookie
redirect with authorization code
redirect with authorization code
exchange code for tokens
exchange code...
return id/access tokens
return id/access tokens
store session and tokens
store session...
session syncronized
session syncronized
redirect with session token
redirect with session token
set session cookie
set session cookie
check authorization
check authorization
authorized
authorized
proxied request
proxied request
Databroker
Cache
Viewer does not support full SVG 1.1
\ No newline at end of file +
Proxy
Proxy
Authenticate
Authenticate
Authorize
Authorize
Identity
Provider
Identity...
Secured Application
Secured A...
request
request
redirect to IdP sign-in
redirect to IdP sign-in
check authorization
check authoriz...
unauthorized
unauthorized
redirect for session cookie
redirect for session cookie
redirect with authorization code
redirect with authorization code
exchange code for tokens
exchange code...
return id/access tokens
return id/access tokens
store session and tokens
store session...
session syncronized
session syncronized
redirect with session token
redirect with session token
set session cookie
set session cookie
check authorization
check authorization
authorized
authorized
proxied request
proxied request
Databroker
Cache
Viewer does not support full SVG 1.1
\ No newline at end of file diff --git a/content/docs/internals/img/architecture/pomerium-container-context-stateless-authn.svg b/content/docs/internals/img/architecture/pomerium-container-context-stateless-authn.svg index 2f8768828..f3c12929e 100644 --- a/content/docs/internals/img/architecture/pomerium-container-context-stateless-authn.svg +++ b/content/docs/internals/img/architecture/pomerium-container-context-stateless-authn.svg @@ -1,4 +1 @@ - - - -
Identity
Provider
Identity...
Request
Req...
Session / Identity
Data Sync
Session / Identity...
Authorize
Authorize
Identify
User
Identify...
Check
Authorization
Check...
Authorized
Request
Authorized...
Proxy
Proxy
Session / Identity
Refresh
Session / Identity...
Databroker
Databroker
Establish
Identity
Establish...
Authenticate
Authenticate
Secured
Application
Secured...
Secured
Application
Secured...
Secured
Application
Secured...
Stores Session
Stores Sess...
Text is not SVG - cannot display
\ No newline at end of file +
Identity
Provider
Identity...
Request
Req...
Session / Identity
Data Sync
Session / Identity...
Authorize
Authorize
Identify
User
Identify...
Check
Authorization
Check...
Authorized
Request
Authorized...
Proxy
Proxy
Session / Identity
Refresh
Session / Identity...
Databroker
Databroker
Establish
Identity
Establish...
Authenticate
Authenticate
Secured
Application
Secured...
Secured
Application
Secured...
Secured
Application
Secured...
Stores Session
Stores Sess...
Text is not SVG - cannot display
\ No newline at end of file diff --git a/content/docs/internals/img/architecture/pomerium-container-context.svg b/content/docs/internals/img/architecture/pomerium-container-context.svg index 53c8edf34..079104690 100644 --- a/content/docs/internals/img/architecture/pomerium-container-context.svg +++ b/content/docs/internals/img/architecture/pomerium-container-context.svg @@ -1,3 +1 @@ - - -
Identity
Provider
Identity...
Request
Req...
Session / Identity
Data Sync
Session / Identity...
Authorize
Authorize
Identify
User
Identify...
Check
Authorization
Check...
Authorized
Request
Authorized...
Proxy
Proxy
Session / Identity
Refresh
Session / Identity...
Databroker
Databroker
Establish
Identity
Establish...
Store
Session
Store...
Authenticate
Authenticate
Secured
Application
Secured...
Secured
Application
Secured...
Secured
Application
Secured...
Viewer does not support full SVG 1.1
\ No newline at end of file +
Identity
Provider
Identity...
Request
Req...
Session / Identity
Data Sync
Session / Identity...
Authorize
Authorize
Identify
User
Identify...
Check
Authorization
Check...
Authorized
Request
Authorized...
Proxy
Proxy
Session / Identity
Refresh
Session / Identity...
Databroker
Databroker
Establish
Identity
Establish...
Store
Session
Store...
Authenticate
Authenticate
Secured
Application
Secured...
Secured
Application
Secured...
Secured
Application
Secured...
Viewer does not support full SVG 1.1
\ No newline at end of file diff --git a/content/docs/internals/img/architecture/pomerium-request-flow.svg b/content/docs/internals/img/architecture/pomerium-request-flow.svg index 464e03133..ae75d315d 100644 --- a/content/docs/internals/img/architecture/pomerium-request-flow.svg +++ b/content/docs/internals/img/architecture/pomerium-request-flow.svg @@ -1,478 +1 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Pr - o - xy - - service - - - - - - - - - - - - Authenticate - - service - - - - - - - - - - - - Authorization - - service - - - - - - - - - - - - Databr - ok - er - - service - Identity Pr - o - vider - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Secur - ed Application - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Client r - equest - - - - - - - - - - - Check Authorization - for session cookie - - - No session? Redir - ect to - Authenticate - - - - - - - - V - erify identity / get - session cookie - - - - - - - - - - Redir - ect to IdP - and sign in - - - Redir - ect with - authorization code - - - Ex - change code for - O - Auth tok - ens - - - Return O - Auth/ID - tok - ens - - - - - - - Authenticate service - r - etrie - ves session - data fr - om the IdP: - - ID tok - en ( - JWT) - - De - vice cr - edentials - - User ID - - OIDC claims, etc. - - - Redir - ect session data - Stor - e session locally - - - - - - - - - Check Authorization - - - - Client r - equest authorized - - - Stor - e session and - tok - ens - - - Query DB for - session data - - - - - - - - - - Redir - ect r - equest to secur - ed application - - - - - - \ No newline at end of file +ProxyserviceAuthenticateserviceAuthorizationserviceDatabrokerserviceIdentity ProviderSecured ApplicationClient requestCheck Authorizationfor session cookieNo session? Redirect toAuthenticateVerify identity / getsession cookieRedirect to IdPand sign inRedirect withauthorization codeExchange code forOAuth tokensReturn OAuth/IDtokensAuthenticate serviceretrieves sessiondata from the IdP:- ID token (JWT)- Device credentials- User ID- OIDC claims, etc.Redirect session dataStore session locallyCheck AuthorizationClient request authorizedStore session andtokensQuery DB forsession dataRedirect request to secured application \ No newline at end of file diff --git a/content/docs/internals/img/architecture/pomerium-system-context.svg b/content/docs/internals/img/architecture/pomerium-system-context.svg index f8e94e16d..2302bcd5c 100644 --- a/content/docs/internals/img/architecture/pomerium-system-context.svg +++ b/content/docs/internals/img/architecture/pomerium-system-context.svg @@ -1,3 +1 @@ - - -
Identify User
Identify User
Identity
Provider
Identity...
On-Prem Users
On-Prem Users
Remote Users
Remote Us...
Authorized
Authorized
Secured
Application
Secured...
Secured
Application
Secured...
Secured
Application
Secured...
Viewer does not support full SVG 1.1
\ No newline at end of file +
Identify User
Identify User
Identity
Provider
Identity...
On-Prem Users
On-Prem Users
Remote Users
Remote Us...
Authorized
Authorized
Secured
Application
Secured...
Secured
Application
Secured...
Secured
Application
Secured...
Viewer does not support full SVG 1.1
\ No newline at end of file diff --git a/content/docs/internals/img/clusters/cluster-ip-address-settings.png b/content/docs/internals/img/clusters/cluster-ip-address-settings.png new file mode 100644 index 000000000..3bcf26446 Binary files /dev/null and b/content/docs/internals/img/clusters/cluster-ip-address-settings.png differ diff --git a/content/docs/internals/img/clusters/cluster-name-table.png b/content/docs/internals/img/clusters/cluster-name-table.png new file mode 100644 index 000000000..dccd64100 Binary files /dev/null and b/content/docs/internals/img/clusters/cluster-name-table.png differ diff --git a/content/docs/internals/img/clusters/clusters-architecture.png b/content/docs/internals/img/clusters/clusters-architecture.png new file mode 100644 index 000000000..4ecd8bfca Binary files /dev/null and b/content/docs/internals/img/clusters/clusters-architecture.png differ diff --git a/content/docs/internals/img/clusters/replica-status.png b/content/docs/internals/img/clusters/replica-status.png new file mode 100644 index 000000000..6513dd28d Binary files /dev/null and b/content/docs/internals/img/clusters/replica-status.png differ diff --git a/content/docs/internals/img/clusters/update-cluster-token.png b/content/docs/internals/img/clusters/update-cluster-token.png new file mode 100644 index 000000000..91cac1042 Binary files /dev/null and b/content/docs/internals/img/clusters/update-cluster-token.png differ diff --git a/content/docs/internals/img/clusters/zero-databroker-connection-string.png b/content/docs/internals/img/clusters/zero-databroker-connection-string.png new file mode 100644 index 000000000..3505bfb1b Binary files /dev/null and b/content/docs/internals/img/clusters/zero-databroker-connection-string.png differ diff --git a/content/docs/internals/img/metrics/enterprise-authorized-requests.png b/content/docs/internals/img/metrics/enterprise-authorized-requests.png new file mode 100644 index 000000000..b13a1b5e2 Binary files /dev/null and b/content/docs/internals/img/metrics/enterprise-authorized-requests.png differ diff --git a/content/docs/internals/img/metrics/enterprise-filter-traffic.gif b/content/docs/internals/img/metrics/enterprise-filter-traffic.gif new file mode 100644 index 000000000..326b2c23d Binary files /dev/null and b/content/docs/internals/img/metrics/enterprise-filter-traffic.gif differ diff --git a/content/docs/internals/img/metrics/enterprise-healthy-upstream-endpoints-graph.png b/content/docs/internals/img/metrics/enterprise-healthy-upstream-endpoints-graph.png new file mode 100644 index 000000000..517817466 Binary files /dev/null and b/content/docs/internals/img/metrics/enterprise-healthy-upstream-endpoints-graph.png differ diff --git a/content/docs/internals/img/metrics/enterprise-metrics-namespaces.gif b/content/docs/internals/img/metrics/enterprise-metrics-namespaces.gif new file mode 100644 index 000000000..f904eb201 Binary files /dev/null and b/content/docs/internals/img/metrics/enterprise-metrics-namespaces.gif differ diff --git a/content/docs/internals/img/metrics/enterprise-percentile-ranges.gif b/content/docs/internals/img/metrics/enterprise-percentile-ranges.gif new file mode 100644 index 000000000..936a9faf2 Binary files /dev/null and b/content/docs/internals/img/metrics/enterprise-percentile-ranges.gif differ diff --git a/content/docs/internals/img/metrics/enterprise-request-duration.png b/content/docs/internals/img/metrics/enterprise-request-duration.png new file mode 100644 index 000000000..9f86a5009 Binary files /dev/null and b/content/docs/internals/img/metrics/enterprise-request-duration.png differ diff --git a/content/docs/internals/img/metrics/enterprise-request-rate.png b/content/docs/internals/img/metrics/enterprise-request-rate.png new file mode 100644 index 000000000..9e3419b40 Binary files /dev/null and b/content/docs/internals/img/metrics/enterprise-request-rate.png differ diff --git a/content/docs/internals/img/metrics/enterprise-request-size.png b/content/docs/internals/img/metrics/enterprise-request-size.png new file mode 100644 index 000000000..848fc55ef Binary files /dev/null and b/content/docs/internals/img/metrics/enterprise-request-size.png differ diff --git a/content/docs/internals/img/metrics/enterprise-response-status-codes.gif b/content/docs/internals/img/metrics/enterprise-response-status-codes.gif new file mode 100644 index 000000000..69e1f95e4 Binary files /dev/null and b/content/docs/internals/img/metrics/enterprise-response-status-codes.gif differ diff --git a/content/docs/internals/img/metrics/enterprise-total-requests.png b/content/docs/internals/img/metrics/enterprise-total-requests.png new file mode 100644 index 000000000..d71cb4a63 Binary files /dev/null and b/content/docs/internals/img/metrics/enterprise-total-requests.png differ diff --git a/content/docs/internals/img/metrics/reports-runtime-fullpage.png b/content/docs/internals/img/metrics/reports-runtime-fullpage.png new file mode 100644 index 000000000..abf70d6f5 Binary files /dev/null and b/content/docs/internals/img/metrics/reports-runtime-fullpage.png differ diff --git a/content/docs/internals/img/metrics/reports-runtime.png b/content/docs/internals/img/metrics/reports-runtime.png new file mode 100644 index 000000000..cac4c9aff Binary files /dev/null and b/content/docs/internals/img/metrics/reports-runtime.png differ diff --git a/content/docs/internals/img/metrics/reports-sessions-fullpage.png b/content/docs/internals/img/metrics/reports-sessions-fullpage.png new file mode 100644 index 000000000..980283c8a Binary files /dev/null and b/content/docs/internals/img/metrics/reports-sessions-fullpage.png differ diff --git a/content/docs/internals/img/metrics/zero-authorized-and-denied-chart.png b/content/docs/internals/img/metrics/zero-authorized-and-denied-chart.png new file mode 100644 index 000000000..052b019a9 Binary files /dev/null and b/content/docs/internals/img/metrics/zero-authorized-and-denied-chart.png differ diff --git a/content/docs/internals/img/metrics/zero-bytes-sent-received.png b/content/docs/internals/img/metrics/zero-bytes-sent-received.png new file mode 100644 index 000000000..2f1711978 Binary files /dev/null and b/content/docs/internals/img/metrics/zero-bytes-sent-received.png differ diff --git a/content/docs/internals/img/metrics/zero-changesets.png b/content/docs/internals/img/metrics/zero-changesets.png new file mode 100644 index 000000000..9818a1604 Binary files /dev/null and b/content/docs/internals/img/metrics/zero-changesets.png differ diff --git a/content/docs/internals/img/metrics/zero-deployments-changesets.gif b/content/docs/internals/img/metrics/zero-deployments-changesets.gif new file mode 100644 index 000000000..ec2cb7a31 Binary files /dev/null and b/content/docs/internals/img/metrics/zero-deployments-changesets.gif differ diff --git a/content/docs/internals/img/metrics/zero-filter-traffic.gif b/content/docs/internals/img/metrics/zero-filter-traffic.gif new file mode 100644 index 000000000..5c9fa5916 Binary files /dev/null and b/content/docs/internals/img/metrics/zero-filter-traffic.gif differ diff --git a/content/docs/internals/img/metrics/zero-find-metrics.gif b/content/docs/internals/img/metrics/zero-find-metrics.gif new file mode 100644 index 000000000..1530b372e Binary files /dev/null and b/content/docs/internals/img/metrics/zero-find-metrics.gif differ diff --git a/content/docs/internals/img/metrics/zero-find-traffic-dashboard.png b/content/docs/internals/img/metrics/zero-find-traffic-dashboard.png new file mode 100644 index 000000000..f2fcb7f2a Binary files /dev/null and b/content/docs/internals/img/metrics/zero-find-traffic-dashboard.png differ diff --git a/content/docs/internals/img/metrics/zero-request-duration-second-chart.png b/content/docs/internals/img/metrics/zero-request-duration-second-chart.png new file mode 100644 index 000000000..858c4c476 Binary files /dev/null and b/content/docs/internals/img/metrics/zero-request-duration-second-chart.png differ diff --git a/content/docs/internals/img/metrics/zero-request-duration.png b/content/docs/internals/img/metrics/zero-request-duration.png new file mode 100644 index 000000000..70a14376a Binary files /dev/null and b/content/docs/internals/img/metrics/zero-request-duration.png differ diff --git a/content/docs/internals/img/metrics/zero-requests-per-second.png b/content/docs/internals/img/metrics/zero-requests-per-second.png new file mode 100644 index 000000000..4a698b6de Binary files /dev/null and b/content/docs/internals/img/metrics/zero-requests-per-second.png differ diff --git a/content/docs/internals/img/metrics/zero-total-and-authorized-requests.png b/content/docs/internals/img/metrics/zero-total-and-authorized-requests.png new file mode 100644 index 000000000..fc12e98fc Binary files /dev/null and b/content/docs/internals/img/metrics/zero-total-and-authorized-requests.png differ diff --git a/content/docs/internals/img/mtls/01-chrome-settings-certificates.png b/content/docs/internals/img/mtls/01-chrome-settings-certificates.png new file mode 100644 index 000000000..2169f2b96 Binary files /dev/null and b/content/docs/internals/img/mtls/01-chrome-settings-certificates.png differ diff --git a/content/docs/internals/img/mtls/02-import-client-certificate.png b/content/docs/internals/img/mtls/02-import-client-certificate.png new file mode 100644 index 000000000..5e5510bd7 Binary files /dev/null and b/content/docs/internals/img/mtls/02-import-client-certificate.png differ diff --git a/content/docs/internals/img/mtls/03-enter-certificate-password.png b/content/docs/internals/img/mtls/03-enter-certificate-password.png new file mode 100644 index 000000000..d8504e9bb Binary files /dev/null and b/content/docs/internals/img/mtls/03-enter-certificate-password.png differ diff --git a/content/docs/internals/img/mtls/04-certificate-list.png b/content/docs/internals/img/mtls/04-certificate-list.png new file mode 100644 index 000000000..38e835fb8 Binary files /dev/null and b/content/docs/internals/img/mtls/04-certificate-list.png differ diff --git a/content/docs/internals/img/mtls/05-select-client-certificate.png b/content/docs/internals/img/mtls/05-select-client-certificate.png new file mode 100644 index 000000000..e86a6f3a3 Binary files /dev/null and b/content/docs/internals/img/mtls/05-select-client-certificate.png differ diff --git a/content/docs/internals/img/mtls/openssl-test1.png b/content/docs/internals/img/mtls/openssl-test1.png new file mode 100644 index 000000000..335bb4844 Binary files /dev/null and b/content/docs/internals/img/mtls/openssl-test1.png differ diff --git a/content/docs/concepts/img/mutual-authentication/east-west-mtls-hacker.svg b/content/docs/internals/img/mutual-authentication/east-west-mtls-hacker.svg similarity index 100% rename from content/docs/concepts/img/mutual-authentication/east-west-mtls-hacker.svg rename to content/docs/internals/img/mutual-authentication/east-west-mtls-hacker.svg diff --git a/content/docs/concepts/img/mutual-authentication/jwt-verification-hacker.svg b/content/docs/internals/img/mutual-authentication/jwt-verification-hacker.svg similarity index 100% rename from content/docs/concepts/img/mutual-authentication/jwt-verification-hacker.svg rename to content/docs/internals/img/mutual-authentication/jwt-verification-hacker.svg diff --git a/content/docs/internals/img/mutual-authentication/jwt-verification.svg b/content/docs/internals/img/mutual-authentication/jwt-verification.svg new file mode 100644 index 000000000..ba8921a69 --- /dev/null +++ b/content/docs/internals/img/mutual-authentication/jwt-verification.svg @@ -0,0 +1 @@ +End UserPomeriumUpstream ServiceIdentity ProviderInternal NetworkJWKS Endpoint \ No newline at end of file diff --git a/content/docs/concepts/img/mutual-authentication/mTLS.svg b/content/docs/internals/img/mutual-authentication/mTLS.svg similarity index 100% rename from content/docs/concepts/img/mutual-authentication/mTLS.svg rename to content/docs/internals/img/mutual-authentication/mTLS.svg diff --git a/content/docs/concepts/img/mutual-authentication/north-south-mutual-auth.svg b/content/docs/internals/img/mutual-authentication/north-south-mutual-auth.svg similarity index 100% rename from content/docs/concepts/img/mutual-authentication/north-south-mutual-auth.svg rename to content/docs/internals/img/mutual-authentication/north-south-mutual-auth.svg diff --git a/content/docs/internals/img/mutual-authentication/pomerium-basic-hacker.svg b/content/docs/internals/img/mutual-authentication/pomerium-basic-hacker.svg new file mode 100644 index 000000000..9450d1e71 --- /dev/null +++ b/content/docs/internals/img/mutual-authentication/pomerium-basic-hacker.svg @@ -0,0 +1 @@ +End UserPomeriumUpstream ServiceHackerInternal Network \ No newline at end of file diff --git a/content/docs/internals/img/mutual-authentication/pomerium-basic.svg b/content/docs/internals/img/mutual-authentication/pomerium-basic.svg new file mode 100644 index 000000000..4788362fa --- /dev/null +++ b/content/docs/internals/img/mutual-authentication/pomerium-basic.svg @@ -0,0 +1 @@ +End UserPomeriumUpstream ServiceIdentity ProviderInternal Network \ No newline at end of file diff --git a/content/docs/concepts/img/mutual-authentication/put-it-together.svg b/content/docs/internals/img/mutual-authentication/put-it-together.svg similarity index 100% rename from content/docs/concepts/img/mutual-authentication/put-it-together.svg rename to content/docs/internals/img/mutual-authentication/put-it-together.svg diff --git a/content/docs/concepts/img/mutual-authentication/sidecar-mtls-hacker.svg b/content/docs/internals/img/mutual-authentication/sidecar-mtls-hacker.svg similarity index 100% rename from content/docs/concepts/img/mutual-authentication/sidecar-mtls-hacker.svg rename to content/docs/internals/img/mutual-authentication/sidecar-mtls-hacker.svg diff --git a/content/docs/concepts/img/mutual-authentication/sidecar-mutual-auth.svg b/content/docs/internals/img/mutual-authentication/sidecar-mutual-auth.svg similarity index 100% rename from content/docs/concepts/img/mutual-authentication/sidecar-mutual-auth.svg rename to content/docs/internals/img/mutual-authentication/sidecar-mutual-auth.svg diff --git a/content/docs/internals/img/ppl/apply-policies-to-routes.png b/content/docs/internals/img/ppl/apply-policies-to-routes.png new file mode 100644 index 000000000..12baf5ca2 Binary files /dev/null and b/content/docs/internals/img/ppl/apply-policies-to-routes.png differ diff --git a/content/docs/internals/img/ppl/console-devices.png b/content/docs/internals/img/ppl/console-devices.png new file mode 100644 index 000000000..fedea3ca8 Binary files /dev/null and b/content/docs/internals/img/ppl/console-devices.png differ diff --git a/content/docs/internals/img/ppl/enroll-device.png b/content/docs/internals/img/ppl/enroll-device.png new file mode 100644 index 000000000..d6835f5ef Binary files /dev/null and b/content/docs/internals/img/ppl/enroll-device.png differ diff --git a/content/docs/internals/img/ppl/exists-operator.png b/content/docs/internals/img/ppl/exists-operator.png new file mode 100644 index 000000000..96012f730 Binary files /dev/null and b/content/docs/internals/img/ppl/exists-operator.png differ diff --git a/content/docs/internals/img/ppl/numerical-comparison-operators.png b/content/docs/internals/img/ppl/numerical-comparison-operators.png new file mode 100644 index 000000000..d8e759174 Binary files /dev/null and b/content/docs/internals/img/ppl/numerical-comparison-operators.png differ diff --git a/content/docs/internals/img/ppl/ppl-edit-policy.png b/content/docs/internals/img/ppl/ppl-edit-policy.png new file mode 100644 index 000000000..d19fe53f6 Binary files /dev/null and b/content/docs/internals/img/ppl/ppl-edit-policy.png differ diff --git a/content/docs/internals/img/ppl/ppl-gui-policy.png b/content/docs/internals/img/ppl/ppl-gui-policy.png new file mode 100644 index 000000000..79a2e2069 Binary files /dev/null and b/content/docs/internals/img/ppl/ppl-gui-policy.png differ diff --git a/content/docs/internals/img/ppl/ppl-rego-policy.png b/content/docs/internals/img/ppl/ppl-rego-policy.png new file mode 100644 index 000000000..0842fa805 Binary files /dev/null and b/content/docs/internals/img/ppl/ppl-rego-policy.png differ diff --git a/content/docs/internals/img/timeouts-http-request/timeouts-http-diagram.png b/content/docs/internals/img/timeouts-http-request/timeouts-http-diagram.png index bbb9acfab..35dc9ca23 100644 Binary files a/content/docs/internals/img/timeouts-http-request/timeouts-http-diagram.png and b/content/docs/internals/img/timeouts-http-request/timeouts-http-diagram.png differ diff --git a/content/docs/internals/img/troubleshooting/adjust-polling-delay-settings.gif b/content/docs/internals/img/troubleshooting/adjust-polling-delay-settings.gif new file mode 100644 index 000000000..07445cf04 Binary files /dev/null and b/content/docs/internals/img/troubleshooting/adjust-polling-delay-settings.gif differ diff --git a/content/docs/internals/img/troubleshooting/last-error-and-request-duration.gif b/content/docs/internals/img/troubleshooting/last-error-and-request-duration.gif new file mode 100644 index 000000000..72fb48af3 Binary files /dev/null and b/content/docs/internals/img/troubleshooting/last-error-and-request-duration.gif differ diff --git a/content/docs/internals/img/troubleshooting/pomerium-proceed-to-verify.png b/content/docs/internals/img/troubleshooting/pomerium-proceed-to-verify.png new file mode 100644 index 000000000..4895e252c Binary files /dev/null and b/content/docs/internals/img/troubleshooting/pomerium-proceed-to-verify.png differ diff --git a/content/docs/internals/img/troubleshooting/zero-change-port-address.png b/content/docs/internals/img/troubleshooting/zero-change-port-address.png new file mode 100644 index 000000000..60a2be44e Binary files /dev/null and b/content/docs/internals/img/troubleshooting/zero-change-port-address.png differ diff --git a/content/docs/capabilities/enterprise-api.mdx b/content/docs/internals/management-api-enterprise.mdx similarity index 95% rename from content/docs/capabilities/enterprise-api.mdx rename to content/docs/internals/management-api-enterprise.mdx index a28a16c81..8d4402416 100644 --- a/content/docs/capabilities/enterprise-api.mdx +++ b/content/docs/internals/management-api-enterprise.mdx @@ -2,7 +2,7 @@ title: Pomerium Enterprise API description: Learn how to programmatically manage Pomerium Enterprise using the gRPC API available in both Python and Go libraries. lang: en-US -sidebar_label: Enterprise API +sidebar_label: 'API for Enterprise' keywords: [pomerium, gRPC, Enterprise API, gRPC API, Go, Python] --- @@ -17,7 +17,7 @@ The Pomerium Enterprise Console supports programmatic interaction through a gRPC This doc assumes: -- You've installed [Pomerium Core](/docs/core) and [Pomerium Enterprise](/docs/enterprise/install) +- You've installed [Pomerium Core](/docs/deploy/core) and [Pomerium Enterprise](/docs/deploy/enterprise/install) - The connection to the Enterprise Console service is encrypted ## Configure a new route @@ -52,7 +52,7 @@ This doc assumes: 1. The Enterprise Console will display the service account token. Be sure to store it securely now, as you cannot view it again after this point. -1. Grant the service account the appropriate [role](/docs/capabilities/namespacing#rbac-for-enterprise-console-users) on the Namespace(s) it will operate against. +1. Grant the service account the appropriate [role](/docs/internals/namespacing#rbac-for-enterprise-console-users) on the Namespace(s) it will operate against. :::tip @@ -234,7 +234,7 @@ Modify the example script to match your console API path, Namespace(s) and Polic See the following pages to learn more about how to use Pomerium Enterprise: - [Service Accounts](/docs/capabilities/service-accounts) -- [Namespaces](/docs/capabilities/namespacing) +- [Namespaces](/docs/internals/namespacing) ::: diff --git a/content/docs/zero/api-guide.md b/content/docs/internals/management-api-zero.md similarity index 99% rename from content/docs/zero/api-guide.md rename to content/docs/internals/management-api-zero.md index 858fc3014..bd84f1b0d 100644 --- a/content/docs/zero/api-guide.md +++ b/content/docs/internals/management-api-zero.md @@ -1,9 +1,8 @@ --- # cSpell:ignore bwjk, Zwxb, NXBQH, Bbxt, Wxgvn, Mehb, PJRSZWSB, Jbsv, Kjvn, Rpmww -id: zero-api-guide title: Get Started With the Pomerium Zero API -sidebar_label: API User Guide +sidebar_label: 'API for Zero' description: This page shows you how to create a route and policy with the Pomerium Zero API. --- diff --git a/content/docs/capabilities/metrics.md b/content/docs/internals/metrics.md similarity index 94% rename from content/docs/capabilities/metrics.md rename to content/docs/internals/metrics.md index 3156547d8..addedfc88 100644 --- a/content/docs/capabilities/metrics.md +++ b/content/docs/internals/metrics.md @@ -1,8 +1,8 @@ --- # cSpell:ignore XPOST tsdb -title: Metrics in Pomerium -sidebar_label: Metrics +title: Telemetry & Metrics in Pomerium +sidebar_label: Telemetry & Metrics description: Learn how Pomerium collects and displays metrics in Pomerium Zero and Pomerium Enterprise. lang: en-US keywords: @@ -72,7 +72,7 @@ When filtering by route, select: -Pomerium Zero collects traffic metrics at the [cluster](/docs/concepts/clusters) level, which includes active replicas. To review the traffic dashboard in Pomerium Zero: +Pomerium Zero collects traffic metrics at the [cluster](/docs/internals/clusters) level, which includes active replicas. To review the traffic dashboard in Pomerium Zero: 1. In the left-hand sidebar, select **Reports**. 1. Select **Traffic**. @@ -82,7 +82,7 @@ Pomerium Zero collects traffic metrics at the [cluster](/docs/concepts/clusters) -When you access the Enterprise Console, you'll land on the traffic dashboard. Pomerium Enterprise organizes traffic metrics in your deployment with [namespaces](/docs/capabilities/namespacing). +When you access the Enterprise Console, you'll land on the traffic dashboard. Pomerium Enterprise organizes traffic metrics in your deployment with [namespaces](/docs/internals/namespacing). Namespaces follow a hierarchical system. You can view traffic metrics for all namespaces, or a specific namespace, using the namespace dropdown menu. You can filter by: @@ -94,7 +94,7 @@ Namespaces follow a hierarchical system. You can view traffic metrics for all na :::enterprise -In Pomerium Enterprise, you must configure metrics before you can view them. Metrics are not enabled by default, and are not required to run Pomerium Enterprise. See the [Configure Metrics](/docs/enterprise/configure-metrics) guide to enable metrics in your Enterprise deployment. +In Pomerium Enterprise, you must configure metrics before you can view them. Metrics are not enabled by default, and are not required to run Pomerium Enterprise. See the [Configure Metrics](/docs/deploy/enterprise/configure-metrics) guide to enable metrics in your Enterprise deployment. ::: @@ -119,7 +119,7 @@ The **Total requests** chart shows the total number of proxied requests. The **A The **Healthy Endpoints** chart displays the number of healthy upstream endpoints, and roughly correlates with the number of routes defined in your deployment. -For example, if a route's **To** definition includes [multiple upstream resources](/docs/reference/routes/to#target-multiple-upstream-resources), Pomerium includes these resources in the total sum of healthy endpoints. Pomerium excludes unhealthy endpoints from this total. See Load Balancing - [Active Health Checks](/docs/capabilities/load-balancing#active-health-checks) and [Passive Health Checks](/docs/capabilities/load-balancing#passive-health-checks) for more information. +For example, if a route's **To** definition includes [multiple upstream resources](/docs/reference/routes/to#target-multiple-upstream-resources), Pomerium includes these resources in the total sum of healthy endpoints. Pomerium excludes unhealthy endpoints from this total. See Load Balancing - [Active Health Checks](/docs/capabilities/routing#active-health-checks) and [Passive Health Checks](/docs/capabilities/routing#passive-health-checks) for more information. ![Viewing the total and authorized request charts in the Enterprise Console](./img/metrics/enterprise-total-requests.png) diff --git a/content/docs/concepts/mutual-auth.md b/content/docs/internals/mutual-auth.md similarity index 88% rename from content/docs/concepts/mutual-auth.md rename to content/docs/internals/mutual-auth.md index b1600e626..4d763a8b8 100644 --- a/content/docs/concepts/mutual-auth.md +++ b/content/docs/internals/mutual-auth.md @@ -14,9 +14,9 @@ Pomerium enables you to configure mutual authentication on both the application ## What Is Mutual Authentication? -Mutual authentication is when two parties authenticate each other’s identities before communicating over a computer network. In the context of Pomerium, that typically means a client and an upstream server must authenticate each other before the server will communicate with the client over HTTPS. +Mutual authentication is when two parties authenticate each other's identities before communicating over a computer network. In the context of Pomerium, that typically means a client and an upstream server must authenticate each other before the server will communicate with the client over HTTPS. -While mutual authentication is simple in theory, applying it may be complex depending on your organization’s needs. This guide explains how Pomerium supports mutual authentication and can help you build a [zero trust] architecture where both clients and services are mutually authenticated. +While mutual authentication is simple in theory, applying it may be complex depending on your organization's needs. This guide explains how Pomerium supports mutual authentication and can help you build a [zero trust] architecture where both clients and services are mutually authenticated. This guide covers the following mutual authentication methods with Pomerium: @@ -66,7 +66,7 @@ JWT authentication with Pomerium enables the upstream service to verify that: - The JWT itself was intended for the upstream service - The user is authorized to access the upstream service -To verify a JWT, the upstream service must check that the JWT was signed by a trusted authority – in this case, that’s Pomerium. Pomerium requires a user’s private key to sign the JWT and stores the corresponding public key in a **JSON web key set** (JWKS). The upstream service can access Pomerium’s JWKS endpoint to fetch the public key and verify that Pomerium signed the JWT. +To verify a JWT, the upstream service must check that the JWT was signed by a trusted authority – in this case, that's Pomerium. Pomerium requires a user's private key to sign the JWT and stores the corresponding public key in a **JSON web key set** (JWKS). The upstream service can access Pomerium's JWKS endpoint to fetch the public key and verify that Pomerium signed the JWT. See the diagram below for a step-by-step example: @@ -85,9 +85,8 @@ In this way, Pomerium applies a zero trust security model to the application lay :::tip -For more information on how Pomerium implements JWT verification, see the following docs: +For more information on how Pomerium implements JWT verification, see the following doc: -- [JWT Verification](/docs/guides/verify-jwt) - [Identity Verification](/docs/capabilities/getting-users-identity) ::: @@ -100,7 +99,7 @@ For more information on how Pomerium implements JWT verification, see the follow ### North-south mTLS -Transport Layer Security (TLS) is a security protocol that encrypts HTTP traffic between a server and a client using the server’s TLS certificate. The server validates its identity with its TLS certificate and the certificate authority (CA) that signed it. +Transport Layer Security (TLS) is a security protocol that encrypts HTTP traffic between a server and a client using the server's TLS certificate. The server validates its identity with its TLS certificate and the certificate authority (CA) that signed it. ![North-south mTLS](./img/mutual-authentication/north-south-mutual-auth.svg) @@ -118,7 +117,7 @@ The process above, an example of [north-south traffic](https://en.wikipedia.org/ 1. The server validates the client certificate signing authority against its trusted keystore or authorized client CA. 1. Once authorized, the server resumes normal encrypted communication with the client. -See [client-side mTLS](/docs/capabilities/mtls-clients) and [upstream mTLS](/docs/capabilities/mtls-services) for more information. +See [client-side mTLS](/docs/internals/certificates-and-tls) and [upstream mTLS](/docs/internals/certificates-and-tls) for more information. ### East-west mTLS @@ -171,12 +170,11 @@ In this example: - Rather than build authentication into the `API` server, both users and admin apps must access it with the sidecar. - The sidecar only accepts mTLS-authenticated connections from the proxy, so both apps connect to the API through Pomerium. -[binaries]: /docs/core -[device identity verification]: /docs/concepts/device-identity.md +[binaries]: /docs/deploy/core +[device identity verification]: /docs/integrations/device-context/device-identity [grafana]: /docs/guides/grafana -[jwt verification]: /docs/guides/jwt-verification.md [jwt-rfc]: https://datatracker.ietf.org/doc/html/rfc7519 [`pass_identity_headers`]: /docs/reference/routes/pass-identity-headers-per-route -[quickstart]: /docs/quickstart +[quickstart]: /docs/get-started/quickstart [transport layer security]: https://en.wikipedia.org/wiki/Transport_Layer_Security [zero trust]: https://www.pomerium.com/docs/background.html diff --git a/content/docs/internals/namespacing.mdx b/content/docs/internals/namespacing.mdx new file mode 100644 index 000000000..253b86551 --- /dev/null +++ b/content/docs/internals/namespacing.mdx @@ -0,0 +1,77 @@ +--- +# cSpell:ignore yourcompany +title: Namespaces +sidebar: Namespaces +lang: en-US +keywords: + [ + pomerium, + identity access proxy, + namespacing, + namespaces, + self-service, + policy, + pomerium enterprise, + rbac, + abac, + ] +description: This page describes the concept of namespaces, why they're important for enabling self-service, and how they enforce RBAC. +--- + +In Pomerium Enterprise, a **Namespace** is a fundamental organizational unit that helps structure access control. You can think of it like a directory structure: you can nest namespaces, delegate rights to teams, and set parent-level policies that child namespaces inherit. + +Namespaces allow you to: + +- Organize resources and teams in a way that matches your organization's structure. +- Enable self-service for application owners without granting them full admin privileges. +- Enforce hierarchical policy (optional or mandatory). +- Apply [RBAC](https://en.wikipedia.org/wiki/Role-based_access_control) to the Pomerium Enterprise Console itself. + +:::enterprise + +**Directory Sync** is a Pomerium Enterprise feature. [Contact us](https://www.pomerium.com/enterprise-sales/) to upgrade today. + +::: + +### Self-Service Capabilities + +Once you place your applications behind an identity-aware proxy, application owners have a strong incentive to configure routes through it. With Namespaces, you can delegate route and policy configuration to the teams that own the applications, reducing the burden on global administrators. This boosts development velocity while preserving security because top-level admins can still enforce high-level security requirements. + +### Hierarchical Policy Enforcement + +Namespaces let you set policies at higher levels and inherit them downstream. You can define mandatory policies at the top level (like requiring a `yourcompany.com` email address or blocking known bad IPs) while still allowing application owners to apply more detailed rules for their specific routes. + +Because Pomerium relies on your Identity Provider for user and group data, your policies remain in sync with whatever user management system you already use. + +### RBAC for Enterprise Console Users + +Namespaces are central to how Pomerium Enterprise controls who can do what in the console. Pomerium defines three primary roles: + +**Guest (no role)** + +- Can authenticate into Pomerium but only see a list of namespaces. +- Cannot modify or view details of any resources. + +**Viewer** + +- Can view resources (Routes, Policies, Certificates) in a namespace and its children. +- Can see traffic dashboards and activity logs. + +**Manager** + +- Can create, edit, and delete routes, policies, and certificates for a namespace (and its children). +- Can reference policies and certificates from parent namespaces. + +:::caution + +Managers can create routes to a given upstream path in **their** namespace, but Managers in other namespaces can also create routes to the same path. To ensure only a single route can reach a service, use [Mutual Authentication](/docs/internals/mutual-auth) techniques like [mTLS](/docs/internals/certificates-and-tls) or [JWT verification](/docs/capabilities/getting-users-identity) on your upstream. Another option is using a service mesh like [Istio](/docs/guides/istio). + +::: + +**Admin** + +- Can manage all namespaces. +- Has global access to settings, sessions, and [service accounts](/docs/capabilities/service-accounts). +- Can see events and runtime data across the organization. + +With these roles, Namespaces provide a powerful way to control who can view or modify Pomerium Enterprise resources, while still allowing each team the freedom to manage its own space. diff --git a/content/docs/capabilities/ppl.mdx b/content/docs/internals/ppl.mdx similarity index 70% rename from content/docs/capabilities/ppl.mdx rename to content/docs/internals/ppl.mdx index 108ae2e71..8ecd0a113 100644 --- a/content/docs/capabilities/ppl.mdx +++ b/content/docs/internals/ppl.mdx @@ -2,7 +2,7 @@ # cSpell:ignore doqu outform pkey pubin yourdomain title: Policy Language -sidebar_label: Policy Language +sidebar_label: 'Policy Enforcement' description: Learn how to use Pomerium Policy Language to build context-aware authorization policies for routes. --- @@ -139,7 +139,7 @@ deny: Below is an exhaustive list of PPL criteria. -Entries marked with `*` denote criteria that are only available in the [Enterprise Console](/docs/enterprise) PPL builder. All other entries are available in both Pomerium Core and Pomerium Enterprise. +Entries marked with `*` denote criteria that are only available in the [Enterprise Console](/docs/deploy/enterprise) PPL builder. All other entries are available in both Pomerium Core and Pomerium Enterprise. | Criterion Name | Data Format | Description | | --- | --- | --- | @@ -153,7 +153,7 @@ Entries marked with `*` denote criteria that are only available in the [Enterpri | `device` | [Device matcher] | Returns true if the incoming request includes a valid device ID or type. | | `domain` | [String Matcher] | Returns true if the logged-in user's email address domain (the part after `@`) matches the given value. | | `email` | [String Matcher] | Returns true if the logged-in user's email address matches the given value. | -| \* `groups` | [String List Matcher] | Returns true if a user's group ID matches the supplied value **exactly**. `groups` data is only available after a successful directory sync. See [Identity Providers](/docs/identity-providers) for vendor-specific directory sync steps. | +| \* `groups` | [String List Matcher] | Returns true if a user's group ID matches the supplied value **exactly**. `groups` data is only available after a successful directory sync. See [Identity Providers](/docs/integrations/user-identity/identity-providers) for vendor-specific directory sync steps. | | `http_method` | [String Matcher] | Returns true if the HTTP method matches the given value. | | `http_path` | [String Matcher] | Returns true if the HTTP path matches the given value. | | `invalid_client_certificate` | Anything. Typically `true`. | Returns true if the incoming request does not have a trusted client certificate. By default, a `deny` rule using this criterion is added to all Pomerium policies when [downstream mTLS] is configured (but this default can be changed using the [Enforcement Mode](/docs/reference/downstream-mtls-settings#enforcement-mode) setting.) | @@ -163,7 +163,7 @@ Entries marked with `*` denote criteria that are only available in the [Enterpri | \* `time_of_day` | [Time of Day Matcher] | Returns true if the time of the request (for the current day) matches the constraints. | | `user` | [String Matcher] | Returns `true` if the logged-in user's ID matches the supplied value. (The actual value of the user ID claim depends on how the identity provider sets this value.) | -Entries marked with `*` denote criteria that are only available in the [Enterprise Console](/docs/enterprise) PPL builder. All other entries are available in both Pomerium Core and Pomerium Enterprise. +Entries marked with `*` denote criteria that are only available in the [Enterprise Console](/docs/deploy/enterprise) PPL builder. All other entries are available in both Pomerium Core and Pomerium Enterprise. ## Matchers @@ -289,8 +289,8 @@ A device matcher is an object with operators as keys. It supports the following - `is` - an exact match of the device ID. - `approved` - true if the device has been approved. This is an enterprise-only feature. - `type` - Specifies the type of device to match on. The available types are `enclave_only` and `any`. - - `enclave_only` will only match [platform authenticators](/docs/concepts/device-identity#secure-enclaves). These include TPM modules and hardware-backed keystores built into mobile devices. - - `any` will also match [hardware security keys](/docs/concepts/device-identity#hardware-security-keys). + - `enclave_only` will only match [platform authenticators](/docs/integrations/device-context/device-identity#secure-enclaves). These include TPM modules and hardware-backed keystores built into mobile devices. + - `any` will also match [hardware security keys](/docs/integrations/device-context/device-identity#hardware-security-keys). For example, a policy to allow any user with a registered device: @@ -315,7 +315,7 @@ Compare to a policy that only allows a set of specific devices: :::tip -Users can [find their device IDs](/docs/capabilities/device-identity#find-the-device-id) at the `/.pomerium` endpoint from any route. +Users can [find their device IDs](/docs/integrations/device-context/device-identity#find-the-device-id) at the `/.pomerium` endpoint from any route. ::: @@ -323,9 +323,9 @@ Users can [find their device IDs](/docs/capabilities/device-identity#find-the-de The record matcher is an object that uses operators as keys. It points to records collected from an [external data source](/docs/capabilities/integrations) defined in the Enterprise Console. Pomerium matches requests to a specific external data source using a record's [foreign key](/docs/capabilities/integrations#foreign-key). You can use data stored in a record as external context in an authorization policy. -The record matcher supports all of the [String Matcher](/docs/capabilities/ppl#string-matcher) and [String List Matcher](/docs/capabilities/ppl#string-list-matcher) operators. However, the following operators are specific to the record matcher: +The record matcher supports all of the [String Matcher](/docs/internals/ppl#string-matcher) and [String List Matcher](/docs/internals/ppl#string-list-matcher) operators. However, the following operators are specific to the record matcher: -- `type`: Identifies the [Record Type](/docs/capabilities/integrations#record-type) as it’s defined in the Enterprise Console +- `type`: Identifies the [Record Type](/docs/capabilities/integrations#record-type) as it's defined in the Enterprise Console - `field`: Specifies the field name as defined by the external data source - [Exists operator](#exists-operator) - [Numerical comparison operators](#numerical-comparison-operators) (`<`, `<=`, `=`, `>`, `>=`) @@ -335,7 +335,7 @@ The record matcher supports all of the [String Matcher](/docs/capabilities/ppl#s The “exists” operator is a **boolean**: - When set to `true`, it returns `ok` if it can find the corresponding external data source record in the Enterprise Console. -- When set to `false`, it returns `ok` if it can’t find the corresponding external data source record in the Enterprise Console. +- When set to `false`, it returns `ok` if it can't find the corresponding external data source record in the Enterprise Console. :::note @@ -455,11 +455,176 @@ allow: before: 4:30PM ``` +## Rego + +:::caution Rego Usage Requires Extreme Care + +Rego policies can be powerful, but improper usage may unintentionally open unauthorized access, deny valid requests, or even leak sensitive data. **Whenever possible, use [PPL](/docs/internals/ppl) instead**. If you're unsure whether your use case requires Rego, work with your Pomerium account representative or [contact support](mailto:support@pomerium.com) to see if your needs can be met using PPL-based policy criteria. + +::: + +Pomerium supports policies expressed in [Rego](https://www.openpolicyagent.org/docs/latest/#rego) for organizations that prefer to use [OPA](https://www.openpolicyagent.org/). + +See the [Outputs](#outputs), [Inputs](#inputs), and [Functions](#functions) reference sections below to learn how Rego policies apply to policy evaluation. + +:::enterprise + +Custom Rego policies is a [Pomerium Enterprise](/docs/deploy/enterprise) feature. + +::: + +In the [Enterprise Console](/docs/deploy/enterprise#enterprise-console), you can write custom Rego policies in the Rego Editor: + +![Apply Rego in Console editor](./img/ppl/ppl-rego-policy.png) + +:::note + +A policy can only support PPL or Rego. Once one is set, the other tab is disabled. + +::: + +## Outputs + +Authorization policy written in Rego is expected to return results in `allow` and/or `deny` rules: + +```rego +# a policy that always allows access +allow := true +``` + +```rego +# a policy that always denies access +deny := true +``` + +Pomerium grants access according to the same rules as [PPL](/docs/internals/ppl#actions): + +> Only two actions are supported: allow and deny. deny takes precedence over allow. More precisely: a user will have access to a route if at least one allow rule matches and no deny rules match. + +`allow` and `deny` rules support four forms: + +1. A simple boolean: + +```rego +allow := true +``` + +2. An array with a single boolean value: + +```rego +deny := [true] +``` + +3. An array with two values: a boolean and a **reason**: + +```rego +allow := [false, "user-unauthorized"] +``` + +4. An array with three values: a boolean, a reason, and additional data: + +```rego +allow := [false, "user-unauthorized", { "key": "value" }] +``` + +The **reason** value is useful for debugging, since it appears in [authorization logs](/docs/reference/authorize-log-fields#find-authorize-logs). There are two special reasons that trigger functionality in Pomerium: + +- `user-unauthenticated` indicates that the user needs to sign in, and results in a redirect to the Authenticate service +- `device-unauthenticated` indicates that the user needs to register a new device + +## Inputs + +Rego scripts are evaluated with inputs available on the `input` object: + +```rego +allow if input.http.method == "POST" +``` + +Rego defines the following inputs: + +| **Input name** | **Type** | **Description** | +| :-- | :-- | :-- | +| `http` | Object | Represents the HTTP request | +| `http.method` | String | The method used in the HTTP request | +| `http.hostname` | String | The hostname in the HTTP request | +| `http.path` | String | The path in the HTTP request | +| `http.url` | String | The full URL in the HTTP request | +| `http.headers` | Object | The headers in the HTTP request | +| `http.client_certificate` | Object | The client certificate details | +| `http.client_certificate.presented` | Boolean | `true` if the client presented a certificate | +| `http.client_certificate.leaf` | String | The leaf certificated provided by the client (unvalidated) | +| `http.client_certificate.intermediates` | String | The remainder of the client certificate chain | +| `http.ip` | String | The user's IP address | +| `http.session` | Object | Represents the user's session | +| `http.session.id` | String | The session ID | +| `http.is_valid_client_certificate` | Boolean | `true` if the presented client certificate is valid | + +## Functions + +The function below is available in Rego scripts: + +- `get_databroker_record(record_type, record_id)`: Returns data from the Databroker service. + +For example: + +```rego +session := get_databroker_record("type.googleapis.com/session.Session", input.session.id) +``` + +### Example Rego policy + +This example policy compares the `given_name` claim from a user's session against a list of popular first names, and only allows the 100 most popular first names. + +```rego +package pomerium.policy +session = s { + s = gset_databroker_record("type.googleapis.com/user.ServiceAccount", input.session.id) + s != null +} else = s { + s = get_databroker_record("type.googleapis.com/session.Session", input.session.id) + s != null +} else = {} { + true +} +user = u { + u = get_databroker_record("type.googleapis.com/user.User", session.user_id) +} else = {} { + true +} +allow = [true, {"custom-rego-authorized"}] { + # grab all the claims from the user and session objects + session_claims := object.get(session, "claims", {}) + user_claims := object.get(user, "claims", {}) + all_claims := object.union(session_claims, user_claims) + # get the given_name claim. claim values are always an array of strings + given_names := object.get(all_claims, "given_name", []) + # query a JSON dump of the most popular baby names from 2020 + response := http.send({ + "method": "GET", + "url": "https://raw.githubusercontent.com/aruljohn/popular-baby-names/master/2020/boy_names_2020.json", + "force_json_decode": true, + }) + # only include the top 100 names + all_names := response.body.names + popular_names := array.slice(all_names, 0, 99) + # check that there's a given name in the popular names + some i + some j + popular_names[i] == given_names[j] +} else = [false, {"custom-rego-unauthorized"}] { + session.id != "" +} else = [false, {"user-unauthenticated"}] { + true +} +``` + +This example pulls session data from the Databroker service using `type.googleapis.com/session.Session` for users and `type.googleapis.com/user.ServiceAccount` for service accounts. + [`allow_public_unauthenticated_access`]: /docs/reference/routes/public-access [`allow_any_authenticated_user`]: /docs/reference/routes/allow-any-authenticated-user [cors pre-flight requests]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#preflighted_requests [downstream mtls]: /docs/reference/downstream-mtls-settings -[pomerium enterprise]: /docs/enterprise/install +[pomerium enterprise]: /docs/deploy/enterprise/install [yaml]: https://en.wikipedia.org/wiki/YAML [string matcher]: #string-matcher [string list matcher]: #string-list-matcher diff --git a/content/docs/capabilities/programmatic-access.mdx b/content/docs/internals/programmatic-access.mdx similarity index 98% rename from content/docs/capabilities/programmatic-access.mdx rename to content/docs/internals/programmatic-access.mdx index c6979348c..e39d54c82 100644 --- a/content/docs/capabilities/programmatic-access.mdx +++ b/content/docs/internals/programmatic-access.mdx @@ -49,7 +49,7 @@ The value of `pomerium_jwt` is an opaque token, meaning the token does not carry To learn more about JWTs and identity verification, see the following docs: - [Identity Verification](/docs/capabilities/getting-users-identity) -- [JWT Verification](/docs/guides/verify-jwt) +- [JWT Verification](/docs/capabilities/getting-users-identity.mdx) ::: @@ -132,5 +132,5 @@ python3 scripts/programmatic_access.py \ [authorization bearer token]: https://developers.google.com/gmail/markup/actions/verifying-bearer-tokens -[identity provider]: /docs/identity-providers +[identity provider]: /docs/integrations/user-identity/identity-providers [proof key for code exchange]: https://tools.ietf.org/html/rfc7636 diff --git a/content/docs/internals/security.md b/content/docs/internals/security.md index 8cf5bac65..68f2f30d0 100644 --- a/content/docs/internals/security.md +++ b/content/docs/internals/security.md @@ -1,10 +1,11 @@ --- # cSpell:ignore LGUI -title: Pomerium Security Policy -sidebar_label: Security Policy +title: Pomerium's Security Policy & Threat Model +sidebar_label: Security & Threat Model lang: en-US -keywords: [pomerium, security, disclosure, vulnerabilities] +keywords: + [pomerium, security, disclosure, vulnerabilities, cryptography, encryption] toc_max_heading_level: 2 --- @@ -101,3 +102,89 @@ While researching, we'd like you to refrain from: - Any attacks against Pomerium's physical property or data centers. This page contains the most current version of our security guidelines, but we may revise them from time to time. + +## Cryptography + +Pomerium uses cryptography to secure data in transit, at rest, and to provide guarantees around confidentiality, authenticity, and integrity between its services and upstream servers it manages access for. + +### Encryption in transit + +Data in transit is protected by [Transport Layer Security](https://en.wikipedia.org/wiki/Transport_Layer_Security) (TLS). See our lab's [SSL Labs report](https://www.ssllabs.com/ssltest/analyze.html?d=authenticate.demo.pomerium.com&latest). + +### Downstream TLS + +For downstream TLS (connections from the user's client to Pomerium): + +- The minimum accepted version of TLS is 1.2 +- For TLS 1.2, the following cipher suites are offered, in this order: + - ECDHE-ECDSA-AES256-GCM-SHA384 + - ECDHE-RSA-AES256-GCM-SHA384 + - ECDHE-ECDSA-AES128-GCM-SHA256 + - ECDHE-RSA-AES128-GCM-SHA256 + - ECDHE-ECDSA-CHACHA20-POLY1305 + - ECDHE-RSA-CHACHA20-POLY1305 +- The following elliptic curves are offered, in this order: + - X25519 + - NIST P-256 + +#### Upstream TLS + +For upstream TLS (connections from Pomerium to the application or service): + +- The minimum accepted version of TLS is 1.2 +- For TLS 1.2, the following cipher suites are supported: + - ECDHE-ECDSA-AES256-GCM-SHA384 + - ECDHE-RSA-AES256-GCM-SHA384 + - ECDHE-ECDSA-AES128-GCM-SHA256 + - ECDHE-RSA-AES128-GCM-SHA256 + - ECDHE-ECDSA-CHACHA20-POLY1305 + - ECDHE-RSA-CHACHA20-POLY1305 + - ECDHE-ECDSA-AES128-SHA + - ECDHE-RSA-AES128-SHA + - AES128-GCM-SHA256 + - AES128-SHA + - ECDHE-ECDSA-AES256-SHA + - ECDHE-RSA-AES256-SHA + - AES256-GCM-SHA384 + - AES256-SHA +- The following elliptic curves are supported: + - X25519 + - NIST P-256 + - NIST P-384 + - NIST P-521 +- [HTTP Strict Transport Security](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security) (HSTS) with a long duration is used by default +- [Mutually authenticated](https://en.wikipedia.org/wiki/Mutual_authentication) TLS is used when client side certificates are provided + +#### Hosted Control Plane + +Connections between Pomerium proxy and the hosted control plane are encrypted in transit using TLS 1.3. + +For connections to the Pomerium Zero web console: + +- The minimum accepted TLS version is 1.2 +- TLS 1.3 is supported and preferred by the server +- For TLS 1.2, the following cipher suites are supported: + - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA + - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA + - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + *** + +### Encryption at rest[](https://www.pomerium.com/docs/internals/cryptography#encryption-at-rest) + +#### Hosted Services + +Block storage is encrypted using the 256-bit [Advanced Encryption Standard](https://wikipedia.org/wiki/Advanced_Encryption_Standard) (AES-256), or better, with symmetric keys. The encryption is done using a [FIPS 140-2 validated](https://cloud.google.com/security/compliance/fips-140-2-validated?hl=en) module. Furthermore, encryption is used throughout the infrastructure used to host the service according to the practices described in the Google [default encryption guide](https://cloud.google.com/docs/security/encryption/default-encryption?hl=en#hardware). + +For sensitive data, we employ field level encryption to securely store the values. These values are encrypted with AES-256-GCM using keys distinct from those used to encrypt the block storage. + +#### Enterprise Console + +Confidential data stored at rest is encrypted using the [authenticated encryption with associated data](https://en.wikipedia.org/wiki/Authenticated_encryption) construction [XChaCha20-Poly1305](https://libsodium.gitbook.io/doc/secret-key_cryptography/aead/chacha20-poly1305/xchacha20-poly1305_construction) with 196-bit nonces. Nonces are randomly generated for every encrypted object. When data is read, the authentication tag is checked for tampering. + +Encryption of the underlying block storage is the responsibility of the customer to meet their requirements in their environment. diff --git a/content/docs/troubleshooting.mdx b/content/docs/internals/troubleshooting.mdx similarity index 66% rename from content/docs/troubleshooting.mdx rename to content/docs/internals/troubleshooting.mdx index a841f964c..4336e8ecc 100644 --- a/content/docs/troubleshooting.mdx +++ b/content/docs/internals/troubleshooting.mdx @@ -1,18 +1,24 @@ --- -# cSpell:ignore errgroup tgroth servername - title: Troubleshooting description: Learn how to troubleshoot common configuration issues or work around any outstanding bugs. pagination_prev: null lang: en-US -keywords: [pomerium, troubleshooting, faq, frequently asked questions] +keywords: + [ + pomerium, + troubleshooting, + faq, + frequently asked questions, + cors, + cross-origin, + http, + https, + ] --- import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem'; -import GenerateRecoveryToken from '@site/content/_generate-recovery-token.md'; - -This article provides troubleshooting information for various tools and features in Pomerium. +import GenerateRecoveryToken from '@site/content/docs/admonitions/_generate-recovery-token.md'; ## Pomerium Zero @@ -33,7 +39,7 @@ If you've reserved port 443 for something else, you can change the port Pomerium 1. Enter the preferred port address 1. Apply your changes -![Changing the default port address for incoming connections in the Zero Console](./troubleshooting/img/zero/zero-change-port-address.png) +![Changing the default port address for incoming connections in the Zero Console](./img/troubleshooting/zero-change-port-address.png) :::info @@ -212,7 +218,7 @@ Ensure that the Proxy service knows about and trusts the certificate authority t COPY --from=builder /etc/ssl/certs/your-cert-bundle.crt /etc/ssl/certs/ca-certificates.crt ``` -- Finally, ensure that you aren't being man-in-the-middle'd or that some eager router isn't injecting its own certificate along the way. Use openssl to verify that your Proxy service is getting the certificate you think its getting. +- Finally, ensure that you aren't being man-in-the-middle'd or that some eager router isn't injecting its own certificate along the way. Use openssl to verify that your Proxy service is getting the certificate you think it's getting. ```bash openssl s_client -servername pomerium.io -connect pomerium.io:443 **Last Error** and **M 1. In the Console, go to **External Data** > **Last Error** to check for errors that may have caused the sync to fail. Go to **External Data** > **Metrics** to review request durations: -![Check Last Error to see if an error interrupted directory sync](./img/troubleshooting/polling-delays/last-error-and-request-duration.gif) +![Check Last Error to see if an error interrupted directory sync](./img/troubleshooting/last-error-and-request-duration.gif) 2. Select **Settings** > **Identity Providers** to see the **IdP Polling Min/Max Delay** settings. Increase the **Polling Min Delay** and **Polling Max Delay** settings before attempting to sync your directory again. Continue to monitor the sync; if it fails due to timeout, increase the durations. -![Find the IdP Polling Delays settings in the Console](./img/troubleshooting/polling-delays/adjust-polling-delay-settings.gif) +![Find the IdP Polling Delays settings in the Console](./img/troubleshooting/adjust-polling-delay-settings.gif) See [**Identity Provider Polling Min/Max Delay**](/docs/reference/identity-provider-settings#identity-provider-polling-minmax-delay) for more information. @@ -332,37 +338,37 @@ The `no_healthy_upstream` error means that there is an issue with the upstream s The `upstream_max_stream_duration_reached` error means that Pomerium cancelled the request because it exceeded the upstream server's maximum stream duration. - **Resolution**: By default, Pomerium sets a 10-second timeout for all requests. If your requests are taking longer than expected, see the [Connections - Timeouts](/docs/internals/connection#timeouts) page to learn how timeouts work with upstream connections, and how to configure timeouts to avoid this error. +**Resolution**: By default, Pomerium sets a 10-second timeout for all requests. If your requests are taking longer than expected, see the [Connections - Timeouts](/docs/internals/connection#timeouts) page to learn how timeouts work with upstream connections, and how to configure timeouts to avoid this error. ### Upstream Per Try Timeout The `upstream_per_try_timeout` error means that the final attempt to connect to the upstream server timed out. - **Resolution**: See the [Connections - Timeouts](/docs/internals/connection#timeouts) page to learn how timeouts work with upstream connections, and how to configure timeouts in Pomerium to avoid this error. +**Resolution**: See the [Connections - Timeouts](/docs/internals/connection#timeouts) page to learn how timeouts work with upstream connections, and how to configure timeouts in Pomerium to avoid this error. ### Upstream Reset After Response Started The `upstream_reset_after_response_started` error means that the upstream server reset the connection _after_ it began transmitting the response. - **Resolution**: See the [Connections - Timeouts](/docs/internals/connection#timeouts) page to learn how timeouts work with upstream connections, and how to configure timeouts in Pomerium to avoid this error. +**Resolution**: See the [Connections - Timeouts](/docs/internals/connection#timeouts) page to learn how timeouts work with upstream connections, and how to configure timeouts in Pomerium to avoid this error. ### Upstream Reset Before Response Started The `upstream_reset_before_response_started` error means the upstream server reset the connection _before_ it began transmitting the response. - **Resolution**: See the [Connections - Timeouts](/docs/internals/connection#timeouts) page to learn how timeouts work with upstream connections, and how to configure timeouts in Pomerium to avoid this error. +**Resolution**: See the [Connections - Timeouts](/docs/internals/connection#timeouts) page to learn how timeouts work with upstream connections, and how to configure timeouts in Pomerium to avoid this error. ### Upstream Response Timeout The `upstream_response_timeout` error means that the upstream server's response timed out. - **Resolution**: See the [Connections - Timeouts](/docs/internals/connection#timeouts) page to learn how timeouts work with upstream connections, and how to configure timeouts in Pomerium to avoid this error. +**Resolution**: See the [Connections - Timeouts](/docs/internals/connection#timeouts) page to learn how timeouts work with upstream connections, and how to configure timeouts in Pomerium to avoid this error. ### Via Upstream The `via_upstream` error means that the upstream service set the response code. - **Resolution**: To resolve this error, check the upstream service's application logs for more information about how the response status code is set. +**Resolution**: To resolve this error, check the upstream service's application logs for more information about how the response status code is set. --- @@ -376,7 +382,7 @@ When using Let's Encrypt certificates, you must use the `fullchain.pem` file, no If you're testing Pomerium locally with self-signed certificates, you may encounter the following self-signed certificate warning: -![proceed to verify](./img/troubleshooting/self-signed-warning/pomerium-proceed-to-verify.png) +![proceed to verify](./img/troubleshooting/pomerium-proceed-to-verify.png) To resolve this error: @@ -391,3 +397,202 @@ If you don't see an **Advanced** option: 1. Select **Enter** Your browser will redirect you to the route defined in your policy. + +--- + +## Cross-Origin Configuration + +For applications that need to send requests across different domains (for example, a web app hosted at `https://app.example.com` making calls to `https://api.example.com`), you may need to configure Cross-Origin Resource Sharing (CORS). Below is a thorough guide for setting up Pomerium to accommodate cross-domain requests. For more details on CORS, see the [MDN Documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) or [Microsoft Docs on CORS](https://docs.microsoft.com/en-us/iis/configuration/system.webServer/security/cors). + +Many applications, particularly single-page JavaScript applications or frameworks (React, Vue, Angular, Next.js, etc.), use multiple domains or subdomains when communicating with an API or service layer. The examples below illustrate how to configure Pomerium to support CORS, without modifying the underlying application code. + +### Configuration + +#### Pomerium + +```yaml +authenticate_service_url: https://authenticate.localhost.pomerium.io + +certificate_file: /pomerium/cert.pem +certificate_key_file: /pomerium/private-key.pem + +idp_provider: REPLACE +idp_client_id: REPLACE +idp_client_secret: REPLACE + +cookie_secret: V2JBZk0zWGtsL29UcFUvWjVDWWQ2UHExNXJ0b2VhcDI= + +routes: + - from: https://api.localhost.pomerium.io + to: http://api:8000 + allow_any_authenticated_user: true + cors_allow_preflight: true + set_response_headers: + 'Access-Control-Allow-Credentials': 'true' + 'Access-Control-Allow-Origin': 'https://app.localhost.pomerium.io' + 'Access-Control-Allow-Headers': 'X-Pomerium-Authorization' + - from: https://app.localhost.pomerium.io + to: http://app:8000 + allow_any_authenticated_user: true +``` + +#### Web Application + +```go +package main + +import ( + "net/http" +) + +func main() { + http.Handle("/", http.FileServer(http.Dir("."))) + http.ListenAndServe(":8000", nil) +} +``` + +```html + + + + Example Application + + + + +``` + +```javascript +(async () => { + const result = await fetch('https://api.localhost.pomerium.io', { + method: 'POST', + headers: { + Accept: 'application/json', + }, + }); + const json = await result.json(); + console.log('RESULT', json); +})(); +``` + +#### API Application + +```go +package main + +import ( + "io" + "net/http" +) + +func main() { + http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "application/json") + io.WriteString(w, `{ "message": "HELLO WORLD" }`) + }) + http.ListenAndServe(":8000", nil) +} +``` + +#### Docker-Compose + +```yaml +services: + pomerium: + image: pomerium/pomerium:main + ports: + - 443:443 + volumes: + - ./_wildcard.localhost.pomerium.io.pem:/pomerium/cert.pem:ro + - ./_wildcard.localhost.pomerium.io-key.pem:/pomerium/private-key.pem:ro + - ./config.yaml:/pomerium/config.yaml:ro + + app: + image: golang:latest + command: ['go', 'run', '.'] + environment: + GO111MODULE: 'off' + volumes: + - ./app.go:/go/app.go:ro + - ./index.html:/go/index.html:ro + - ./index.mjs:/go/index.mjs:ro + + api: + image: golang:latest + command: ['go', 'run', '.'] + environment: + GO111MODULE: 'off' + volumes: + - ./api.go:/go/api.go:ro +``` + +### Problem + +When accessing `app.localhost.pomerium.io`, the browser returns a 401 error for requests to `api.localhost.pomerium.io`: + +> URL: https://api.localhost.pomerium.io/ Status: 401 Unauthorized Source: Network Address: 127.0.0.1:443 Initiator: index.mjs:2 + +Because these domains differ, cookies may not be automatically sent, leading to authentication failures and CORS-related requests being denied. + +### Solutions + +#### Use a Single Domain + +Rather than using different subdomains for your app and API, configure them on a single domain with different paths. For example: + +```yaml +routes: + - from: https://app.localhost.pomerium.io + prefix: /api + to: http://api:8000 + allow_any_authenticated_user: true + - from: https://app.localhost.pomerium.io + to: http://app:8000 + allow_any_authenticated_user: true +``` + +Then your requests can share domain cookies and avoid CORS complexities. Update the JavaScript to reference `location.origin + '/api'` instead of the separate `api.localhost.pomerium.io` domain. + +#### Pass the Pomerium Credentials via a Header + +If you must use different domains, you can pass the JWT in a custom header. For example: + +```yaml +cookie_http_only: false +``` + +```javascript +(async () => { + const result = await fetch('https://api.localhost.pomerium.io', { + method: 'POST', + headers: { + Accept: 'application/json', + 'X-Pomerium-Authorization': document.cookie.substring( + document.cookie.indexOf('=') + 1, + ), + }, + }); + const json = await result.json(); + console.log('RESULT', json); +})(); +``` + +#### Share the Cookie + +If both subdomains share a parent domain, you can set a cookie domain such as `cookie_domain: '.localhost.pomerium.io'`. The browser will then share cookies among subdomains. You'll still need to configure your JavaScript client to send credentials: + +```javascript +(async () => { + const result = await fetch('https://api.localhost.pomerium.io', { + method: 'POST', + headers: { + Accept: 'application/json', + }, + credentials: 'include', + }); + const json = await result.json(); + console.log('RESULT', json); +})(); +``` + +> For more details on how cookies and credentials work in fetch or XHR, refer to [XMLHttpRequest/withCredentials on MDN](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials) and [fetch() API documentation](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API). diff --git a/content/docs/concepts/zero-trust.md b/content/docs/internals/zero-trust.md similarity index 97% rename from content/docs/concepts/zero-trust.md rename to content/docs/internals/zero-trust.md index da21d4561..2ec42f7d2 100644 --- a/content/docs/concepts/zero-trust.md +++ b/content/docs/internals/zero-trust.md @@ -19,7 +19,7 @@ keywords: ## History -For years, security has been synonymous with the perimeter security model. This model relies on the strength of its outer defenses. That is, your corporate network is safe so long as your perimeter is impenetrable. Perimeter security typically incorporates tools like firewalls, network segmentation, and VPNs. But perimeter security’s shortcomings have become apparent as: +For years, security has been synonymous with the perimeter security model. This model relies on the strength of its outer defenses. That is, your corporate network is safe so long as your perimeter is impenetrable. Perimeter security typically incorporates tools like firewalls, network segmentation, and VPNs. But perimeter security's shortcomings have become apparent as: - Software is shipped differently now. Organizations now deploy code outside their perimeter, in public and private clouds. - Workforce habits are changing. A majority of the global workforce now works remotely at least one day a week. @@ -96,7 +96,7 @@ The zero trust security model was first articulated by [John Kindervag](http://w - [Zero Trust Maturity Rubric and Tool Matrix](https://www.pomerium.com/blog/zero-trust-maturity-rubric-and-tool-matrix/) - [Benefits of Zero Trust Architecture](https://www.pomerium.com/blog/what-are-the-benefits-zero-trust-brings-to-organizations/) - [Children's Introduction Guide to Zero Trust](https://www.pomerium.com/blog/childrens-introduction-guide-to-zero-trust/) - - [Analyzing the US Government’s Adoption of Zero Trust](https://www.pomerium.com/blog/analyzing-the-us-government-adoption-of-zero-trust/) + - [Analyzing the US Government's Adoption of Zero Trust](https://www.pomerium.com/blog/analyzing-the-us-government-adoption-of-zero-trust/) - [Q&A with Zero Trust Architecture Writers from NIST](https://www.pomerium.com/blog/zta-qa-nist/) - [Demystifying Zero Trust](https://www.pomerium.com/blog/demystifying-zero-trust/) diff --git a/content/docs/k8s/img/httpbin.png b/content/docs/k8s/img/httpbin.png deleted file mode 100644 index 707bdae8f..000000000 Binary files a/content/docs/k8s/img/httpbin.png and /dev/null differ diff --git a/content/docs/k8s/img/logged-in-as.png b/content/docs/k8s/img/logged-in-as.png deleted file mode 100644 index 7de800a74..000000000 Binary files a/content/docs/k8s/img/logged-in-as.png and /dev/null differ diff --git a/content/docs/k8s/img/verify-app.png b/content/docs/k8s/img/verify-app.png deleted file mode 100644 index 093a2ca11..000000000 Binary files a/content/docs/k8s/img/verify-app.png and /dev/null differ diff --git a/content/docs/reference/_manage-devices.md b/content/docs/reference/_manage-devices.md index 018f3341f..646c9c949 100644 --- a/content/docs/reference/_manage-devices.md +++ b/content/docs/reference/_manage-devices.md @@ -1,6 +1,6 @@ From this page, administrators can manage new and existing device enrollments. -Device enrollment let's you create [policies](/docs/capabilities/ppl#device-matcher) that use [device identity](/docs/concepts/device-identity). +Device enrollment let's you create [policies](/docs/internals/ppl#device-matcher) that use [device identity](/docs/integrations/device-context/device-identity). -- Users can [self-enroll](/docs/capabilities/device-identity) devices, which must then be approved in the **Devices List** for policies requiring approved devices. +- Users can [self-enroll](/docs/integrations/device-context/device-identity) devices, which must then be approved in the **Devices List** for policies requiring approved devices. - Administrators can use the **New Enrollment** button to create a link for the user to enroll a device as pre-approved. See our [Pre-Approved Device Enrollment](/docs/guides/admin-enroll-device) guide for more information. diff --git a/content/docs/reference/access-log-fields.mdx b/content/docs/reference/access-log-fields.mdx index e3e4a97d6..bb6fc1428 100644 --- a/content/docs/reference/access-log-fields.mdx +++ b/content/docs/reference/access-log-fields.mdx @@ -66,7 +66,7 @@ Add **Custom Headers** in the Console: -| **[Parameter name](/docs/k8s/reference#spec)** | **Type** | **Default** | +| **[Parameter name](/docs/deploy/k8s/reference#spec)** | **Type** | **Default** | | :-- | :-- | :-- | | `accessLogFields` | Array of strings | See [Access Fields and Defaults](#access-fields-and-defaults) | diff --git a/content/docs/reference/authenticate-callback-path.mdx b/content/docs/reference/authenticate-callback-path.mdx index dbfea44bb..60102bc12 100644 --- a/content/docs/reference/authenticate-callback-path.mdx +++ b/content/docs/reference/authenticate-callback-path.mdx @@ -29,11 +29,11 @@ See [Google - Setting Redirect URI](https://developers.google.com/identity/proto :::tip **Note:** -Pomerium uses the [**Hosted Authenticate Service**](/docs/capabilities/hosted-authenticate-service) by default. +Pomerium uses the [**Hosted Authenticate Service**](/docs/capabilities/authentication) by default. -If you want to run Pomerium with a self-hosted authenticate service, you must include an [**identity provider**](/docs/identity-providers) and [**authenticate service URL**](/docs/reference/service-urls#authenticate-service-url) in your configuration. +If you want to run Pomerium with a self-hosted authenticate service, you must include an [**identity provider**](/docs/integrations/user-identity/identity-providers) and [**authenticate service URL**](/docs/reference/service-urls#authenticate-service-url) in your configuration. -See [**Self-Hosted Authenticate Service**](/docs/capabilities/self-hosted-authenticate-service) for more information. +See [**Self-Hosted Authenticate Service**](/docs/capabilities/authentication) for more information. ::: @@ -64,7 +64,7 @@ AUTHENTICATE_CALLBACK_PATH=/custom/callback -| **[Parameter name](/docs/k8s/reference#authenticate)** | **Type** | **Usage** | **Default** | +| **[Parameter name](/docs/deploy/k8s/reference#authenticate)** | **Type** | **Usage** | **Default** | | :-- | :-- | :-- | :-- | | `authenticate.callbackPath` | `string` | **optional** | `/oauth2/callback` | diff --git a/content/docs/reference/authorize-log-fields.mdx b/content/docs/reference/authorize-log-fields.mdx index 4af466402..d87efc146 100644 --- a/content/docs/reference/authorize-log-fields.mdx +++ b/content/docs/reference/authorize-log-fields.mdx @@ -78,7 +78,7 @@ Add **Custom Headers** in the Console: -| **[Parameter name](/docs/k8s/reference#spec)** | **Type** | **Default** | +| **[Parameter name](/docs/deploy/k8s/reference#spec)** | **Type** | **Default** | | :-- | :-- | :-- | | `authorizeLogFields` | Array of strings | See [Authorize Fields and Defaults](#authorize-log-fields-and-defaults) | diff --git a/content/docs/reference/autocert.mdx b/content/docs/reference/autocert.mdx index 02720df8e..b5b3598b1 100644 --- a/content/docs/reference/autocert.mdx +++ b/content/docs/reference/autocert.mdx @@ -25,13 +25,13 @@ Autocert can incorporate also certificates set manually in the Pomerium configur :::note Autocert support -The suite of Autocert settings listed below are supported only in [Pomerium Core](/docs/core) configurations. Here's what you should know about ACME support in other Pomerium products: +The suite of Autocert settings listed below are supported only in [Pomerium Core](/docs/deploy/core) configurations. Here's what you should know about ACME support in other Pomerium products: -- Pomerium Enterprise users should note that Autocert cannot be configured in the [Enterprise Console](/docs/enterprise#enterprise-console) or the Pomerium Enterprise [configuration file](/docs/enterprise/configure). Autocert is a bootstrap setting, meaning it must be configured in Pomerium Core (either in a configuration file or as an environment variable) before running Pomerium Enterprise. +- Pomerium Enterprise users should note that Autocert cannot be configured in the [Enterprise Console](/docs/deploy/enterprise#enterprise-console) or the Pomerium Enterprise [configuration file](/docs/deploy/enterprise/configure). Autocert is a bootstrap setting, meaning it must be configured in Pomerium Core (either in a configuration file or as an environment variable) before running Pomerium Enterprise. -- Kubernetes users should refer to the [Cert-Manager integration](/docs/k8s/ingress#cert-manager-integration) section for more information on configuring automated certificate management in the Pomerium Ingress Controller. +- Kubernetes users should refer to the [Cert-Manager integration](/docs/deploy/k8s/ingress#cert-manager-integration) section for more information on configuring automated certificate management in the Pomerium Ingress Controller. -- Pomerium Zero users should note that Pomerium automatically manages certificates for [starter domains](/docs/concepts/clusters#starter-domain) and [custom domains](/docs/capabilities/custom-domains). +- Pomerium Zero users should note that Pomerium automatically manages certificates for [starter domains](/docs/internals/clusters#starter-domain) and [custom domains](/docs/capabilities/custom-domains). ::: diff --git a/content/docs/reference/branding/img/branding-custom-error-message.png b/content/docs/reference/branding/img/branding-custom-error-message.png index 55fd94d9f..a83354131 100644 Binary files a/content/docs/reference/branding/img/branding-custom-error-message.png and b/content/docs/reference/branding/img/branding-custom-error-message.png differ diff --git a/content/docs/reference/branding/img/branding-custom-logo.png b/content/docs/reference/branding/img/branding-custom-logo.png index 1b5335105..298bf739b 100644 Binary files a/content/docs/reference/branding/img/branding-custom-logo.png and b/content/docs/reference/branding/img/branding-custom-logo.png differ diff --git a/content/docs/reference/branding/img/branding-dark-mode-secondary.png b/content/docs/reference/branding/img/branding-dark-mode-secondary.png index d91bf8132..18676361b 100644 Binary files a/content/docs/reference/branding/img/branding-dark-mode-secondary.png and b/content/docs/reference/branding/img/branding-dark-mode-secondary.png differ diff --git a/content/docs/reference/branding/img/branding-dark-mode.png b/content/docs/reference/branding/img/branding-dark-mode.png index db6baf97f..152118122 100644 Binary files a/content/docs/reference/branding/img/branding-dark-mode.png and b/content/docs/reference/branding/img/branding-dark-mode.png differ diff --git a/content/docs/reference/branding/img/branding-error-message-header.png b/content/docs/reference/branding/img/branding-error-message-header.png index de73afdb6..95ea63c9b 100644 Binary files a/content/docs/reference/branding/img/branding-error-message-header.png and b/content/docs/reference/branding/img/branding-error-message-header.png differ diff --git a/content/docs/reference/branding/img/branding-favicon-url.png b/content/docs/reference/branding/img/branding-favicon-url.png index a42886285..1f1279e8f 100644 Binary files a/content/docs/reference/branding/img/branding-favicon-url.png and b/content/docs/reference/branding/img/branding-favicon-url.png differ diff --git a/content/docs/reference/branding/img/branding-primary-light-mode.png b/content/docs/reference/branding/img/branding-primary-light-mode.png index 206802390..d128435b3 100644 Binary files a/content/docs/reference/branding/img/branding-primary-light-mode.png and b/content/docs/reference/branding/img/branding-primary-light-mode.png differ diff --git a/content/docs/reference/branding/img/branding-secondary-light-mode.png b/content/docs/reference/branding/img/branding-secondary-light-mode.png index 2266e4333..f2c961dbb 100644 Binary files a/content/docs/reference/branding/img/branding-secondary-light-mode.png and b/content/docs/reference/branding/img/branding-secondary-light-mode.png differ diff --git a/content/docs/reference/branding/img/branding-show-error-details.png b/content/docs/reference/branding/img/branding-show-error-details.png index cf5384992..62c169ee4 100644 Binary files a/content/docs/reference/branding/img/branding-show-error-details.png and b/content/docs/reference/branding/img/branding-show-error-details.png differ diff --git a/content/docs/reference/certificates.mdx b/content/docs/reference/certificates.mdx index 5cb1ae5ad..7a354b19e 100644 --- a/content/docs/reference/certificates.mdx +++ b/content/docs/reference/certificates.mdx @@ -91,7 +91,7 @@ View **Certificates**: certificates: pomerium/wildcard-localhost ``` -See Kubernetes [TLS Certificates](/docs/k8s/ingress#tls-certificates) for more information. +See Kubernetes [TLS Certificates](/docs/deploy/k8s/ingress#tls-certificates) for more information. diff --git a/content/docs/reference/codec-type.mdx b/content/docs/reference/codec-type.mdx index b8aa2682a..5e1d6de31 100644 --- a/content/docs/reference/codec-type.mdx +++ b/content/docs/reference/codec-type.mdx @@ -47,7 +47,17 @@ CODEC_TYPE=http2
-Kubernetes does not support `codec_type` +| **[Parameter name](/docs/deploy/k8s/reference#spec)** | **Type** | **Usage** | **Default** | +| :-- | :-- | :-- | :-- | +| `codecType` | `string` | **optional** | `auto` | + +### Examples + +```yaml +codecType: http2 +``` + +See [Kubernetes - Global Configuration](/docs/deploy/k8s/configure.md) for more information.
diff --git a/content/docs/reference/cookies.mdx b/content/docs/reference/cookies.mdx index 6124ad18d..64608d0f7 100644 --- a/content/docs/reference/cookies.mdx +++ b/content/docs/reference/cookies.mdx @@ -53,9 +53,9 @@ COOKIE_NAME=cookie_name
-| **[Parameter name](/docs/k8s/reference#cookie)** | **Type** | **Default** | -| :----------------------------------------------- | :------- | :---------- | -| `cookie.name` | `string` | `_pomerium` | +| **[Parameter name](/docs/deploy/k8s/reference#cookie)** | **Type** | **Default** | +| :-- | :-- | :-- | +| `cookie.name` | `string` | `_pomerium` | #### Examples {#cookie-name-examples} @@ -106,7 +106,7 @@ COOKIE_SECRET=tdkuWzUelRukP/6VYzopfh6kis7y5u5Ldl3MrIq9ZR0= -See Kubernetes [bootstrap secrets](/docs/k8s/configure#bootstrap-secrets) for more information. +See Kubernetes [bootstrap secrets](/docs/deploy/k8s/configure#bootstrap-secrets) for more information.
@@ -144,7 +144,7 @@ COOKIE_DOMAIN=localhost.pomerium.io
-| **[Parameter name](/docs/k8s/reference#cookie)** | **Type** | **Usage** | **Default** | +| **[Parameter name](/docs/deploy/k8s/reference#cookie)** | **Type** | **Usage** | **Default** | | :-- | :-- | :-- | :-- | | `cookie.domain` | `string` | **optional** | The host that set the cookie | @@ -195,9 +195,9 @@ Configure **Cookie HTTP Only** with the **Javascript Security** toggle button in -| **[Parameter name](/docs/k8s/reference#cookie)** | **Type** | **Default** | -| :----------------------------------------------- | :-------- | :---------- | -| `cookie.httpOnly` | `boolean` | `true` | +| **[Parameter name](/docs/deploy/k8s/reference#cookie)** | **Type** | **Default** | +| :-- | :-- | :-- | +| `cookie.httpOnly` | `boolean` | `true` | #### Examples {#cookie-http-only-examples} @@ -240,7 +240,7 @@ Set **Cookie Expiration** in the Console: ![Setting the cookie expiration time i -| **[Parameter name](/docs/k8s/reference#cookie)** | **Type** | **Default** | +| **[Parameter name](/docs/deploy/k8s/reference#cookie)** | **Type** | **Default** | | :-- | :-- | :-- | | `cookie.expire` | `string` ([Go Duration](https://golang.org/pkg/time/#Duration.String) formatting) | `14h` | @@ -289,7 +289,7 @@ See [Cookie SameSite Options](#cookie-samesite-options) for more information. -| **[Parameter name](/docs/k8s/reference#cookie)** | **Type** | **Usage** | **Default** | **Options** | +| **[Parameter name](/docs/deploy/k8s/reference#cookie)** | **Type** | **Usage** | **Default** | **Options** | | :-- | :-- | :-- | :-- | :-- | | `cookie.sameSite` | `string` | **optional** | ` Lax` (if unset) | See [Cookie SameSite Options](#cookie-samesite-options) | @@ -352,7 +352,7 @@ This is useful when deploying in environments that provide secret management lik -See Kubernetes [Secrets reference](/docs/k8s/reference#spec) for more information. +See Kubernetes [Secrets reference](/docs/deploy/k8s/reference#spec) for more information.
diff --git a/content/docs/reference/databroker.mdx b/content/docs/reference/databroker.mdx index d74dd61fb..44e36167d 100644 --- a/content/docs/reference/databroker.mdx +++ b/content/docs/reference/databroker.mdx @@ -52,7 +52,7 @@ DATABROKER_STORAGE_TYPE=postgres
-See Kubernetes [Storage reference](/docs/k8s/reference#storage) for more information. +See Kubernetes [Storage reference](/docs/deploy/k8s/reference#storage) for more information.
@@ -106,7 +106,7 @@ DATABROKER_STORAGE_CONNECTION_STRING_FILE=/run/secrets/db_connection_string
-See Kubernetes [Storage reference](/docs/k8s/reference#storage) for more information. +See Kubernetes [Storage reference](/docs/deploy/k8s/reference#storage) for more information.
diff --git a/content/docs/reference/downstream-mtls-settings.mdx b/content/docs/reference/downstream-mtls-settings.mdx index e6339961b..bc60f13f1 100644 --- a/content/docs/reference/downstream-mtls-settings.mdx +++ b/content/docs/reference/downstream-mtls-settings.mdx @@ -150,7 +150,7 @@ The Ingress Controller does not support these settings. 2. `policy` — Pomerium will not require client certificates for any routes unless explicitly required by a route policy. - This mode allows you to configure only certain routes to require a trusted client certificate. To configure a route to require client certificates, add a policy Deny rule with the `invalid_client_certificate` criterion. (See [Pomerium Policy Language](/docs/capabilities/ppl) for more information.) + This mode allows you to configure only certain routes to require a trusted client certificate. To configure a route to require client certificates, add a policy Deny rule with the `invalid_client_certificate` criterion. (See [Pomerium Policy Language](/docs/internals/ppl) for more information.) As in the previous mode, Pomerium will serve an HTML error page for any routes where client certificates are required but no trusted certificate is presented, and likewise these requests will be logged by the authorize service. diff --git a/content/docs/reference/global-timeouts.mdx b/content/docs/reference/global-timeouts.mdx index 3cb0746c6..231d1efe3 100644 --- a/content/docs/reference/global-timeouts.mdx +++ b/content/docs/reference/global-timeouts.mdx @@ -56,7 +56,7 @@ Set **Global Timeouts** in the Console: ![Global timeouts in Console](./img/time -| **[Parameter name](/docs/k8s/reference#timeouts)** | **Type** | **Defaults** | +| **[Parameter name](/docs/deploy/k8s/reference#timeouts)** | **Type** | **Defaults** | | :-- | :-- | :-- | | `timeouts.read` | [Go Duration] string | `30s` | @@ -103,7 +103,7 @@ Set **Global Timeouts** in the Console: ![Global timeouts in Console](./img/time -| **[Parameter name](/docs/k8s/reference#timeouts)** | **Type** | **Default** | +| **[Parameter name](/docs/deploy/k8s/reference#timeouts)** | **Type** | **Default** | | :-- | :-- | :-- | | `timeouts.write` | [Go Duration] string | `0` (no timeout) | @@ -150,7 +150,7 @@ Set **Global Timeouts** in the Console: ![Global timeouts in Console](./img/time -| **[Parameter name](/docs/k8s/reference#timeouts)** | **Type** | **Default** | +| **[Parameter name](/docs/deploy/k8s/reference#timeouts)** | **Type** | **Default** | | :-- | :-- | :-- | | `timeouts.idle` | [Go Duration] string | `5m` | diff --git a/content/docs/reference/grpc.mdx b/content/docs/reference/grpc.mdx index 97b2d76ce..8e78fe343 100644 --- a/content/docs/reference/grpc.mdx +++ b/content/docs/reference/grpc.mdx @@ -16,7 +16,7 @@ import TabItem from '@theme/TabItem'; Pomerium's gRPC settings apply to internal communication between: - Pomerium services running in [split service mode]. -- The Enterprise Console and core Pomerium in a [Pomerium Enterprise](/docs/enterprise) deployment. +- The Enterprise Console and core Pomerium in a [Pomerium Enterprise](/docs/deploy/enterprise) deployment. These settings have no effect on gRPC traffic proxied on a regular Pomerium route. diff --git a/content/docs/reference/identity-provider-settings.mdx b/content/docs/reference/identity-provider-settings.mdx index 0701ec45f..84bd064d3 100644 --- a/content/docs/reference/identity-provider-settings.mdx +++ b/content/docs/reference/identity-provider-settings.mdx @@ -23,23 +23,23 @@ This reference covers all of Pomerium's **Identity Provider Settings**: :::tip **Note:** -Pomerium uses the [**Hosted Authenticate Service**](/docs/capabilities/hosted-authenticate-service) by default. +Pomerium uses the [**Hosted Authenticate Service**](/docs/capabilities/authentication) by default. -If you want to run Pomerium with a self-hosted authenticate service, include an [**identity provider**](/docs/identity-providers) and [**authenticate service URL**](/docs/reference/service-urls#authenticate-service-url) in your configuration. +If you want to run Pomerium with a self-hosted authenticate service, include an [**identity provider**](/docs/integrations/user-identity/identity-providers) and [**authenticate service URL**](/docs/reference/service-urls#authenticate-service-url) in your configuration. -See [**Self-Hosted Authenticate Service**](/docs/capabilities/self-hosted-authenticate-service) for more information. +See [**Self-Hosted Authenticate Service**](/docs/capabilities/authentication) for more information. ::: ## Supported identity providers {#supported-identity-providers} -Pomerium supports all major single-sign on (SSO) identity providers. See the [identity providers](/docs/identity-providers) page for a list of supported SSO providers and guides to integrate each provider with Pomerium. +Pomerium supports all major single-sign on (SSO) identity providers. See the [identity providers](/docs/integrations/user-identity/identity-providers) page for a list of supported SSO providers and guides to integrate each provider with Pomerium. Pomerium can also integrate with any identity provider that supports OAuth 2.0 and OIDC protocols. ## Identity Provider Client ID {#identity-provider-client-id} -**Identity Provider Client ID** is the OAuth 2.0 Client Identifier retrieved from your identity provider. See your identity provider's documentation, and Pomerium's [identity provider](/docs/identity-providers/) docs for details. +**Identity Provider Client ID** is the OAuth 2.0 Client Identifier retrieved from your identity provider. See your identity provider's documentation, and Pomerium's identity provider docs for details. ### How to configure {#identity-provider-client-id-how-to-configure} @@ -70,14 +70,14 @@ Configure **Identity Provider Client ID** under **IDP Options** in the Console: -See [`identityProvider.secret`](/docs/k8s/reference#identityprovider) +See [`identityProvider.secret`](/docs/deploy/k8s/reference#identityprovider) ## Identity Provider Client Secret {#identity-provider-client-secret} -**Identity Provider Client Secret** is the OAuth 2.0 Secret Identifier retrieved from your identity provider. See your identity provider's documentation, and Pomerium's [identity provider](/docs/identity-providers/) docs for details. +**Identity Provider Client Secret** is the OAuth 2.0 Secret Identifier retrieved from your identity provider. See your identity provider's documentation, and Pomerium's identity provider docs for details. ### How to configure {#identity-provider-client-secret-how-to-configure} @@ -108,14 +108,14 @@ Configure **Identity Provider Client Secret** under **IDP Settings** in the Cons -See [`identityProvider.secret`](/docs/k8s/reference#identityprovider) for more information +See [`identityProvider.secret`](/docs/deploy/k8s/reference#identityprovider) for more information ## Identity Provider Client Secret File {#identity-provider-client-secret-file} -**Identity Provider Client Secret File** is the OAuth 2.0 Secret Identifier retrieved from your identity provider. See your identity provider's documentation, and Pomerium's [identity provider](/docs/identity-providers/) docs for details. +**Identity Provider Client Secret File** is the OAuth 2.0 Secret Identifier retrieved from your identity provider. See your identity provider's documentation, and Pomerium's identity provider docs for details. The identity provider client secret file points to a file containing the secret. This is useful when deploying in environments that provide secret management like [Docker Swarm](https://docs.docker.com/engine/swarm/secrets/). @@ -146,7 +146,7 @@ IDP_CLIENT_SECRET_FILE='/run/secrets/POMERIUM_CLIENT_SECRET' -See [`identityProvider.secret`](/docs/k8s/reference#identityprovider) for more information. +See [`identityProvider.secret`](/docs/deploy/k8s/reference#identityprovider) for more information. @@ -155,7 +155,7 @@ See [`identityProvider.secret`](/docs/k8s/reference#identityprovider) for more i **Identity Provider Name** is the short-hand name of a built-in OpenID Connect (OIDC) identity provider used for authentication. -See [identity provider](/docs/identity-providers/) for details. +See identity provider for details. The supported values for this setting are: @@ -178,7 +178,7 @@ The supported values for this setting are: | **Config file keys** | **Environment variables** | **Type** | **Usage** | | :-- | :-- | :-- | :-- | -| `idp_provider` | `IDP_PROVIDER` | `string` | **required** (if [self-hosting](/docs/capabilities/self-hosted-authenticate-service)) | +| `idp_provider` | `IDP_PROVIDER` | `string` | **required** (if [self-hosting](/docs/capabilities/authentication)) | #### Examples {#identity-provider-name-examples} @@ -200,7 +200,7 @@ Set **Identity Provider Name** under the **Identity Provider** options in the Co -See [`identityProvider.provider`](/docs/k8s/reference#identityprovider) for more information +See [`identityProvider.provider`](/docs/deploy/k8s/reference#identityprovider) for more information @@ -241,7 +241,7 @@ Configure **Identity Provider Request Params** under **Authenticate** settings i -See Kubernetes [`identityProvider.requestParams` and `identityProvider.requestParamsSecret`](/docs/k8s/reference#identityprovider) for more information +See Kubernetes [`identityProvider.requestParams` and `identityProvider.requestParamsSecret`](/docs/deploy/k8s/reference#identityprovider) for more information @@ -312,7 +312,7 @@ Configure **Identity Provider Scopes** under **Authenticate** settings in the Co -See Kubernetes [`identityProvider.scopes`](/docs/k8s/reference#identityprovider) for more information +See Kubernetes [`identityProvider.scopes`](/docs/deploy/k8s/reference#identityprovider) for more information @@ -361,7 +361,7 @@ Set the **Identity Provider URL** under **IDP Options** settings in the Console: -See Kubernetes [`identityProvider.url`](/docs/k8s/reference#identityprovider) for more information +See Kubernetes [`identityProvider.url`](/docs/deploy/k8s/reference#identityprovider) for more information diff --git a/content/docs/reference/img/495-error-page.png b/content/docs/reference/img/495-error-page.png index ccd705a01..1cc8ccd1a 100644 Binary files a/content/docs/reference/img/495-error-page.png and b/content/docs/reference/img/495-error-page.png differ diff --git a/content/docs/reference/img/auth-flow-diagram.svg b/content/docs/reference/img/auth-flow-diagram.svg index f361156fe..5c15ae073 100644 --- a/content/docs/reference/img/auth-flow-diagram.svg +++ b/content/docs/reference/img/auth-flow-diagram.svg @@ -1,399 +1 @@ -BrowserIdentity ProviderIngressPomeriumPomerium AuthNPomerium AuthZappGET /app/verify/appAuthenticated?No!HTTP 301 sign in callback urlHTTP 301: Oauth2 callback endpointSave sessionHTTP 301 app/verify/appAuthenticated?Yes!Authorized?Yes?HTTP 200OK!BrowserIdentity ProviderIngressPomeriumPomerium AuthNPomerium AuthZapp \ No newline at end of file +BrowserIdentity ProviderIngressPomeriumPomerium AuthNPomerium AuthZappGET /app/verify/appAuthenticated?No!HTTP 301 sign in callback urlHTTP 301: Oauth2 callback endpointSave sessionHTTP 301 app/verify/appAuthenticated?Yes!Authorized?Yes?HTTP 200OK!BrowserIdentity ProviderIngressPomeriumPomerium AuthNPomerium AuthZapp \ No newline at end of file diff --git a/content/docs/reference/img/certificates-valid-secure-certificate.png b/content/docs/reference/img/certificates-valid-secure-certificate.png index 68fc6275e..2b248e73c 100644 Binary files a/content/docs/reference/img/certificates-valid-secure-certificate.png and b/content/docs/reference/img/certificates-valid-secure-certificate.png differ diff --git a/content/docs/reference/img/certificates/cert-authority-console.png b/content/docs/reference/img/certificates/cert-authority-console.png index f47b7c3c8..3c1feaf5e 100644 Binary files a/content/docs/reference/img/certificates/cert-authority-console.png and b/content/docs/reference/img/certificates/cert-authority-console.png differ diff --git a/content/docs/reference/img/certificates/certs-console-list.png b/content/docs/reference/img/certificates/certs-console-list.png index c9af315af..edd4443bf 100644 Binary files a/content/docs/reference/img/certificates/certs-console-list.png and b/content/docs/reference/img/certificates/certs-console-list.png differ diff --git a/content/docs/reference/img/certificates/certs-console.png b/content/docs/reference/img/certificates/certs-console.png index 8a5b9399f..a1fcf8da5 100644 Binary files a/content/docs/reference/img/certificates/certs-console.png and b/content/docs/reference/img/certificates/certs-console.png differ diff --git a/content/docs/reference/img/chrome-client-cert-error-page.png b/content/docs/reference/img/chrome-client-cert-error-page.png index 642b965da..854e13599 100644 Binary files a/content/docs/reference/img/chrome-client-cert-error-page.png and b/content/docs/reference/img/chrome-client-cert-error-page.png differ diff --git a/content/docs/reference/img/console-devices.png b/content/docs/reference/img/console-devices.png index 3e9de4bae..fedea3ca8 100644 Binary files a/content/docs/reference/img/console-devices.png and b/content/docs/reference/img/console-devices.png differ diff --git a/content/docs/reference/img/console-service-account.png b/content/docs/reference/img/console-service-account.png index b78fb4656..28d1c6c1c 100644 Binary files a/content/docs/reference/img/console-service-account.png and b/content/docs/reference/img/console-service-account.png differ diff --git a/content/docs/reference/img/cookies/cookie-samesite.gif b/content/docs/reference/img/cookies/cookie-samesite.gif index 863433a46..fc84889d7 100644 Binary files a/content/docs/reference/img/cookies/cookie-samesite.gif and b/content/docs/reference/img/cookies/cookie-samesite.gif differ diff --git a/content/docs/reference/img/cookies/cookie-settings.png b/content/docs/reference/img/cookies/cookie-settings.png index 157836165..d0d6d2a98 100644 Binary files a/content/docs/reference/img/cookies/cookie-settings.png and b/content/docs/reference/img/cookies/cookie-settings.png differ diff --git a/content/docs/reference/img/cookies/cookies-expiration.png b/content/docs/reference/img/cookies/cookies-expiration.png index ba2f79f16..96c795a18 100644 Binary files a/content/docs/reference/img/cookies/cookies-expiration.png and b/content/docs/reference/img/cookies/cookies-expiration.png differ diff --git a/content/docs/reference/img/create-policy-1.png b/content/docs/reference/img/create-policy-1.png index 62138b390..a2d4f3fc4 100644 Binary files a/content/docs/reference/img/create-policy-1.png and b/content/docs/reference/img/create-policy-1.png differ diff --git a/content/docs/reference/img/create-policy-2.png b/content/docs/reference/img/create-policy-2.png index 32f9c221f..e064006ec 100644 Binary files a/content/docs/reference/img/create-policy-2.png and b/content/docs/reference/img/create-policy-2.png differ diff --git a/content/docs/reference/img/create-service-account.png b/content/docs/reference/img/create-service-account.png index 2d5505b7e..ddb2d3c8f 100644 Binary files a/content/docs/reference/img/create-service-account.png and b/content/docs/reference/img/create-service-account.png differ diff --git a/content/docs/reference/img/debug/debug-settings.png b/content/docs/reference/img/debug/debug-settings.png index 6cac0b186..e36002f14 100644 Binary files a/content/docs/reference/img/debug/debug-settings.png and b/content/docs/reference/img/debug/debug-settings.png differ diff --git a/content/docs/reference/img/deployment-diff.png b/content/docs/reference/img/deployment-diff.png index d52992a94..f4f66149a 100644 Binary files a/content/docs/reference/img/deployment-diff.png and b/content/docs/reference/img/deployment-diff.png differ diff --git a/content/docs/reference/img/dns/dns-lookup-family-options.gif b/content/docs/reference/img/dns/dns-lookup-family-options.gif index ec843eaf9..456fc1992 100644 Binary files a/content/docs/reference/img/dns/dns-lookup-family-options.gif and b/content/docs/reference/img/dns/dns-lookup-family-options.gif differ diff --git a/content/docs/reference/img/events-fullpage.png b/content/docs/reference/img/events-fullpage.png index cb9f3a545..e958d6e77 100644 Binary files a/content/docs/reference/img/events-fullpage.png and b/content/docs/reference/img/events-fullpage.png differ diff --git a/content/docs/reference/img/global-settings/log-level.gif b/content/docs/reference/img/global-settings/log-level.gif index 252442c2c..b59f08ab5 100644 Binary files a/content/docs/reference/img/global-settings/log-level.gif and b/content/docs/reference/img/global-settings/log-level.gif differ diff --git a/content/docs/reference/img/global-settings/proxy-log-level.gif b/content/docs/reference/img/global-settings/proxy-log-level.gif index 2a336b462..2ec358171 100644 Binary files a/content/docs/reference/img/global-settings/proxy-log-level.gif and b/content/docs/reference/img/global-settings/proxy-log-level.gif differ diff --git a/content/docs/reference/img/headers/x-forwarded-for-http-header.png b/content/docs/reference/img/headers/x-forwarded-for-http-header.png index 9f8c91225..e477298aa 100644 Binary files a/content/docs/reference/img/headers/x-forwarded-for-http-header.png and b/content/docs/reference/img/headers/x-forwarded-for-http-header.png differ diff --git a/content/docs/reference/img/http-logs/access-custom-headers.gif b/content/docs/reference/img/http-logs/access-custom-headers.gif index 00ef9dfab..d2045a3fe 100644 Binary files a/content/docs/reference/img/http-logs/access-custom-headers.gif and b/content/docs/reference/img/http-logs/access-custom-headers.gif differ diff --git a/content/docs/reference/img/http-logs/access-custom-logged-fields.gif b/content/docs/reference/img/http-logs/access-custom-logged-fields.gif index e02939469..8761481d0 100644 Binary files a/content/docs/reference/img/http-logs/access-custom-logged-fields.gif and b/content/docs/reference/img/http-logs/access-custom-logged-fields.gif differ diff --git a/content/docs/reference/img/http-logs/authorize-custom-headers.gif b/content/docs/reference/img/http-logs/authorize-custom-headers.gif index 576bc6671..7f2dcf9f4 100644 Binary files a/content/docs/reference/img/http-logs/authorize-custom-headers.gif and b/content/docs/reference/img/http-logs/authorize-custom-headers.gif differ diff --git a/content/docs/reference/img/http-logs/authorize-custom-logged-fields.gif b/content/docs/reference/img/http-logs/authorize-custom-logged-fields.gif index 4720bcf5f..cc590ab7f 100644 Binary files a/content/docs/reference/img/http-logs/authorize-custom-logged-fields.gif and b/content/docs/reference/img/http-logs/authorize-custom-logged-fields.gif differ diff --git a/content/docs/reference/img/http/http-redirect-address.png b/content/docs/reference/img/http/http-redirect-address.png index b5a0f9c20..d5600181e 100644 Binary files a/content/docs/reference/img/http/http-redirect-address.png and b/content/docs/reference/img/http/http-redirect-address.png differ diff --git a/content/docs/reference/img/idp_options/external-data-last-error.png b/content/docs/reference/img/idp_options/external-data-last-error.png index 79a64b9de..8624c636f 100644 Binary files a/content/docs/reference/img/idp_options/external-data-last-error.png and b/content/docs/reference/img/idp_options/external-data-last-error.png differ diff --git a/content/docs/reference/img/idp_options/external-data-request-duration.png b/content/docs/reference/img/idp_options/external-data-request-duration.png index f44fbda76..e668b572e 100644 Binary files a/content/docs/reference/img/idp_options/external-data-request-duration.png and b/content/docs/reference/img/idp_options/external-data-request-duration.png differ diff --git a/content/docs/reference/img/idp_options/identity-provider-name.png b/content/docs/reference/img/idp_options/identity-provider-name.png index afa36ba34..62dd1b6d8 100644 Binary files a/content/docs/reference/img/idp_options/identity-provider-name.png and b/content/docs/reference/img/idp_options/identity-provider-name.png differ diff --git a/content/docs/reference/img/idp_options/idp-directory-refresh-settings.png b/content/docs/reference/img/idp_options/idp-directory-refresh-settings.png index 06a43ff51..6d5561f1f 100644 Binary files a/content/docs/reference/img/idp_options/idp-directory-refresh-settings.png and b/content/docs/reference/img/idp_options/idp-directory-refresh-settings.png differ diff --git a/content/docs/reference/img/idp_options/idp-id-secret-route.png b/content/docs/reference/img/idp_options/idp-id-secret-route.png index 55f273637..431cd75da 100644 Binary files a/content/docs/reference/img/idp_options/idp-id-secret-route.png and b/content/docs/reference/img/idp_options/idp-id-secret-route.png differ diff --git a/content/docs/reference/img/idp_options/idp-options-console.png b/content/docs/reference/img/idp_options/idp-options-console.png index e97469c3f..859634254 100644 Binary files a/content/docs/reference/img/idp_options/idp-options-console.png and b/content/docs/reference/img/idp_options/idp-options-console.png differ diff --git a/content/docs/reference/img/idp_options/idp-polling-min-max-delay.png b/content/docs/reference/img/idp_options/idp-polling-min-max-delay.png index fe580c8db..703b527a2 100644 Binary files a/content/docs/reference/img/idp_options/idp-polling-min-max-delay.png and b/content/docs/reference/img/idp_options/idp-polling-min-max-delay.png differ diff --git a/content/docs/reference/img/idp_options/idp-providers.gif b/content/docs/reference/img/idp_options/idp-providers.gif index 748c853d6..2dca12338 100644 Binary files a/content/docs/reference/img/idp_options/idp-providers.gif and b/content/docs/reference/img/idp_options/idp-providers.gif differ diff --git a/content/docs/reference/img/idp_options/idp-request-params.png b/content/docs/reference/img/idp_options/idp-request-params.png index 9fd94e94d..cfdc47bf6 100644 Binary files a/content/docs/reference/img/idp_options/idp-request-params.png and b/content/docs/reference/img/idp_options/idp-request-params.png differ diff --git a/content/docs/reference/img/idp_options/idp-scopes.png b/content/docs/reference/img/idp_options/idp-scopes.png index 8e25183b0..d3ba15976 100644 Binary files a/content/docs/reference/img/idp_options/idp-scopes.png and b/content/docs/reference/img/idp_options/idp-scopes.png differ diff --git a/content/docs/reference/img/jaeger.png b/content/docs/reference/img/jaeger.png index ea1b1b53d..9ab8dbb6e 100644 Binary files a/content/docs/reference/img/jaeger.png and b/content/docs/reference/img/jaeger.png differ diff --git a/content/docs/reference/img/jwts/jwt-claims-headers-console.png b/content/docs/reference/img/jwts/jwt-claims-headers-console.png index f5bf9d7c5..43a5d62cc 100644 Binary files a/content/docs/reference/img/jwts/jwt-claims-headers-console.png and b/content/docs/reference/img/jwts/jwt-claims-headers-console.png differ diff --git a/content/docs/reference/img/new-enrollment.png b/content/docs/reference/img/new-enrollment.png index 99de9ce65..83a716958 100644 Binary files a/content/docs/reference/img/new-enrollment.png and b/content/docs/reference/img/new-enrollment.png differ diff --git a/content/docs/reference/img/pass-identity-headers/global-pass-identity-headers.gif b/content/docs/reference/img/pass-identity-headers/global-pass-identity-headers.gif index a51f87bd2..b7e33e4d7 100644 Binary files a/content/docs/reference/img/pass-identity-headers/global-pass-identity-headers.gif and b/content/docs/reference/img/pass-identity-headers/global-pass-identity-headers.gif differ diff --git a/content/docs/reference/img/proxy-settings/response-headers.png b/content/docs/reference/img/proxy-settings/response-headers.png index b52bbc874..9f8eedc57 100644 Binary files a/content/docs/reference/img/proxy-settings/response-headers.png and b/content/docs/reference/img/proxy-settings/response-headers.png differ diff --git a/content/docs/reference/img/routes/allow-any-authenticated-user/allow-any-user.png b/content/docs/reference/img/routes/allow-any-authenticated-user/allow-any-user.png index e9755f76a..c1226fa0e 100644 Binary files a/content/docs/reference/img/routes/allow-any-authenticated-user/allow-any-user.png and b/content/docs/reference/img/routes/allow-any-authenticated-user/allow-any-user.png differ diff --git a/content/docs/reference/img/routes/cors/cors-preflight.png b/content/docs/reference/img/routes/cors/cors-preflight.png index 9735cd21f..c8d9bb092 100644 Binary files a/content/docs/reference/img/routes/cors/cors-preflight.png and b/content/docs/reference/img/routes/cors/cors-preflight.png differ diff --git a/content/docs/reference/img/routes/direct-response/enterprise-direct-response-content-type.png b/content/docs/reference/img/routes/direct-response/enterprise-direct-response-content-type.png index 4b205d66e..33c873b23 100644 Binary files a/content/docs/reference/img/routes/direct-response/enterprise-direct-response-content-type.png and b/content/docs/reference/img/routes/direct-response/enterprise-direct-response-content-type.png differ diff --git a/content/docs/reference/img/routes/direct-response/enterprise-direct-response.png b/content/docs/reference/img/routes/direct-response/enterprise-direct-response.png index d81f6c6b5..4686bee63 100644 Binary files a/content/docs/reference/img/routes/direct-response/enterprise-direct-response.png and b/content/docs/reference/img/routes/direct-response/enterprise-direct-response.png differ diff --git a/content/docs/reference/img/routes/from/from-route.png b/content/docs/reference/img/routes/from/from-route.png index 93605923a..663f1d8c0 100644 Binary files a/content/docs/reference/img/routes/from/from-route.png and b/content/docs/reference/img/routes/from/from-route.png differ diff --git a/content/docs/reference/img/routes/gcs-sa-auth/enable-gcs-authn.png b/content/docs/reference/img/routes/gcs-sa-auth/enable-gcs-authn.png index 52fc4e778..3f423aab1 100644 Binary files a/content/docs/reference/img/routes/gcs-sa-auth/enable-gcs-authn.png and b/content/docs/reference/img/routes/gcs-sa-auth/enable-gcs-authn.png differ diff --git a/content/docs/reference/img/routes/headers/remove-request-headers.png b/content/docs/reference/img/routes/headers/remove-request-headers.png index ce7a34da9..1011d755e 100644 Binary files a/content/docs/reference/img/routes/headers/remove-request-headers.png and b/content/docs/reference/img/routes/headers/remove-request-headers.png differ diff --git a/content/docs/reference/img/routes/headers/rewrite-host-header.gif b/content/docs/reference/img/routes/headers/rewrite-host-header.gif index 33c47c32e..9646c6003 100644 Binary files a/content/docs/reference/img/routes/headers/rewrite-host-header.gif and b/content/docs/reference/img/routes/headers/rewrite-host-header.gif differ diff --git a/content/docs/reference/img/routes/headers/rewrite-response-header.png b/content/docs/reference/img/routes/headers/rewrite-response-header.png index e417880db..233e4dc8e 100644 Binary files a/content/docs/reference/img/routes/headers/rewrite-response-header.png and b/content/docs/reference/img/routes/headers/rewrite-response-header.png differ diff --git a/content/docs/reference/img/routes/headers/set-authorization-header.gif b/content/docs/reference/img/routes/headers/set-authorization-header.gif index ba8432213..f520f853d 100644 Binary files a/content/docs/reference/img/routes/headers/set-authorization-header.gif and b/content/docs/reference/img/routes/headers/set-authorization-header.gif differ diff --git a/content/docs/reference/img/routes/headers/set-request-headers.png b/content/docs/reference/img/routes/headers/set-request-headers.png index 604f772c3..5cfb9690b 100644 Binary files a/content/docs/reference/img/routes/headers/set-request-headers.png and b/content/docs/reference/img/routes/headers/set-request-headers.png differ diff --git a/content/docs/reference/img/routes/headers/set-response-headers-route.png b/content/docs/reference/img/routes/headers/set-response-headers-route.png index fd117d5be..cb271b719 100644 Binary files a/content/docs/reference/img/routes/headers/set-response-headers-route.png and b/content/docs/reference/img/routes/headers/set-response-headers-route.png differ diff --git a/content/docs/reference/img/routes/health-checks/health-checks.gif b/content/docs/reference/img/routes/health-checks/health-checks.gif index 00f49161f..ce988720b 100644 Binary files a/content/docs/reference/img/routes/health-checks/health-checks.gif and b/content/docs/reference/img/routes/health-checks/health-checks.gif differ diff --git a/content/docs/reference/img/routes/identity-headers/pass-identity-headers.png b/content/docs/reference/img/routes/identity-headers/pass-identity-headers.png index 16247bc61..264d6d2bb 100644 Binary files a/content/docs/reference/img/routes/identity-headers/pass-identity-headers.png and b/content/docs/reference/img/routes/identity-headers/pass-identity-headers.png differ diff --git a/content/docs/reference/img/routes/jwt-issuer-format.png b/content/docs/reference/img/routes/jwt-issuer-format.png index 5b6d4e1be..2c1fdf22b 100644 Binary files a/content/docs/reference/img/routes/jwt-issuer-format.png and b/content/docs/reference/img/routes/jwt-issuer-format.png differ diff --git a/content/docs/reference/img/routes/k8s/kubernetes-bearer-token.png b/content/docs/reference/img/routes/k8s/kubernetes-bearer-token.png index 6fffe34f4..e7130b905 100644 Binary files a/content/docs/reference/img/routes/k8s/kubernetes-bearer-token.png and b/content/docs/reference/img/routes/k8s/kubernetes-bearer-token.png differ diff --git a/content/docs/reference/img/routes/load-balancing/lb-policy.png b/content/docs/reference/img/routes/load-balancing/lb-policy.png index 74edeb683..f89067a44 100644 Binary files a/content/docs/reference/img/routes/load-balancing/lb-policy.png and b/content/docs/reference/img/routes/load-balancing/lb-policy.png differ diff --git a/content/docs/reference/img/routes/load-balancing/load-balancing-config.gif b/content/docs/reference/img/routes/load-balancing/load-balancing-config.gif index 829b2e010..6671696d8 100644 Binary files a/content/docs/reference/img/routes/load-balancing/load-balancing-config.gif and b/content/docs/reference/img/routes/load-balancing/load-balancing-config.gif differ diff --git a/content/docs/reference/img/routes/path-matching/exact-path.png b/content/docs/reference/img/routes/path-matching/exact-path.png index 37b9b8348..e2faf983d 100644 Binary files a/content/docs/reference/img/routes/path-matching/exact-path.png and b/content/docs/reference/img/routes/path-matching/exact-path.png differ diff --git a/content/docs/reference/img/routes/path-matching/prefix.png b/content/docs/reference/img/routes/path-matching/prefix.png index b0b350960..eba27a4ec 100644 Binary files a/content/docs/reference/img/routes/path-matching/prefix.png and b/content/docs/reference/img/routes/path-matching/prefix.png differ diff --git a/content/docs/reference/img/routes/path-rewrite/prefix-rewrite.png b/content/docs/reference/img/routes/path-rewrite/prefix-rewrite.png index 175b3e28f..a1d07e551 100644 Binary files a/content/docs/reference/img/routes/path-rewrite/prefix-rewrite.png and b/content/docs/reference/img/routes/path-rewrite/prefix-rewrite.png differ diff --git a/content/docs/reference/img/routes/policies/build-policy.png b/content/docs/reference/img/routes/policies/build-policy.png index 0c04974c7..954166091 100644 Binary files a/content/docs/reference/img/routes/policies/build-policy.png and b/content/docs/reference/img/routes/policies/build-policy.png differ diff --git a/content/docs/reference/img/routes/policies/create-policy.png b/content/docs/reference/img/routes/policies/create-policy.png index 3129e428b..72ce5f45b 100644 Binary files a/content/docs/reference/img/routes/policies/create-policy.png and b/content/docs/reference/img/routes/policies/create-policy.png differ diff --git a/content/docs/reference/img/routes/policies/edit-policy.png b/content/docs/reference/img/routes/policies/edit-policy.png index a307ff761..54c1d9c1f 100644 Binary files a/content/docs/reference/img/routes/policies/edit-policy.png and b/content/docs/reference/img/routes/policies/edit-policy.png differ diff --git a/content/docs/reference/img/routes/public-access/public-access.png b/content/docs/reference/img/routes/public-access/public-access.png index 7cc9918ef..74c83c33c 100644 Binary files a/content/docs/reference/img/routes/public-access/public-access.png and b/content/docs/reference/img/routes/public-access/public-access.png differ diff --git a/content/docs/reference/img/routes/redirects/console-redirects.png b/content/docs/reference/img/routes/redirects/console-redirects.png index f1ab5330f..b21afdc00 100644 Binary files a/content/docs/reference/img/routes/redirects/console-redirects.png and b/content/docs/reference/img/routes/redirects/console-redirects.png differ diff --git a/content/docs/reference/img/routes/regex/regex-rewrites.png b/content/docs/reference/img/routes/regex/regex-rewrites.png index 840103fe2..87955bb6a 100644 Binary files a/content/docs/reference/img/routes/regex/regex-rewrites.png and b/content/docs/reference/img/routes/regex/regex-rewrites.png differ diff --git a/content/docs/reference/img/routes/regex/regex.png b/content/docs/reference/img/routes/regex/regex.png index 944dc69cd..5e591de77 100644 Binary files a/content/docs/reference/img/routes/regex/regex.png and b/content/docs/reference/img/routes/regex/regex.png differ diff --git a/content/docs/reference/img/routes/timeouts/allow-websockets.png b/content/docs/reference/img/routes/timeouts/allow-websockets.png index c85fbc29e..da78d238e 100644 Binary files a/content/docs/reference/img/routes/timeouts/allow-websockets.png and b/content/docs/reference/img/routes/timeouts/allow-websockets.png differ diff --git a/content/docs/reference/img/routes/timeouts/idle-and-route-timeouts.png b/content/docs/reference/img/routes/timeouts/idle-and-route-timeouts.png index 0af9e82e7..13b9723b5 100644 Binary files a/content/docs/reference/img/routes/timeouts/idle-and-route-timeouts.png and b/content/docs/reference/img/routes/timeouts/idle-and-route-timeouts.png differ diff --git a/content/docs/reference/img/routes/timeouts/spdy.png b/content/docs/reference/img/routes/timeouts/spdy.png index e15b61596..b675117cc 100644 Binary files a/content/docs/reference/img/routes/timeouts/spdy.png and b/content/docs/reference/img/routes/timeouts/spdy.png differ diff --git a/content/docs/reference/img/routes/tls/route-tls-settings.png b/content/docs/reference/img/routes/tls/route-tls-settings.png index 9c61d6cea..da586303a 100644 Binary files a/content/docs/reference/img/routes/tls/route-tls-settings.png and b/content/docs/reference/img/routes/tls/route-tls-settings.png differ diff --git a/content/docs/reference/img/routes/tls/tls-client-certificate.png b/content/docs/reference/img/routes/tls/tls-client-certificate.png index 5b58df3ee..52db5117b 100644 Binary files a/content/docs/reference/img/routes/tls/tls-client-certificate.png and b/content/docs/reference/img/routes/tls/tls-client-certificate.png differ diff --git a/content/docs/reference/img/routes/to-routes.png b/content/docs/reference/img/routes/to-routes.png index 1c1cbe6b4..703b145d0 100644 Binary files a/content/docs/reference/img/routes/to-routes.png and b/content/docs/reference/img/routes/to-routes.png differ diff --git a/content/docs/reference/img/runtime-fullpage.png b/content/docs/reference/img/runtime-fullpage.png index 3875bc264..cd6e30c69 100644 Binary files a/content/docs/reference/img/runtime-fullpage.png and b/content/docs/reference/img/runtime-fullpage.png differ diff --git a/content/docs/reference/img/service-account-jwt.png b/content/docs/reference/img/service-account-jwt.png index 7aa664734..d072c8d53 100644 Binary files a/content/docs/reference/img/service-account-jwt.png and b/content/docs/reference/img/service-account-jwt.png differ diff --git a/content/docs/reference/img/sessions-fullpage.png b/content/docs/reference/img/sessions-fullpage.png index efd1288f4..8d16c5967 100644 Binary files a/content/docs/reference/img/sessions-fullpage.png and b/content/docs/reference/img/sessions-fullpage.png differ diff --git a/content/docs/reference/img/timeouts/default-upstream-timeout.png b/content/docs/reference/img/timeouts/default-upstream-timeout.png index 140f55972..265a06633 100644 Binary files a/content/docs/reference/img/timeouts/default-upstream-timeout.png and b/content/docs/reference/img/timeouts/default-upstream-timeout.png differ diff --git a/content/docs/reference/img/timeouts/timeouts-default.png b/content/docs/reference/img/timeouts/timeouts-default.png index 0ff8662d4..888103d24 100644 Binary files a/content/docs/reference/img/timeouts/timeouts-default.png and b/content/docs/reference/img/timeouts/timeouts-default.png differ diff --git a/content/docs/reference/img/tracing/default-tracing.png b/content/docs/reference/img/tracing/default-tracing.png index 456adb6b2..f8db7a4fb 100644 Binary files a/content/docs/reference/img/tracing/default-tracing.png and b/content/docs/reference/img/tracing/default-tracing.png differ diff --git a/content/docs/reference/img/tracing/jaeger-endpoints.png b/content/docs/reference/img/tracing/jaeger-endpoints.png index fb69a11d8..7d67a7c82 100644 Binary files a/content/docs/reference/img/tracing/jaeger-endpoints.png and b/content/docs/reference/img/tracing/jaeger-endpoints.png differ diff --git a/content/docs/reference/img/tracing/tracing-providers.png b/content/docs/reference/img/tracing/tracing-providers.png index 4f8fffe6b..dad9a10f2 100644 Binary files a/content/docs/reference/img/tracing/tracing-providers.png and b/content/docs/reference/img/tracing/tracing-providers.png differ diff --git a/content/docs/reference/img/tracing/zipkin-endpoint.png b/content/docs/reference/img/tracing/zipkin-endpoint.png index 1ccb3e8b5..d5ba65557 100644 Binary files a/content/docs/reference/img/tracing/zipkin-endpoint.png and b/content/docs/reference/img/tracing/zipkin-endpoint.png differ diff --git a/content/docs/reference/img/traffic-fullpage.png b/content/docs/reference/img/traffic-fullpage.png index da26dcbd7..13575f053 100644 Binary files a/content/docs/reference/img/traffic-fullpage.png and b/content/docs/reference/img/traffic-fullpage.png differ diff --git a/content/docs/reference/img/user-id.png b/content/docs/reference/img/user-id.png index 4da86334f..3b02e8cce 100644 Binary files a/content/docs/reference/img/user-id.png and b/content/docs/reference/img/user-id.png differ diff --git a/content/docs/reference/jwt-claim-headers.mdx b/content/docs/reference/jwt-claim-headers.mdx index dfc37cbdd..9907d9125 100644 --- a/content/docs/reference/jwt-claim-headers.mdx +++ b/content/docs/reference/jwt-claim-headers.mdx @@ -50,7 +50,7 @@ Format **JWT Claims Headers** in the Console: -| **[Parameter name](/docs/k8s/reference#spec)** | **Type** | **Usage** | +| **[Parameter name](/docs/deploy/k8s/reference#spec)** | **Type** | **Usage** | | :-- | :-- | :-- | | `jwtClaimHeaders` | map of strings | **optional** | @@ -67,7 +67,7 @@ jwtClaimHeaders: ### Format JWT Claims Headers -Any claim in Pomerium’s session JWT can be placed into a corresponding header and the JWT payload for upstream consumption. Claim information is sourced from your [identity provider](/docs/identity-providers) and Pomerium’s own session metadata. +Any claim in Pomerium's session JWT can be placed into a corresponding header and the JWT payload for upstream consumption. Claim information is sourced from your [identity provider](/docs/integrations/user-identity/identity-providers) and Pomerium's own session metadata. The header will have the following format: diff --git a/content/docs/reference/metrics.mdx b/content/docs/reference/metrics.mdx index 35fe60410..8dfa08dfc 100644 --- a/content/docs/reference/metrics.mdx +++ b/content/docs/reference/metrics.mdx @@ -56,7 +56,7 @@ METRICS_ADDRESS: 127.0.0.1:9090 -See Kubernetes [Metrics](/docs/k8s/install#metrics) +See Kubernetes [Metrics](/docs/deploy/k8s/install#metrics) diff --git a/content/docs/reference/pass-identity-headers.mdx b/content/docs/reference/pass-identity-headers.mdx index 7ca7fca1f..737794bd7 100644 --- a/content/docs/reference/pass-identity-headers.mdx +++ b/content/docs/reference/pass-identity-headers.mdx @@ -60,7 +60,7 @@ The button has three states: -| **[Parameter name](/docs/k8s/reference#spec)** | **Type** | **Usage** | **Default** | +| **[Parameter name](/docs/deploy/k8s/reference#spec)** | **Type** | **Usage** | **Default** | | :-- | :-- | :-- | :-- | | `passIdentityHeaders` | `boolean` | **optional** | \*`false` | @@ -70,7 +70,7 @@ The button has three states: passIdentityHeaders: true ``` -See [Kubernetes - Global Configuration](/docs/k8s/configure) for more information. +See [Kubernetes - Global Configuration](/docs/deploy/k8s/configure) for more information. diff --git a/content/docs/reference/reference.json b/content/docs/reference/reference.json index 81aaf3388..392d4b60c 100644 --- a/content/docs/reference/reference.json +++ b/content/docs/reference/reference.json @@ -207,7 +207,7 @@ }, "idp-options-auth0": { "id": "idp-options-auth0", - "path": "/../identity-providers/auth0", + "path": "/../integrations/auth0", "title": "Identity Provider Auth0", "description": "Click for information on Auth0", "type": "string", @@ -215,7 +215,7 @@ }, "idp-options-azure": { "id": "idp-options-azure", - "path": "/../identity-providers/azure", + "path": "/../integrations/azure", "title": "Identity Provider Azure", "description": "Click for information on Azure", "type": "string", @@ -223,7 +223,7 @@ }, "idp-options-github": { "id": "idp-options-github", - "path": "/../identity-providers/github", + "path": "/../integrations/github", "title": "Identity Provider Github", "description": "Click for information on Github", "type": "string", @@ -232,14 +232,14 @@ "idp-options-gitlab": { "id": "idp-options-gitlab", "title": "Identity Provider Gitlab", - "path": "/../identity-providers/gitlab", + "path": "/../integrations/gitlab", "description": "Click for information on Gitlab", "type": "string", "enterpriseOnly": true }, "idp-options-google": { "id": "idp-options-google", - "path": "/../identity-providers/google", + "path": "/../integrations/google", "title": "Identity Provider Google", "description": "Click for information on getting a service account from Google.", "type": "string", @@ -247,7 +247,7 @@ }, "idp-options-okta": { "id": "idp-options-okta", - "path": "/../identity-providers/okta", + "path": "/../integrations/okta", "title": "Identity Provider Okta", "description": "Click for information on Okta.", "type": "string", @@ -255,7 +255,7 @@ }, "idp-options-onelogin": { "id": "idp-options-onelogin", - "path": "/../identity-providers/one-login", + "path": "/../integrations/one-login", "title": "Identity Provider Onelogin", "description": "Click for information on Onelogin.", "type": "string", @@ -263,7 +263,7 @@ }, "idp-options-ping": { "id": "idp-options-ping", - "path": "/../identity-providers/ping", + "path": "/../integrations/ping", "title": "Identity Provider Ping", "description": "Click for information on Ping.", "type": "string", diff --git a/content/docs/reference/routes/allow-any-authenticated-user.mdx b/content/docs/reference/routes/allow-any-authenticated-user.mdx index ab0f65177..11531e73a 100644 --- a/content/docs/reference/routes/allow-any-authenticated-user.mdx +++ b/content/docs/reference/routes/allow-any-authenticated-user.mdx @@ -47,7 +47,7 @@ Enable **Any Authenticated User** in the **Policy Builder** in the Console: -| [**Annotation name**](/docs/k8s/ingress#set-ingress-annotations) | **Type** | **Default** | **Usage** | +| [**Annotation name**](/docs/deploy/k8s/ingress#set-ingress-annotations) | **Type** | **Default** | **Usage** | | :-- | :-- | :-- | :-- | | `allow_any_authenticated_user` | `boolean` | `false` | **optional** | diff --git a/content/docs/reference/routes/cluster-name.mdx b/content/docs/reference/routes/cluster-name.mdx index 757073b0b..7f75b50a6 100644 --- a/content/docs/reference/routes/cluster-name.mdx +++ b/content/docs/reference/routes/cluster-name.mdx @@ -35,7 +35,7 @@ Runtime metrics for **Cluster Name** would be available under `envoy_cluster_`_` -See Kubernetes [Ingress](/docs/k8s/ingress#metrics) for more information +See Kubernetes [Ingress](/docs/deploy/k8s/ingress#metrics) for more information diff --git a/content/docs/reference/routes/from.mdx b/content/docs/reference/routes/from.mdx index c950980c8..c3d6760d4 100644 --- a/content/docs/reference/routes/from.mdx +++ b/content/docs/reference/routes/from.mdx @@ -19,7 +19,7 @@ import TabItem from '@theme/TabItem'; The **From** URL is the externally accessible URL for a proxied HTTP request. -Specifying `tcp+https` for the scheme enables [TCP proxying](/docs/capabilities/tcp/) support for the route. You may map more than one port through the same hostname by specifying a different `:port` in the URL. +Specifying `tcp+https` or `udp+https` for the scheme enables [TCP proxying](/docs/capabilities/non-http/) or [UDP proxying](/docs/capabilities/non-http/udp) (available since v0.29) support for the route. You may map more than one port through the same hostname by specifying a different `:port` in the URL. ## How to configure @@ -93,7 +93,7 @@ Define a **From** route under **General** route settings in the Console: -See Kubernetes [Ingress](/docs/k8s/ingress) for more information. +See Kubernetes [Ingress](/docs/deploy/k8s/ingress) for more information. diff --git a/content/docs/reference/routes/headers.mdx b/content/docs/reference/routes/headers.mdx index 3e2b4604f..5dfd9d3e0 100644 --- a/content/docs/reference/routes/headers.mdx +++ b/content/docs/reference/routes/headers.mdx @@ -65,7 +65,7 @@ Configure **Host Rewrite** settings in the route **Headers** settings in the Con -| **[Annotation name](/docs/k8s/ingress#set-ingress-annotations)** | **Type** | **Usage** | +| **[Annotation name](/docs/deploy/k8s/ingress#set-ingress-annotations)** | **Type** | **Usage** | | :-- | :-- | :-- | | `host_rewrite` | `string` | **optional** | @@ -177,7 +177,7 @@ Configure **Set Request Headers** in the Console: -| **[Annotation name](/docs/k8s/ingress#set-ingress-annotations)** | **Type** | **Usage** | +| **[Annotation name](/docs/deploy/k8s/ingress#set-ingress-annotations)** | **Type** | **Usage** | | :-- | :-- | :-- | | `set_request_headers` | map of key-value pairs | **optional** | @@ -196,11 +196,11 @@ The following token substitutions are available: | **Token** | **Value** | | :-- | :-- | | `${pomerium.access_token}` | OAuth access token from the identity provider\* | -| `${pomerium.client_cert_fingerprint}` | Short form SHA-256 fingerprint of the presented client certificate (if [downstream mTLS](/docs/capabilities/mtls-clients) is enabled) | +| `${pomerium.client_cert_fingerprint}` | Short form SHA-256 fingerprint of the presented client certificate (if [downstream mTLS](/docs/internals/certificates-and-tls) is enabled) | | `${pomerium.id_token}` | OIDC ID token from the identity provider\* | | `${pomerium.jwt}` | [Pomerium JWT](/docs/capabilities/getting-users-identity) (this is the same value as in the [`X-Pomerium-Jwt-Assertion` header](/docs/reference/routes/pass-identity-headers-per-route)) | -\*The ID token and access token are not available when using the [Hosted Authenticate](/docs/capabilities/hosted-authenticate-service) service. +\*The ID token and access token are not available when using the [Hosted Authenticate](/docs/capabilities/authentication) service. **Note:** Token values must use the `${pomerium.}` syntax. To include a literal `$` character in a header value, use `$$`. @@ -248,7 +248,7 @@ Set **Remove Request Headers** in the Console: -| **[Annotation name](/docs/k8s/ingress#set-ingress-annotations)** | **Type** | **Usage** | +| **[Annotation name](/docs/deploy/k8s/ingress#set-ingress-annotations)** | **Type** | **Usage** | | :-- | :-- | :-- | | `remove_request_headers` | `string` | **optional** | @@ -291,7 +291,7 @@ Configure **Set Response Headers** in the Console: -| **[Annotation name](/docs/k8s/ingress#set-ingress-annotations)** | **Type** | **Usage** | +| **[Annotation name](/docs/deploy/k8s/ingress#set-ingress-annotations)** | **Type** | **Usage** | | :-- | :-- | :-- | | `set_response_headers` | `string` | **optional** | @@ -345,7 +345,7 @@ Configure **Rewrite Response Headers** in the Console: -| **[Annotation name](/docs/k8s/ingress#set-ingress-annotations)** | **Type** | **Usage** | +| **[Annotation name](/docs/deploy/k8s/ingress#set-ingress-annotations)** | **Type** | **Usage** | | :-- | :-- | :-- | | `rewrite_response_headers` | `object` | **optional** | diff --git a/content/docs/reference/routes/load-balancing-policy-config.mdx b/content/docs/reference/routes/load-balancing-policy-config.mdx index fba6097e7..9706a10e2 100644 --- a/content/docs/reference/routes/load-balancing-policy-config.mdx +++ b/content/docs/reference/routes/load-balancing-policy-config.mdx @@ -40,9 +40,9 @@ When [`lb_policy`](/docs/reference/routes/load-balancing#load-balancing-policy) -See Kubernetes [Ingress](/docs/k8s/ingress#load-balancing) for more information +See Kubernetes [Ingress](/docs/deploy/k8s/ingress#load-balancing) for more information -See [Load Balancing](/docs/capabilities/load-balancing) for example [configurations](/docs/capabilities/load-balancing#load-balancing-method) +See [Load Balancing](/docs/capabilities/routing) for example [configurations](/docs/capabilities/routing#load-balancing-method) diff --git a/content/docs/reference/routes/load-balancing.mdx b/content/docs/reference/routes/load-balancing.mdx index 42975d2f8..8bb673a32 100644 --- a/content/docs/reference/routes/load-balancing.mdx +++ b/content/docs/reference/routes/load-balancing.mdx @@ -56,7 +56,7 @@ Set the **Load Balancing Policy** in the Console: -| **[Annotation name](/docs/k8s/ingress#set-ingress-annotations)** | **Type** | **Usage** | **Default** | +| **[Annotation name](/docs/deploy/k8s/ingress#set-ingress-annotations)** | **Type** | **Usage** | **Default** | | :-- | :-- | :-- | :-- | | `lb_policy` | `enum` | **optional** | `ROUND_ROBIN` | @@ -67,7 +67,7 @@ ingress.pomerium.io/lb_policy: LEAST_REQUEST ingress.pomerium.io/least_request_lb_config: '{"choice_count": 2}' ``` -See [Kubernetes - Ingress Configuration](/docs/k8s/ingress) for more information. +See [Kubernetes - Ingress Configuration](/docs/deploy/k8s/ingress) for more information. @@ -190,7 +190,7 @@ Configure **Health Checks** under **Load Balancing** settings in the Console: -See Kubernetes [Ingress - load balancing](/docs/k8s/ingress#load-balancing) for more information. +See Kubernetes [Ingress - load balancing](/docs/deploy/k8s/ingress#load-balancing) for more information. diff --git a/content/docs/reference/routes/outlier-detection.mdx b/content/docs/reference/routes/outlier-detection.mdx index da7639959..fce682a57 100644 --- a/content/docs/reference/routes/outlier-detection.mdx +++ b/content/docs/reference/routes/outlier-detection.mdx @@ -43,7 +43,7 @@ outlier_detection: {'consecutive_5xx': 12} -See the [Load Balancing](/docs/capabilities/load-balancing#passive-health-checks) guide for more information +See the [Load Balancing](/docs/capabilities/routing#passive-health-checks) guide for more information diff --git a/content/docs/reference/routes/pass-identity-headers.mdx b/content/docs/reference/routes/pass-identity-headers.mdx index 8bbb9bc74..aa18281fd 100644 --- a/content/docs/reference/routes/pass-identity-headers.mdx +++ b/content/docs/reference/routes/pass-identity-headers.mdx @@ -53,7 +53,7 @@ Set **Pass Identity Headers** under **General** route settings in the Console: -| **[Annotation name](/docs/k8s/ingress#set-ingress-annotations)** | **Type** | **Usage** | **Default** | +| **[Annotation name](/docs/deploy/k8s/ingress#set-ingress-annotations)** | **Type** | **Usage** | **Default** | | :-- | :-- | :-- | :-- | | `pass_identity_headers` | `boolean` | **optional** | `false` | diff --git a/content/docs/reference/routes/path-matching.mdx b/content/docs/reference/routes/path-matching.mdx index 75f2b2ad4..fcf3f3ae4 100644 --- a/content/docs/reference/routes/path-matching.mdx +++ b/content/docs/reference/routes/path-matching.mdx @@ -51,7 +51,7 @@ Set **Path** under **Path Matching** settings in the Console: -See Kubernetes [Ingress](/docs/k8s/ingress#regular-expressions-path-matching) for more information +See Kubernetes [Ingress](/docs/deploy/k8s/ingress#regular-expressions-path-matching) for more information @@ -107,7 +107,7 @@ spec: pathType: Prefix ``` -See Kubernetes [Ingress](/docs/k8s/ingress#annotations) for more information +See Kubernetes [Ingress](/docs/deploy/k8s/ingress#annotations) for more information diff --git a/content/docs/reference/routes/path-rewriting.mdx b/content/docs/reference/routes/path-rewriting.mdx index 8036c3968..dcf7622f9 100644 --- a/content/docs/reference/routes/path-rewriting.mdx +++ b/content/docs/reference/routes/path-rewriting.mdx @@ -81,7 +81,7 @@ Configure **Prefix Rewrite** in the Console: -| **[Annotation name](/docs/k8s/ingress#set-ingress-annotations)** | **Type** | **Usage** | +| **[Annotation name](/docs/deploy/k8s/ingress#set-ingress-annotations)** | **Type** | **Usage** | | :-- | :-- | :-- | | `prefix_rewrite` | `string` | **optional** | diff --git a/content/docs/reference/routes/policy.mdx b/content/docs/reference/routes/policy.mdx index 63a5da13c..5da51f732 100644 --- a/content/docs/reference/routes/policy.mdx +++ b/content/docs/reference/routes/policy.mdx @@ -17,7 +17,7 @@ import TabItem from '@theme/TabItem'; The `policy` block inside a `route` definition defines the authorization policy applied to a route. Policies are defined using Pomerium Policy Language (**PPL**), a yaml-based markup designed to be easier to read and implement compared to current alternatives. -See [Pomerium Policy Language](/docs/capabilities/ppl) for a full explanation of how to write policies in PPL. +See [Pomerium Policy Language](/docs/internals/ppl) for a full explanation of how to write policies in PPL. ## How to configure @@ -63,7 +63,7 @@ Edit your policy: -| **[Annotation name](/docs/k8s/ingress#set-authorization-policy)** | **Type** | **Usage** | +| **[Annotation name](/docs/deploy/k8s/ingress#set-authorization-policy)** | **Type** | **Usage** | | :-- | :-- | :-- | | `policy` | `string` | **optional** | diff --git a/content/docs/reference/routes/public-access.mdx b/content/docs/reference/routes/public-access.mdx index e3a856871..07b1f6f76 100644 --- a/content/docs/reference/routes/public-access.mdx +++ b/content/docs/reference/routes/public-access.mdx @@ -62,7 +62,7 @@ Enable **Public Access** in the **Policy Builder** in the Console: -| **[Annotation name](/docs/k8s/ingress#set-ingress-annotations)** | **Type** | **Default** | **Usage** | +| **[Annotation name](/docs/deploy/k8s/ingress#set-ingress-annotations)** | **Type** | **Default** | **Usage** | | :-- | :-- | :-- | :-- | | `allow_public_unauthenticated_access` | `boolean`, `string` | `false` | **optional** | diff --git a/content/docs/reference/routes/readme.mdx b/content/docs/reference/routes/readme.mdx index cb8be5979..8e666869d 100644 --- a/content/docs/reference/routes/readme.mdx +++ b/content/docs/reference/routes/readme.mdx @@ -8,7 +8,7 @@ pagination_prev: null pagination_next: null --- -import RouteExample from '../../../examples/config/route.example.yaml.md'; +import RouteExample from '/content/examples/config/route.example.yaml.md'; # Routes @@ -19,6 +19,6 @@ import RouteExample from '../../../examples/config/route.example.yaml.md'; A route contains specific access and control definitions for a back-end service. Each route is a list item under the `routes` key. -Each route defines at minimum a `from` and `to` field, and a `policy` key defining authorization logic. Policies are defined using [Pomerium Policy Language](/docs/capabilities/ppl) (**PPL**). Additional options are listed below. +Each route defines at minimum a `from` and `to` field, and a `policy` key defining authorization logic. Policies are defined using [Pomerium Policy Language](/docs/internals/ppl) (**PPL**). Additional options are listed below. diff --git a/content/docs/reference/routes/timeouts.mdx b/content/docs/reference/routes/timeouts.mdx index ebe62a92c..bea944dca 100644 --- a/content/docs/reference/routes/timeouts.mdx +++ b/content/docs/reference/routes/timeouts.mdx @@ -55,7 +55,7 @@ Enable **Allow Websockets** in the Console: -| **[Annotation name](/docs/k8s/ingress#set-ingress-annotations)** | **Type** | **Default** | +| **[Annotation name](/docs/deploy/k8s/ingress#set-ingress-annotations)** | **Type** | **Default** | | :-- | :-- | :-- | | `allow_websockets` | `boolean`, `string` | `false` | @@ -97,7 +97,7 @@ Enable **SPDY** in the Console: -| **[Annotation name](/docs/k8s/ingress#set-ingress-annotations)** | **Type** | **Default** | +| **[Annotation name](/docs/deploy/k8s/ingress#set-ingress-annotations)** | **Type** | **Default** | | :-- | :-- | :-- | | `allow_spdy` | `boolean` | `false` | @@ -107,7 +107,7 @@ Enable **SPDY** in the Console: ingress.pomerium.io/allow_spdy: 'true' ``` -See [Kubernetes - Ingress Configuration](/docs/k8s/ingress) for more information. +See [Kubernetes - Ingress Configuration](/docs/deploy/k8s/ingress) for more information. @@ -141,7 +141,7 @@ Set the **Route Timeout** in the Console: -| **[Annotation name](/docs/k8s/ingress#set-ingress-annotations)** | **Type** | **Usage** | **Default** | +| **[Annotation name](/docs/deploy/k8s/ingress#set-ingress-annotations)** | **Type** | **Usage** | **Default** | | :-- | :-- | :-- | :-- | | `timeout` | `string` ([Go Duration](https://golang.org/pkg/time/#Duration.String) formatting) | **optional** | `30s` | @@ -189,7 +189,7 @@ Set **Idle Timeout** under route **Timeouts** settings in the Console: -| **[Annotation name](/docs/k8s/ingress#set-ingress-annotations)** | **Type** | **Usage** | **Default** | +| **[Annotation name](/docs/deploy/k8s/ingress#set-ingress-annotations)** | **Type** | **Usage** | **Default** | | :-- | :-- | :-- | :-- | | `idle_timeout` | `string` ([Go Duration](https://golang.org/pkg/time/#Duration.String) formatting) | **optional** | `5m` | diff --git a/content/docs/reference/routes/tls.mdx b/content/docs/reference/routes/tls.mdx index f88be0c52..8acdd9d38 100644 --- a/content/docs/reference/routes/tls.mdx +++ b/content/docs/reference/routes/tls.mdx @@ -27,7 +27,7 @@ This reference covers all of Pomerium's TLS route settings: If specified, Pomerium will present this client certificate to upstream services when requested to enforce [mutual authentication](https://en.wikipedia.org/wiki/Mutual_authentication) (mTLS). -For more details, see our [mTLS example repository](https://github.com/pomerium/pomerium/tree/main/examples/mutual-tls) and the [Upstream mTLS With Pomerium](/docs/capabilities/mtls-services) guide. +For more details, see our [mTLS example repository](https://github.com/pomerium/pomerium/tree/main/examples/mutual-tls) and the [Upstream mTLS With Pomerium](/docs/internals/certificates-and-tls) guide. ### How to configure {#how-to-configure-tls-client-certificate} @@ -60,7 +60,7 @@ Set the **TLS Client Certificate** under **TLS Settings** in the Console: -See Kubernetes [TLS Certificates](/docs/k8s/ingress#tls-certificates) for more information +See Kubernetes [TLS Certificates](/docs/deploy/k8s/ingress#tls-certificates) for more information @@ -97,7 +97,7 @@ Set **TLS Custom Certificate Authority** in the Console: -See Kubernetes [TLS Certificates](/docs/k8s/ingress#tls-certificates) for more information +See Kubernetes [TLS Certificates](/docs/deploy/k8s/ingress#tls-certificates) for more information @@ -110,7 +110,7 @@ This setting is deprecated, and will be removed in a future release. If you previously used this setting to require client certificates only on certain routes, you can achieve this same behavior by setting the new downstream mTLS [**Enforcement Mode**](/docs/reference/downstream-mtls-settings#enforcement-mode) option to the value `policy` and adding a policy deny rule with the `invalid_client_certificate` criterion on all routes that should require client certificates. -If you want to enforce an allowlist or denylist of specific certificates on a particular route, you can use the new [`client_certificate`](/docs/capabilities/ppl#certificate-matcher) policy criterion. +If you want to enforce an allowlist or denylist of specific certificates on a particular route, you can use the new [`client_certificate`](/docs/internals/ppl#certificate-matcher) policy criterion. If you do need to set completely different trusted client CAs for different routes, we recommend running separate Pomerium clusters for each set of trusted client CAs. @@ -118,7 +118,7 @@ If you do need to set completely different trusted client CAs for different rout If specified, downstream clients (like a user's browser) will be required to provide a valid client TLS certificate. This overrides the global `downstream_mtls.ca` option for this route. -See [Client-Side mTLS With Pomerium](/docs/concepts/mutual-auth.md) for more information. +See [Client-Side mTLS With Pomerium](/docs/internals/mutual-auth.md) for more information. ### How to configure {#how-to-configure-tls-downstream-client-certificate-authority} @@ -146,7 +146,7 @@ Set **TLS Downstream Client CA** in the Console: -See Kubernetes [TLS Certificates](/docs/k8s/ingress#tls-certificates) for more information +See Kubernetes [TLS Certificates](/docs/deploy/k8s/ingress#tls-certificates) for more information @@ -212,7 +212,7 @@ Enable **TLS Skip Verify** in the Console: -| **[Annotation name](/docs/k8s/ingress#set-ingress-annotations)** | **Type** | **Default** | +| **[Annotation name](/docs/deploy/k8s/ingress#set-ingress-annotations)** | **Type** | **Default** | | :-- | :-- | :-- | | `tls_skip_verify` | `boolean` | `false` | @@ -231,7 +231,7 @@ ingress.pomerium.io/tls_skip_verify: 'true' :::warning -TLS renegotiation is considered insecure and shouldn’t be used unless absolutely necessary. +TLS renegotiation is considered insecure and shouldn't be used unless absolutely necessary. ::: diff --git a/content/docs/reference/routes/to.mdx b/content/docs/reference/routes/to.mdx index 5e38e2fc5..c3f11623a 100644 --- a/content/docs/reference/routes/to.mdx +++ b/content/docs/reference/routes/to.mdx @@ -53,7 +53,7 @@ Set **To** in the Console: -See Kubernetes [Ingress](/docs/k8s/ingress) for more information. +See Kubernetes [Ingress](/docs/deploy/k8s/ingress) for more information. @@ -71,7 +71,7 @@ Multiple upstream resources can be targeted by using a list instead of a single ### Set load balancing weight -A load balancing weight may be associated with a particular upstream by appending `,[weight]` to the URL. The exact behavior depends on your [`lb_policy`](/docs/reference/routes/load-balancing#load-balancing-policy) setting. See [Load Balancing](/docs/capabilities/load-balancing) for example [configurations](/docs/capabilities/load-balancing#load-balancing-weight). +A load balancing weight may be associated with a particular upstream by appending `,[weight]` to the URL. The exact behavior depends on your [`lb_policy`](/docs/reference/routes/load-balancing#load-balancing-policy) setting. See [Load Balancing](/docs/capabilities/routing) for example [configurations](/docs/capabilities/routing#load-balancing-weight). ```yaml - from: https://example.com @@ -102,7 +102,7 @@ One use case is connecting to an insecure gRPC server. As gRPC requires HTTP/2, ### TCP routes -You can configure Pomerium to handle a [TCP route](/docs/capabilities/tcp) in one of two different ways. +You can configure Pomerium to handle a [TCP route](/docs/capabilities/non-http) in one of two different ways. If you specify a `to` URL with the `tcp://` scheme, Pomerium will proxy the raw TCP connection to the upstream service: @@ -122,6 +122,28 @@ This allows you to place Pomerium in front of another HTTP-to-TCP proxy. If you specify a list of multiple `to` URLs in one route, you may not include both `tcp://` and non-`tcp://` URLs. +### UDP Routes + +Starting in v0.29, you can configure Pomerium to handle a [UDP route](/docs/capabilities/non-http/udp) in one of two different ways. + +If you specify a `to` URL with the `udp://` scheme, Pomerium will proxy the raw UDP connection to the upstream service: + +```yaml +- from: udp+https://udp.example.com:3001 + to: udp://localhost:3001 +``` + +If you specify a `to` URL with the scheme `http://` or `https://`, Pomerium will instead proxy an HTTP CONNECT-UDP request to the upstream service: + +```yaml +- from: udp+https://udp.example.com:3001 + to: https://second-proxy.udp.example.com:3002 +``` + +This allows you to place Pomerium in front of another HTTP-to-UDP proxy. + +If you specify a list of multiple `to` URLs in one route, you may not include both `udp://` and non-`udp://` URLs. + :::note See [**Routing - Route matching order**](/docs/capabilities/routing#route-matching-order) for more information on how Pomerium processes and matches routes. diff --git a/content/docs/reference/runtime-flags.md b/content/docs/reference/runtime-flags.md index 5c238f862..94ad544e9 100644 --- a/content/docs/reference/runtime-flags.md +++ b/content/docs/reference/runtime-flags.md @@ -36,7 +36,7 @@ The available flags are: | :-- | :-- | :-- | | `config_hot_reload` | Enables automatic config reloading triggered whenever a configuration file is written to (either the main Pomerium configuration file or a file referenced from the main configuration). In some rare cases this may not work correctly, so this setting provides a way to disable this behavior. (See issue [#5079](https://github.com/pomerium/pomerium/issues/5079) for more context.) | `true` | | `envoy_resource_manager` | Monitors control group (cgroup) memory usage of all processes running in the container (including both Pomerium and Envoy) and applies overload actions when memory thresholds are exceeded to reduce memory consumption. See [memory thresholds](#envoy-resource-manager-memory-thresholds) to review thresholds and their corresponding overload actions. | `true` | -| `grpc_databroker_keepalive` | _(experimental)_ Enables gRPC keep-alive (HTTP/2 PING) requests on the databroker service connection. This may improve service reliability in [split service mode](/docs/capabilities/high-availability#service-mode) deployments where there are multiple firewalls in the connection path between different Pomerium services. | `false` | +| `grpc_databroker_keepalive` | _(experimental)_ Enables gRPC keep-alive (HTTP/2 PING) requests on the databroker service connection. This may improve service reliability in [split service mode](/docs/internals/configuration#service-mode) deployments where there are multiple firewalls in the connection path between different Pomerium services. | `false` | | `legacy_identity_manager` | The way Pomerium manages IdP session refresh has been newly rewritten in v0.26 for enhanced performance and reliability. When this flag is enabled, Pomerium will revert to the older implementation. | `false` | | `match_any_incoming_port` | For a route where the From URL does not contain a port number, allow it to match incoming requests with any port number. See the section on [Port matching behavior](/docs/reference/routes/from#port-matching-behavior) for more details. | `true` | | `pomerium_jwt_endpoint` | Temporary opt-out of the `/.pomerium/jwt` deprecation: when set to `true`, Pomerium will continue to issue a JWT from the deprecated `/.pomerium/jwt` endpoint. (This endpoint does not provide the desired security properties for the Pomerium JWT and will be removed in a future release.) | `false` | diff --git a/content/docs/reference/service-mode.mdx b/content/docs/reference/service-mode.mdx index 9a619288d..c5476bfa8 100644 --- a/content/docs/reference/service-mode.mdx +++ b/content/docs/reference/service-mode.mdx @@ -18,7 +18,7 @@ import TabItem from '@theme/TabItem'; ## Summary -**Service Mode** sets which service(s) to run. If testing, you may want to set to `all` and run Pomerium in [all-in-one mode](/docs/internals/configuration#all-in-one-vs-split-service-mode). In production, you'll likely want to spin up several instances of each service mode for [high availability](/docs/capabilities/high-availability). +**Service Mode** sets which service(s) to run. If testing, you may want to set to `all` and run Pomerium in [all-in-one mode](/docs/internals/configuration#all-in-one-vs-split-service-mode). In production, you'll likely want to spin up several instances of each service mode for [high availability](/docs/internals/configuration). ## How to configure diff --git a/content/docs/reference/service-urls.md b/content/docs/reference/service-urls.md index 06236966d..c108fd731 100644 --- a/content/docs/reference/service-urls.md +++ b/content/docs/reference/service-urls.md @@ -32,7 +32,7 @@ import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem'; import Pom Pomerium's service URL settings control how the different [Pomerium services](/docs/internals/architecture#component-level) communicate with each other. -The [authenticate service URL](#authenticate-service-url) setting also controls whether Pomerium will run its own authenticate service or use the [Hosted Authenticate Service](/docs/capabilities/hosted-authenticate-service). +The [authenticate service URL](#authenticate-service-url) setting also controls whether Pomerium will run its own authenticate service or use the [Hosted Authenticate Service](/docs/capabilities/authentication). The other service URL settings are needed only for split service deployments. When running in all-in-one mode (which is the recommended mode), these settings are not needed. @@ -40,9 +40,9 @@ The other service URL settings are needed only for split service deployments. Wh The **Authenticate Service URL** setting defines the externally accessible URL where Pomerium redirects end users (clients) to authenticate against an identity provider. -If not set, Pomerium will use the [Hosted Authenticate Service](/docs/capabilities/hosted-authenticate-service). +If not set, Pomerium will use the [Hosted Authenticate Service](/docs/capabilities/authentication). -If you prefer to use your own [identity provider](/docs/identity-providers), you'll need to set an authenticate service URL, and you will need this URL when configuring your identity provider client's OAuth callback URL. +If you prefer to use your own [identity provider](/docs/integrations/user-identity/identity-providers), you'll need to set an authenticate service URL, and you will need this URL when configuring your identity provider client's OAuth callback URL. If Pomerium is running in [split-service mode](/docs/internals/configuration#all-in-one-vs-split-service-mode), each Pomerium service requires the authenticate service URL in its configuration. @@ -79,9 +79,9 @@ AUTHENTICATE_SERVICE_URL=https://authenticate.corp.example.com -| **[Parameter name](/docs/k8s/reference#spec** | **Type** | **Usage** | -| :-------------------------------------------- | :------- | :----------- | -| `authenticate.url` | `URL` | **optional** | +| **[Parameter name](/docs/deploy/k8s/reference#spec** | **Type** | **Usage** | +| :-- | :-- | :-- | +| `authenticate.url` | `URL` | **optional** | ### Examples @@ -90,14 +90,14 @@ authenticate: url: https://authenticate.corp.example.com ``` -See the [Kubernetes - Global Configuration](/docs/k8s/configure#authenticate-endpoint) for more information. +See the [Kubernetes - Global Configuration](/docs/deploy/k8s/configure#authenticate-endpoint) for more information. ## Authenticate Internal Service URL -The **Authenticate Internal Service URL** setting is only required for split-service mode deployments where Pomerium can’t access the public Authenticate Service URL. +The **Authenticate Internal Service URL** setting is only required for split-service mode deployments where Pomerium can't access the public Authenticate Service URL. If set, the Authenticate Internal Service URL will be used for communication between other Pomerium services and the authenticate service. @@ -110,7 +110,7 @@ If set, the Authenticate Internal Service URL will be used for communication bet | :-- | :-- | :-- | :-- | | `authenticate_internal_service_url` | `AUTHENTICATE_INTERNAL_SERVICE_URL` | `URL` | \***optional** | -\* Excluding the `authenticate_internal_service_url` defaults to the [hosted authenticated service](/docs/capabilities/hosted-authenticate-service) if `authenticate_service_url` isn't defined. +\* Excluding the `authenticate_internal_service_url` defaults to the [hosted authenticated service](/docs/capabilities/authentication) if `authenticate_service_url` isn't defined. ### Examples @@ -186,7 +186,7 @@ The `authorize_service_url` is not customizable in all-in-one mode with the CRD ## Authorize Internal Service URL -The **Authorize Internal Service URL** setting is only required for split-service mode deployments where Pomerium can’t access the public Authorize Service URL. +The **Authorize Internal Service URL** setting is only required for split-service mode deployments where Pomerium can't access the public Authorize Service URL. If included, Authorize Internal Service URL will override Authorize Service URL. diff --git a/content/docs/reference/set-response-headers.mdx b/content/docs/reference/set-response-headers.mdx index 0e8154490..3cb6181c5 100644 --- a/content/docs/reference/set-response-headers.mdx +++ b/content/docs/reference/set-response-headers.mdx @@ -56,7 +56,7 @@ Configure **Response Headers** under **Proxy** settings in the Console: -| **[Annotation name](/docs/k8s/ingress#set-ingress-annotations)** | **Type** | **Default** | +| **[Annotation name](/docs/deploy/k8s/ingress#set-ingress-annotations)** | **Type** | **Default** | | :-- | :-- | :-- | | `set_response_headers` | `string` | see [Default headers](#default) | @@ -81,7 +81,7 @@ Strict-Transport-Security:max-age=31536000; includeSubDomains; preload, By default, conservative [secure HTTP headers](https://www.owasp.org/index.php/OWASP_Secure_Headers_Project) are set: -- `max-age=31536000` instructs the browser to pin the certificate for a domain for a year. This helps prevent man-in-the-middle attacks, but can create issues when developing new environments with temporary certificates. See [Troubleshooting - HSTS](/docs/troubleshooting#http-strict-transport-security-hsts) for more information. +- `max-age=31536000` instructs the browser to pin the certificate for a domain for a year. This helps prevent man-in-the-middle attacks, but can create issues when developing new environments with temporary certificates. See [Troubleshooting - HSTS](/docs/internals/troubleshooting) for more information. - `includeSubDomains` applies these rules to subdomains, which is how individual routes are defined. - `preload` instructs the browser to preload the certificate from an HSTS preload service if available. This means that the certificate can be loaded from an already-trusted secure connection, and the user never needs to connect to your domain without TLS. diff --git a/content/docs/reference/shared-secret.mdx b/content/docs/reference/shared-secret.mdx index 448796796..30aba9160 100644 --- a/content/docs/reference/shared-secret.mdx +++ b/content/docs/reference/shared-secret.mdx @@ -21,7 +21,7 @@ import TabItem from '@theme/TabItem'; :::note -If you adjust your shared secret and/or how it's accessed by Pomerium, you may create a [**secret mismatch**](/docs/troubleshooting#shared-secret-mismatch). +If you adjust your shared secret and/or how it's accessed by Pomerium, you may create a [**secret mismatch**](/docs/internals/troubleshooting). ::: @@ -37,9 +37,9 @@ If you adjust your shared secret and/or how it's accessed by Pomerium, you may c :::enterprise Shared Secret in Enterprise Configurations -If you're connecting to the [Enterprise Console](/docs/enterprise), your Pomerium Core and Enterprise configurations each require the same shared secret. +If you're connecting to the [Enterprise Console](/docs/deploy/enterprise), your Pomerium Core and Enterprise configurations each require the same shared secret. -See the [Enterprise Quickstart](/docs/enterprise/quickstart) for an example implementation. +See the [Enterprise Quickstart](/docs/deploy/enterprise/quickstart) for an example implementation. ::: @@ -73,7 +73,7 @@ SHARED_SECRET_FILE='/run/secrets/POMERIUM_SHARED_SECRET' | :---------------------- | :------- | :----------- | | `secrets.shared_secret` | `string` | **required** | -See Kubernetes [bootstrap secrets](/docs/k8s/reference#spec) for more information. +See Kubernetes [bootstrap secrets](/docs/deploy/k8s/reference#spec) for more information. diff --git a/content/docs/reference/signing-key.mdx b/content/docs/reference/signing-key.mdx index c976ec280..2b21399ce 100644 --- a/content/docs/reference/signing-key.mdx +++ b/content/docs/reference/signing-key.mdx @@ -42,7 +42,7 @@ import TabItem from '@theme/TabItem'; | :-------------------- | :------- | :----------- | | `secrets.signing_key` | `string` | **optional** | -See Kubernetes [bootstrap secrets](/docs/k8s/reference#spec) for more information. +See Kubernetes [bootstrap secrets](/docs/deploy/k8s/reference#spec) for more information. diff --git a/content/docs/reference/tls-derive.mdx b/content/docs/reference/tls-derive.mdx index 76b5cc67c..6ca267a53 100644 --- a/content/docs/reference/tls-derive.mdx +++ b/content/docs/reference/tls-derive.mdx @@ -19,7 +19,7 @@ import TabItem from '@theme/TabItem'; **Auto TLS** enables automatic TLS between Pomerium Core and Enterprise by deriving the certificate authority (CA) and server certificates from a `shared_secret`. -Auto TLS secures HTTPS and gRPC/TLS endpoints connecting the Console to the Databroker and Proxy services so you don’t have to manually generate certificates (it’s still an option for users who demand it). +Auto TLS secures HTTPS and gRPC/TLS endpoints connecting the Console to the Databroker and Proxy services so you don't have to manually generate certificates (it's still an option for users who demand it). ## How to configure diff --git a/content/docs/reference/use-proxy-protocol.mdx b/content/docs/reference/use-proxy-protocol.mdx index c17db5642..83c130bea 100644 --- a/content/docs/reference/use-proxy-protocol.mdx +++ b/content/docs/reference/use-proxy-protocol.mdx @@ -45,7 +45,7 @@ USE_PROXY_PROTOCOL=true -| **[Parameter name](/docs/k8s/reference#spec)** | **Type** | **Usage** | **Default** | +| **[Parameter name](/docs/deploy/k8s/reference#spec)** | **Type** | **Usage** | **Default** | | :-- | :-- | :-- | :-- | | `useProxyProtocol` | `boolean` | **optional** | `false` | diff --git a/content/docs/troubleshooting/cluster-status.mdx b/content/docs/troubleshooting/cluster-status.mdx deleted file mode 100644 index e34dbaaca..000000000 --- a/content/docs/troubleshooting/cluster-status.mdx +++ /dev/null @@ -1,129 +0,0 @@ ---- -id: cluster-status -title: Cluster Status -sidebar_label: Cluster Status -description: The Cluster Status page describes alerts you may see in the Zero Console regarding your cluster's health, and what you can do to resolve them. ---- - -# Cluster Status - -The [Status](https://console.pomerium.app/app/reports/status) page of the Zero Console displays notifications and alerts regarding the health of a cluster. If you see an alert in the Status page, it means something may be wrong with your cluster and you should take steps to resolve it. - -We've addressed all the cluster status alerts below. Refer to the relevant alert to learn how to fix it. - -## Certificates are expired or invalid {#certificates_current} - -This cluster status alert inspects a cluster's certificates to see if they expire within 10 days. It runs daily, and every time the cluster configuration is updated. - -**What causes this alert**: - -- If your cluster uses managed certificates provisioned by Pomerium, then this error is a bug. Please [contact support](https://discuss.pomerium.com/). -- If you manually uploaded your own custom certificate, then you must upload a new certificate. - -**Steps to resolve**: Upload a valid certificate, or allow Pomerium to automate certificate management for you by adding a [Custom Domain](/docs/capabilities/custom-domains). - -## Hostnames do not have matching certificates {#certificates_match_hostnames} - -This cluster status alert ensures that all the hostnames available in a cluster's configuration have matching certificates. It runs every time the cluster configuration is updated. - -**What causes this alert**: Either the [From URL](/docs/reference/routes/from) in a route block is incorrect, or the certificate is missing. - -**Steps to resolve**: Make sure all [From URLs](/docs/reference/routes/from) are correct, and that the hostnames have matching certificates. - -:::info - -For more information on certificates in Pomerium, see the following pages: - -- [**Certificates**](/docs/guides/certificates) -- [**Certificates reference**](/docs/reference/certificates) - -::: - -## Cluster configuration is not current {#cluster_config_current} - -This cluster status alert makes sure the cluster is running the latest changeset. It runs daily to check for the latest configuration, or every time the cluster configuration is updated. - -**What causes this alert**: This cluster status alert may indicate cluster connectivity issues. Specifically, Pomerium Zero can't connect to the cluster to apply the latest changeset to its configuration. - -**Steps to resolve**: Restart the cluster. If that doesn't resolve the issue, please [contact support](https://discuss.pomerium.com/). - -## Cluster version is not current {#cluster_version_current} - -This cluster status alert makes sure the cluster replica is running the latest release. It runs daily. - -**What causes this alert**: The replica is not running the latest version of Pomerium Zero. - -**Steps to resolve**: Update your Pomerium Zero cluster configuration to run the latest version of Pomerium. - -## Cluster using an in-memory storage backend {#persistent_backend} - -This cluster status alert throws an error if it detects a cluster isn't connected to a persistent storage backend. It runs every time the cluster configuration is updated. - -**What causes this alert**: - -By default, a cluster uses an in-memory storage backend to synchronize replicas. This does not persist your configuration. For production environments, we recommend connecting each cluster instance to its own dedicated PostgreSQL database. See the [**Persistence**](/docs/internals/data-storage#backends) page for instructions. - -**Steps to resolve**: See the [**Databroker Storage Connection String**](/docs/reference/databroker#databroker-storage-connection-string) reference page to learn how to connect to a database instance in Pomerium. - -## Incompatible configuration {#config.databroker.build} - -This cluster status alert looks for configuration incompatibilities in a replica. It runs every time the cluster configuration is updated. - -**What causes this alert**: This is caused by a version incompatibility in the cluster configuration. For example, you somehow apply a configuration change that isn't compatible with your version of Pomerium Zero. - -**Steps to resolve**: If you see this warning, please [contact support](https://discuss.pomerium.com/). - -## Cluster can't communicate with the storage backend {#storage.backend} - -This cluster status alert monitors the connection to a PostgreSQL database. It runs every time the cluster configuration is updated. - -**What causes this alert**: Pomerium can't connect to your PostgreSQL database. - -**Steps to resolve**: Check the parameters of your [**Databroker Storage Connection String**](/docs/reference/databroker#databroker-storage-connection-string). - -## There's an issue with cluster configuration {#xds.cluster} - -This cluster status alert tells you if Envoy accepted the cluster configuration or not after a configuration update. - -**What causes this alert**: If you see this warning, please [contact support](https://discuss.pomerium.com/). - -## There's an issue with the network listener {#xds.listener} - -This cluster status alert makes sure the network listener is configured correctly. It runs every time the cluster configuration is updated. - -**What causes this alert**: Typically, this error is caused when Pomerium's network listener can't bind to the cluster's port. The error may also be the result of a non-root process with insufficient permissions attempting to bind to a privileged port. - -**Steps to resolve**: - -- If this is a port binding error, you may need to kill a process running on that port or specify a port to bind to. -- If this is a permissions issue, you may need to add the `CAP_NET_BIND_SERVICE` capability to the process. - -## There's an issue with the route configuration {#xds.route-configuration} - -This cluster status alert verifies the route configuration. It runs every time the cluster configuration is updated. - -**What causes this alert**: A route misconfiguration in a cluster. - -**Steps to resolve**: If you see this warning, it's likely a problem with Pomerium. Please [contact support](https://discuss.pomerium.com/). - -## There's an issue with the configuration {#xds.other} - -This cluster status alert monitors [xDS](https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol) issues in a replica. It runs every time the cluster configuration is updated. - -**What causes this alert**: If you see this warning, it's likely a problem with Pomerium. Please [contact support](https://discuss.pomerium.com/). - -## Pomerium can't write some of its cache files {#zero.bootstrap-config.save} - -This cluster status alert makes sure Pomerium can persist a replica's bootstrap configuration. It runs when you start a cluster, or every time the cluster configuration is updated. - -**What causes this alert**: Pomerium doesn't have sufficient permissions to read from a replica's configuration file. - -**Steps to resolve**: Check your file permissions to make sure Pomerium has read access. - -## Cluster connectivity issues with the cloud {#zero.connect} - -This cluster status alert monitors the connection between the Pomerium Zero cloud and a cluster. It maintains a consistent streaming connection. - -**What causes this alert**: Connectivity issues between Pomerium Zero and a cluster. - -**Steps to resolve**: You may experience this issue if you're accessing Pomerium Zero behind a firewall. Check your firewall settings to make sure it allows HTTP and HTTPS traffic. diff --git a/content/docs/troubleshooting/img/zero/zero-change-port-address.png b/content/docs/troubleshooting/img/zero/zero-change-port-address.png deleted file mode 100644 index c7ecd921a..000000000 Binary files a/content/docs/troubleshooting/img/zero/zero-change-port-address.png and /dev/null differ diff --git a/content/docs/versions.mdx b/content/docs/versions.mdx index 0cdc82bee..1dd281349 100644 --- a/content/docs/versions.mdx +++ b/content/docs/versions.mdx @@ -3,9 +3,9 @@ title: Archived Versions displayed_sidebar: documentation --- -import DocVersions from '../../src/components/DocVersions'; +import DocVersions from '@site/src/components/DocVersions'; -If you're running a previous version of Pomerium, we suggest [upgrading](/docs/core/upgrading). In addition to fixes and new features, updated versions can patch security issues as they are discovered. +If you're running a previous version of Pomerium, we suggest [upgrading](/docs/deploy/upgrading.mdx). In addition to fixes and new features, updated versions can patch security issues as they are discovered. If you're unable to upgrade Pomerium, you can use the links below to find documentation for previous versions. diff --git a/content/docs/zero.mdx b/content/docs/zero.mdx deleted file mode 100644 index e93459349..000000000 --- a/content/docs/zero.mdx +++ /dev/null @@ -1,33 +0,0 @@ ---- -id: zero -title: What is Pomerium Zero? -description: Learn about Pomerium Zero, a hybrid-cloud, zero-trust reverse proxy that provides seamless access to your services. -sidebar_label: Pomerium Zero ---- - -# What is Pomerium Zero? - -Welcome to **Pomerium Zero**, a hybrid-cloud zero-trust solution that provides clientless, remote access to your services without a VPN. Built on top of Pomerium Core, Pomerium Zero is designed to be deployed at edge where your services are. - -## Get started - -[**Zero Quickstart**](/docs/quickstart): If you're new to Pomerium Zero, complete the **Zero Quickstart** first. It guides you through installing Pomerium Zero as a Docker container and provides example routes, policies, and certificates to get you started. - -[**Pomerium Zero Fundamentals Courses**](/docs/courses): Next, complete our fundamentals courses. These courses are designed to teach you the basics of Pomerium so you can secure your apps and services with confidence. - -## Learn - -If you want to learn more about how Pomerium Zero works, see the following docs: - -- [**What are Clusters?**](/docs/concepts/clusters) -- [**Pomerium Policy Language**](/docs/capabilities/ppl) -- [**Routing**](/docs/capabilities/routing) -- [**Certificates**](/docs/guides/certificates) - -## Popular use cases - -Check out these guides for real-world examples: - -- [**Jenkins**](/docs/guides/jenkins) -- [**Grafana**](/docs/guides/grafana) -- [**Code-server**](/docs/guides/code-server) diff --git a/content/docs/zero/img/billing/billing-org-dropdown.png b/content/docs/zero/img/billing/billing-org-dropdown.png deleted file mode 100644 index 572c3ffcc..000000000 Binary files a/content/docs/zero/img/billing/billing-org-dropdown.png and /dev/null differ diff --git a/content/docs/zero/img/billing/zero-pay-wall.png b/content/docs/zero/img/billing/zero-pay-wall.png deleted file mode 100644 index 272befea4..000000000 Binary files a/content/docs/zero/img/billing/zero-pay-wall.png and /dev/null differ diff --git a/content/docs/zero/img/billing/zero-usage-dash.png b/content/docs/zero/img/billing/zero-usage-dash.png deleted file mode 100644 index ea640fb11..000000000 Binary files a/content/docs/zero/img/billing/zero-usage-dash.png and /dev/null differ diff --git a/content/docs/zero/img/core-to-zero/add-cluster.png b/content/docs/zero/img/core-to-zero/add-cluster.png deleted file mode 100644 index f883cc144..000000000 Binary files a/content/docs/zero/img/core-to-zero/add-cluster.png and /dev/null differ diff --git a/content/docs/zero/img/core-to-zero/docker-import-command.png b/content/docs/zero/img/core-to-zero/docker-import-command.png deleted file mode 100644 index f813fb92c..000000000 Binary files a/content/docs/zero/img/core-to-zero/docker-import-command.png and /dev/null differ diff --git a/content/docs/zero/img/core-to-zero/import-existing-config-button.png b/content/docs/zero/img/core-to-zero/import-existing-config-button.png deleted file mode 100644 index 5289e5b4b..000000000 Binary files a/content/docs/zero/img/core-to-zero/import-existing-config-button.png and /dev/null differ diff --git a/content/docs/zero/img/core-to-zero/import-successful.png b/content/docs/zero/img/core-to-zero/import-successful.png deleted file mode 100644 index bf3d6fc04..000000000 Binary files a/content/docs/zero/img/core-to-zero/import-successful.png and /dev/null differ diff --git a/content/docs/zero/img/core-to-zero/import-terminal-command.png b/content/docs/zero/img/core-to-zero/import-terminal-command.png deleted file mode 100644 index 4aa099b41..000000000 Binary files a/content/docs/zero/img/core-to-zero/import-terminal-command.png and /dev/null differ diff --git a/content/docs/zero/img/core-to-zero/zero-onboarding-import-ui.png b/content/docs/zero/img/core-to-zero/zero-onboarding-import-ui.png deleted file mode 100644 index 2bb78b001..000000000 Binary files a/content/docs/zero/img/core-to-zero/zero-onboarding-import-ui.png and /dev/null differ diff --git a/content/examples/config/config.docker.yaml.md b/content/examples/config/config.docker.yaml.md index 51516bc93..c59d578f7 100644 --- a/content/examples/config/config.docker.yaml.md +++ b/content/examples/config/config.docker.yaml.md @@ -11,7 +11,7 @@ authenticate_service_url: https://authenticate.pomerium.app #################################################################################### # If self-hosting, you must configure an identity provider. # -# See identity provider settings: https://www.pomerium.com/docs/identity-providers/# +# See identity provider settings: https://www.pomerium.com/docs/integrations/# #################################################################################### # https://pomerium.com/reference/#routes diff --git a/content/examples/config/config.minimal.yaml.md b/content/examples/config/config.minimal.yaml.md index 8edf41e20..eda8337c3 100644 --- a/content/examples/config/config.minimal.yaml.md +++ b/content/examples/config/config.minimal.yaml.md @@ -14,7 +14,7 @@ autocert_use_staging: true # certificate_file: /home/user/.local/share/mkcert/rootCA.pem # certificate_key_file: /user/alex/.local/share/mkcert/rootCA-key.pem -# identity provider settings : https://www.pomerium.com/docs/identity-providers.html +# identity provider settings : https://www.pomerium.com/docs/integrations/user-identity/identity-providers.html idp_provider: google idp_client_id: REPLACE_ME idp_client_secret: REPLACE_ME diff --git a/content/examples/docker/autocert.docker-compose.yml b/content/examples/docker/autocert.docker-compose.yml index b8c71734c..aaa1b721e 100644 --- a/content/examples/docker/autocert.docker-compose.yml +++ b/content/examples/docker/autocert.docker-compose.yml @@ -1,6 +1,6 @@ services: pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest environment: # Generate new secret keys. e.g. `head -c32 /dev/urandom | base64` - COOKIE_SECRET=V2JBZk0zWGtsL29UcFUvWjVDWWQ2UHExNXJ0b2VhcDI= @@ -12,6 +12,6 @@ services: # https://verify.corp.beyondperimeter.com --> Pomerium --> http://verify verify: - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest expose: - 80 diff --git a/content/examples/docker/basic.docker-compose.yml.md b/content/examples/docker/basic.docker-compose.yml.md index f639a2476..267d7207a 100644 --- a/content/examples/docker/basic.docker-compose.yml.md +++ b/content/examples/docker/basic.docker-compose.yml.md @@ -1,7 +1,7 @@ ```yaml services: pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest volumes: ## Mount your config file: https://www.pomerium.com/docs/reference/ - ./config.yaml:/pomerium/config.yaml:ro @@ -9,7 +9,7 @@ services: - 443:443 ## https://verify.localhost.pomerium.io --> Pomerium --> http://verify verify: - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest expose: - 8000 ``` \ No newline at end of file diff --git a/content/examples/docker/nginx.docker-compose.yml b/content/examples/docker/nginx.docker-compose.yml index 7ec75fe26..9aa708d4e 100644 --- a/content/examples/docker/nginx.docker-compose.yml +++ b/content/examples/docker/nginx.docker-compose.yml @@ -11,12 +11,12 @@ services: - /var/run/docker.sock:/tmp/docker.sock:ro pomerium-authenticate: - image: cr.pomerium.com/pomerium/pomerium:latest # or `build: .` to build from source + image: pomerium.com/pomerium/pomerium:latest # or `build: .` to build from source restart: always environment: - SERVICES=authenticate - INSECURE_SERVER=TRUE - # NOTE!: Replace with your identity provider settings https://www.pomerium.com/docs/identity-providers.html + # NOTE!: Replace with your identity provider settings https://www.pomerium.com/docs/integrations/user-identity/identity-providers.html # - IDP_PROVIDER=okta # - IDP_PROVIDER_URL=https://beyondperimeter.okta.com # - IDP_CLIENT_ID=REPLACE_ME @@ -59,7 +59,7 @@ services: - 443 pomerium-authorize: - image: cr.pomerium.com/pomerium/pomerium:latest # or `build: .` to build from source + image: pomerium.com/pomerium/pomerium:latest # or `build: .` to build from source restart: always environment: - SERVICES=authorize @@ -76,7 +76,7 @@ services: - 443 pomerium-databroker: - image: cr.pomerium.com/pomerium/pomerium:latest # or `build: .` to build from source + image: pomerium.com/pomerium/pomerium:latest # or `build: .` to build from source restart: always environment: - SERVICES=databroker @@ -93,7 +93,7 @@ services: # https://verify.corp.beyondperimeter.com verify: - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest expose: - 80 # https://hello.corp.beyondperimeter.com diff --git a/content/examples/enterprise/hosted-auth-docker.yaml.md b/content/examples/enterprise/hosted-auth-docker.yaml.md index c7afacd21..8dcb8e4d4 100644 --- a/content/examples/enterprise/hosted-auth-docker.yaml.md +++ b/content/examples/enterprise/hosted-auth-docker.yaml.md @@ -1,7 +1,7 @@ ```yaml title="docker-compose.yaml" services: pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest volumes: - ./config.yaml:/pomerium/config.yaml:ro ports: @@ -57,7 +57,7 @@ services: volumes: - pgdata:/var/lib/postgresql/data verify: - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest expose: - 8000 restart: always diff --git a/content/examples/guacamole/guacamole.docker-compose.md b/content/examples/guacamole/guacamole.docker-compose.md index efb7492b9..fd7411c7b 100644 --- a/content/examples/guacamole/guacamole.docker-compose.md +++ b/content/examples/guacamole/guacamole.docker-compose.md @@ -57,7 +57,7 @@ services: # pomerium pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest volumes: - ./config.yaml:/pomerium/config.yaml:ro ports: diff --git a/content/examples/jenkins/jenkins-docker-compose.md b/content/examples/jenkins/jenkins-docker-compose.md index 2f2a84e11..4699132fd 100644 --- a/content/examples/jenkins/jenkins-docker-compose.md +++ b/content/examples/jenkins/jenkins-docker-compose.md @@ -3,7 +3,7 @@ networks: main: {} services: pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest volumes: - ./config.yaml:/pomerium/config.yaml:ro ports: @@ -15,7 +15,7 @@ services: verify: networks: main: {} - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest expose: - 8000 jenkins: diff --git a/content/examples/nginx/docker-compose.yaml.md b/content/examples/nginx/docker-compose.yaml.md index 4a81731ce..7411bd554 100644 --- a/content/examples/nginx/docker-compose.yaml.md +++ b/content/examples/nginx/docker-compose.yaml.md @@ -18,11 +18,11 @@ services: - ./proxy.conf:/etc/nginx/proxy.conf verify: - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest expose: - 80 pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest volumes: - ./config.yaml:/pomerium/config.yaml:ro expose: diff --git a/content/examples/tcp/docker-compose.yaml.md b/content/examples/tcp/docker-compose.yaml.md index 2f6f30a58..b0de820d9 100644 --- a/content/examples/tcp/docker-compose.yaml.md +++ b/content/examples/tcp/docker-compose.yaml.md @@ -1,7 +1,7 @@ ```yaml title="docker-compose.md" services: pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest volumes: # Uncomment to mount certificates (optional) # - ./_wildcard.localhost.pomerium.io.pem:/pomerium/cert.pem:ro diff --git a/content/examples/tiddlywiki/docker-compose.yaml.md b/content/examples/tiddlywiki/docker-compose.yaml.md index 4f76ce862..e3646712c 100644 --- a/content/examples/tiddlywiki/docker-compose.yaml.md +++ b/content/examples/tiddlywiki/docker-compose.yaml.md @@ -1,7 +1,7 @@ ```yaml title="docker-compose.yaml" services: pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest volumes: # Use a volume to store ACME certificates - ./config.yaml:/pomerium/config.yaml:ro diff --git a/content/examples/tooljet/console-compose.yaml.md b/content/examples/tooljet/console-compose.yaml.md index 9deb48d08..529773098 100644 --- a/content/examples/tooljet/console-compose.yaml.md +++ b/content/examples/tooljet/console-compose.yaml.md @@ -3,7 +3,7 @@ networks: main: {} services: pomerium: - image: cr.pomerium.com/pomerium/pomerium:v0.21.1 + image: pomerium.com/pomerium/pomerium:v0.21.1 volumes: - ./config.yaml:/pomerium/config.yaml:ro ports: @@ -68,7 +68,7 @@ services: verify: networks: main: {} - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest expose: - 8000 restart: always diff --git a/content/examples/tooljet/docker-compose.yaml.md b/content/examples/tooljet/docker-compose.yaml.md index 8b3fd0b5d..d0dc676f0 100644 --- a/content/examples/tooljet/docker-compose.yaml.md +++ b/content/examples/tooljet/docker-compose.yaml.md @@ -3,7 +3,7 @@ networks: main: {} services: pomerium: - image: cr.pomerium.com/pomerium/pomerium:latest + image: pomerium.com/pomerium/pomerium:latest volumes: ## Mount your config file: https://www.pomerium.com/docs/reference/ - ./config.yaml:/pomerium/config.yaml:ro @@ -18,7 +18,7 @@ services: verify: networks: main: {} - image: cr.pomerium.com/pomerium/verify:latest + image: pomerium.com/pomerium/verify:latest expose: - 8000 tooljet: diff --git a/cspell.json b/cspell.json index 58a34b1c8..23abfcf03 100644 --- a/cspell.json +++ b/cspell.json @@ -31,6 +31,8 @@ "clsx", "configmap", "crd", + "ETBS", + "PHNs", "darkmode", "databroker", "databrokers", @@ -188,7 +190,33 @@ "ollama", "CUDA", "WEBUI", - "openwebui" + "openwebui", + "abnf", + "BYOD", + "changeit", + "cooldown", + "Continious", + "errgroup", + "Factorio", + "filippo", + "FIPS", + "gpgcheck", + "gpgkey", + "gset", + "localdomain", + "mykeycloak", + "mynewclient", + "myorg", + "nonroot", + "Privelege", + "reqs", + "sslverify", + "statefulset", + "tgroth", + "unvalidated", + "Whitelabeling", + "yourcompany", + "Zipkin" ], "ignorePaths": [ "*.mp4", @@ -199,6 +227,7 @@ "examples", "docusaurus.config.js", "package.json", - "sidebars.js" + "sidebars.js", + "static/_redirects" ] } diff --git a/docusaurus-plugins/src/webpackDebugFix.js b/docusaurus-plugins/src/webpackDebugFix.js deleted file mode 100644 index 972b22e34..000000000 --- a/docusaurus-plugins/src/webpackDebugFix.js +++ /dev/null @@ -1,20 +0,0 @@ -// solution here: https://github.com/rohit-gohri/redocusaurus/issues/236#issuecomment-1449548972 - -// solution here: https://github.com/rohit-gohri/redocusaurus/issues/236#issuecomment-1449548972 - -module.exports = async function webpackDebugFix(context, opts) { - const webpack = require('webpack'); - - return { - name: 'webpack-fix-plugin', - configureWebpack(config, isServer, utils, content) { - return { - plugins: [ - new webpack.DefinePlugin({ - 'process.env.DEBUG': 'process.env.DEBUG', - }), - ], - }; - }, - }; -}; diff --git a/docusaurus.config.js b/docusaurus.config.js index 2a3f45f57..bfcaa9949 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -1,9 +1,8 @@ // @ts-check // Note: type annotations allow type checking and IDEs autocompletion -const githubCodeTheme = require('prism-react-renderer/themes/github'); -const draculaCodeTheme = require('prism-react-renderer/themes/dracula'); const dotenv = require('dotenv'); +const webpack = require('webpack'); dotenv.config(); @@ -119,23 +118,6 @@ const config = { label: 'Reference', to: '/docs/reference/', }, - { - type: 'dropdown', - position: 'right', - label: 'APIs', - items: [ - { - docId: 'docs/api', - label: 'Zero API', - to: '/docs/api/', - }, - { - docId: 'docs/capabilities/enterprise-api', - label: 'Enterprise API', - to: 'docs/capabilities/enterprise-api', - }, - ], - }, { type: 'docSidebar', sidebarId: 'guides', @@ -154,12 +136,8 @@ const config = { dropdownActiveClassDisabled: true, dropdownItemsAfter: [ { - to: 'https://0-27-0.docs.pomerium.com/docs', - label: 'v0.27', - }, - { - to: 'https://0-26-0.docs.pomerium.com/docs', - label: 'v0.26', + to: 'https://0-28-0.docs.pomerium.com/docs', + label: 'v0.28 (latest)', }, { type: 'html', @@ -259,7 +237,22 @@ const config = { id: process.env.GTM, }, ], - './docusaurus-plugins/src/webpackDebugFix.js', + // async function customPlugin(context, opts) { + // return { + // name: 'custom-plugin', + // configureWebpack(config, isServer, utils, content) { + // return { + // plugins: [ + // new webpack.DefinePlugin({ + // // IMPORTANT: To fix debug library‘s bug + // // {}.DEBUG = namespaces; // SyntaxError: Unexpected token '.' + // 'process.env.DEBUG': 'process.env.DEBUG', + // }), + // ], + // }; + // }, + // }; + // }, [ 'docusaurus-pushfeedback', { @@ -277,18 +270,19 @@ const config = { // token types, so define our own styles for these types here. function lightCodeTheme() { return { - ...githubCodeTheme, - styles: githubCodeTheme.styles.concat([ + ...require('prism-react-renderer').themes.github, + styles: require('prism-react-renderer').themes.github.styles.concat([ {types: ['shell-symbol'], style: {color: '#5d36c6'}}, {types: ['command'], style: {color: '#1c1e21'}}, {types: ['output'], style: {color: '#133369'}}, ]), }; } + function darkCodeTheme() { return { - ...draculaCodeTheme, - styles: draculaCodeTheme.styles.concat([ + ...require('prism-react-renderer').themes.dracula, + styles: require('prism-react-renderer').themes.dracula.styles.concat([ {types: ['shell-symbol'], style: {color: '#c0a9ff'}}, {types: ['output'], style: {color: '#e4e4c4'}}, ]), diff --git a/package.json b/package.json index 015738718..c50968e9d 100644 --- a/package.json +++ b/package.json @@ -17,30 +17,30 @@ "format-check": "prettier --check ." }, "dependencies": { - "@docusaurus/core": "^3.6.0", - "@docusaurus/preset-classic": "^3.6.0", + "@docusaurus/core": "^3.6.3", + "@docusaurus/preset-classic": "^3.6.3", "@docusaurus/theme-common": "^3.6.0", "@docusaurus/theme-mermaid": "^3.6.0", "@docusaurus/types": "^3.4.0", "@emotion/react": "^11.11.3", "@emotion/styled": "^11.11.0", "@mdx-js/react": "^3.0.0", - "@mui/icons-material": "^5.15.3", - "@mui/material": "^5.15.3", - "@mui/x-data-grid": "^6.18.6", - "@mui/x-data-grid-pro": "^6.18.6", + "@mui/icons-material": "^6.3.0", + "@mui/material": "^6.3.0", + "@mui/x-data-grid": "^7.23.5", + "@mui/x-data-grid-pro": "^7.23.5", "clsx": "^2.1.0", "docusaurus-gtm-plugin": "^0.0.2", "docusaurus-pushfeedback": "^1.0.1", "dotenv": "^16.3.1", "mdx-mermaid": "^2.0.0", - "mermaid": "^10.9.3", - "prism-react-renderer": "^1.3.1", + "mermaid": "^11.4.1", + "prism-react-renderer": "^2.4.1", "raw-loader": "^4.0.2", "react": "^18.2.0", "react-dom": "^18.2.0", "react-mailchimp-subscribe": "^2.1.3", - "redocusaurus": "^2.0.2" + "redocusaurus": "^2.2.0" }, "browserslist": { "production": [ @@ -55,7 +55,8 @@ ] }, "devDependencies": { + "image-size": "^1.2.0", "js-yaml": "^4.1.0", - "prettier": "^3.1.1" + "prettier": "^3.4.2" } } diff --git a/sidebars.js b/sidebars.js index 3419d8d04..ef9940423 100644 --- a/sidebars.js +++ b/sidebars.js @@ -3,166 +3,75 @@ const sidebars = { documentation: [ 'docs/index', - 'docs/quickstart', { type: 'category', - label: 'Courses', - link: {type: 'doc', id: 'docs/courses'}, + label: 'Get Started', + link: {type: 'doc', id: 'docs/get-started/quickstart'}, items: [ { type: 'doc', - id: 'docs/courses/fundamentals/zero-build-routes', + id: 'docs/get-started/quickstart', }, { - type: 'doc', - id: 'docs/courses/fundamentals/zero-build-policies', - }, - { - type: 'doc', - id: 'docs/courses/fundamentals/zero-single-sign-on', - }, - { - type: 'doc', - id: 'docs/courses/fundamentals/zero-advanced-policies', - }, - { - type: 'doc', - id: 'docs/courses/fundamentals/zero-advanced-routes', - }, - { - type: 'doc', - id: 'docs/courses/fundamentals/zero-tcp-routes', - }, - { - type: 'doc', - id: 'docs/courses/fundamentals/zero-custom-idp', + type: 'category', + label: 'Fundamentals Step-by-Step', + items: [ + { + type: 'autogenerated', + dirName: 'docs/get-started/fundamentals', + }, + ], }, ], }, { type: 'category', - label: 'Pomerium Zero', - link: {type: 'doc', id: 'docs/zero'}, - items: [{type: 'autogenerated', dirName: 'docs/zero'}], - }, - { - type: 'category', - label: 'Pomerium Core', - link: {type: 'doc', id: 'docs/core'}, - items: [{type: 'autogenerated', dirName: 'docs/core'}], - }, - { - type: 'category', - label: 'Pomerium Enterprise', - link: {type: 'doc', id: 'docs/enterprise'}, + label: 'Deploy', items: [ - 'docs/enterprise/quickstart', - 'docs/enterprise/install', - 'docs/enterprise/configure', - 'docs/enterprise/configure-metrics', - 'docs/enterprise/changelog', - 'docs/enterprise/upgrading', + { + type: 'autogenerated', + dirName: 'docs/deploy', + }, ], }, - { - type: 'category', - label: 'Kubernetes', - items: [{type: 'autogenerated', dirName: 'docs/k8s'}], - }, - { - type: 'category', - label: 'Clients', - items: [{type: 'autogenerated', dirName: 'docs/clients'}], - }, { type: 'category', label: 'Capabilities', items: [ - // zero - { - id: 'docs/capabilities/custom-domains', - className: 'zero', - type: 'doc', - label: 'Custom Domains', - }, - // core & open source - // - // Core concepts + // Core Capabilities 'docs/capabilities/authentication', 'docs/capabilities/authorization', - 'docs/capabilities/ppl', + 'docs/capabilities/getting-users-identity', 'docs/capabilities/routing', + 'docs/capabilities/custom-domains', // secondary capabilities { type: 'doc', label: 'Audit Logs', id: 'docs/capabilities/audit-logs', }, - 'docs/capabilities/hosted-authenticate-service', - 'docs/capabilities/self-hosted-authenticate-service', - 'docs/capabilities/metrics', - 'docs/capabilities/mtls-clients', - 'docs/capabilities/mtls-services', - 'docs/capabilities/getting-users-identity', - 'docs/capabilities/single-sign-out', - 'docs/capabilities/programmatic-access', - 'docs/capabilities/load-balancing', 'docs/capabilities/kubernetes-access', { type: 'category', - label: 'TCP over HTTP', - link: {type: 'doc', id: 'docs/capabilities/tcp'}, - items: [{type: 'autogenerated', dirName: 'docs/capabilities/tcp'}], + label: 'Non-HTTP Protocols', + link: {type: 'doc', id: 'docs/deploy/clients/clients'}, + items: [ + { + type: 'autogenerated', + dirName: 'docs/capabilities/non-http', + }, + ], }, - // Enterprise { id: 'docs/capabilities/branding', className: 'enterprise', type: 'doc', - label: 'Custom Branding & Errors', - }, - { - id: 'docs/capabilities/rego', - className: 'enterprise', - type: 'doc', - label: 'Custom Rego Policies', - }, - { - id: 'docs/capabilities/device-identity', - className: 'enterprise', - type: 'doc', - label: 'Device Identity', - }, - { - id: 'docs/capabilities/directory-sync', - className: 'enterprise', - type: 'doc', - label: 'Directory Sync', }, { - id: 'docs/capabilities/enterprise-api', + id: 'docs/capabilities/self-remediation', className: 'enterprise', type: 'doc', - label: 'Enterprise API', - }, - { - id: 'docs/integrations', - className: 'enterprise', - type: 'doc', - label: 'External Data Sources', - }, - { - id: 'docs/capabilities/high-availability', - className: 'enterprise', - type: 'doc', - label: 'High Availability', - }, - { - id: 'docs/capabilities/namespacing', - className: 'enterprise', - type: 'doc', - label: 'Namespaces', }, { id: 'docs/capabilities/original-request-context', @@ -184,33 +93,7 @@ const sidebars = { }, ], }, - { - type: 'category', - label: 'Concepts', - items: [ - { - type: 'doc', - id: 'docs/concepts/clusters', - className: 'zero', - }, - { - type: 'doc', - id: 'docs/concepts/access-control', - }, - { - type: 'doc', - id: 'docs/concepts/device-identity', - }, - { - type: 'doc', - id: 'docs/concepts/mutual-auth', - }, - { - type: 'doc', - id: 'docs/concepts/zero-trust', - }, - ], - }, + { type: 'category', label: 'Internals', @@ -219,21 +102,10 @@ const sidebars = { }, { type: 'category', - label: 'Community', - link: {type: 'doc', id: 'docs/community'}, - items: [{type: 'autogenerated', dirName: 'docs/community'}], - }, - { - type: 'category', - label: 'Troubleshooting', - link: {type: 'doc', id: 'docs/troubleshooting'}, - items: [ - { - id: 'docs/troubleshooting/cluster-status', - className: 'zero', - type: 'doc', - }, - ], + label: 'Integrations', + link: {type: 'doc', id: 'docs/integrations'}, + description: 'Integrate external data sources with Pomerium', + items: [{type: 'autogenerated', dirName: 'docs/integrations'}], }, ], reference: [ @@ -259,253 +131,7 @@ const sidebars = { keywords: ['guides'], slug: 'docs/guides', }, - items: [ - { - type: 'category', - label: 'Upstream Services', - description: - 'Secure common services and applications behind Pomerium', - items: [ - { - type: 'doc', - id: 'docs/guides/ad-guard', - }, - { - type: 'doc', - id: 'docs/guides/guacamole', - }, - { - type: 'doc', - id: 'docs/guides/code-server', - }, - { - type: 'doc', - id: 'docs/guides/gitlab', - }, - { - type: 'doc', - id: 'docs/guides/grafana', - }, - { - type: 'doc', - id: 'docs/guides/hedgedoc', - }, - { - type: 'doc', - id: 'docs/guides/jenkins', - }, - { - type: 'doc', - id: 'docs/guides/jit', - }, - { - type: 'doc', - id: 'docs/guides/llm', - }, - { - type: 'doc', - id: 'docs/guides/tiddlywiki', - }, - { - type: 'doc', - id: 'docs/guides/tooljet', - }, - { - type: 'doc', - id: 'docs/guides/transmission', - }, - ], - }, - { - type: 'category', - label: 'Identity Providers', - description: - 'Configure a custom Identity Provider for authentication', - link: {type: 'doc', id: 'docs/identity-providers/index'}, - items: [ - { - type: 'doc', - id: 'docs/identity-providers/apple', - }, - { - type: 'doc', - id: 'docs/identity-providers/auth0', - }, - { - type: 'doc', - id: 'docs/identity-providers/cognito', - }, - { - type: 'doc', - id: 'docs/identity-providers/github', - }, - { - type: 'doc', - id: 'docs/identity-providers/gitlab', - }, - { - type: 'doc', - id: 'docs/identity-providers/google', - }, - { - type: 'doc', - id: 'docs/identity-providers/azure', - }, - { - type: 'doc', - id: 'docs/identity-providers/oidc', - }, - { - type: 'doc', - id: 'docs/identity-providers/okta', - }, - { - type: 'doc', - id: 'docs/identity-providers/one-login', - }, - { - type: 'doc', - id: 'docs/identity-providers/ping', - }, - ], - }, - { - type: 'category', - label: 'External Data Sources', - description: 'Integrate external data sources with Pomerium', - items: [ - { - type: 'doc', - id: 'docs/integrations/bamboohr', - className: 'enterprise', - }, - { - type: 'doc', - id: 'docs/integrations/fleetdm', - className: 'enterprise', - }, - { - type: 'doc', - id: 'docs/integrations/geoip', - className: 'enterprise', - }, - { - type: 'doc', - id: 'docs/integrations/ip-ranges', - className: 'enterprise', - }, - { - type: 'doc', - id: 'docs/integrations/tor-exit-nodes', - className: 'enterprise', - }, - { - type: 'doc', - id: 'docs/integrations/vpn-providers', - className: 'enterprise', - }, - { - type: 'doc', - id: 'docs/integrations/zenefits', - className: 'enterprise', - }, - { - type: 'doc', - id: 'docs/guides/argo', - }, - { - type: 'doc', - id: 'docs/guides/cloud-run', - }, - { - type: 'doc', - id: 'docs/guides/cockpit', - }, - { - type: 'doc', - id: 'docs/guides/helm', - }, - { - type: 'doc', - id: 'docs/guides/istio', - }, - { - type: 'doc', - id: 'docs/guides/synology', - }, - ], - }, - { - type: 'category', - label: 'Courses', - description: 'Learn how Pomerium works with guided tutorials', - items: [ - { - type: 'doc', - id: 'docs/courses/fundamentals/get-started', - }, - { - type: 'doc', - id: 'docs/courses/fundamentals/build-routes', - }, - { - type: 'doc', - id: 'docs/courses/fundamentals/build-policies', - }, - { - type: 'doc', - id: 'docs/courses/fundamentals/jwt-verification', - }, - { - type: 'doc', - id: 'docs/courses/fundamentals/advanced-policies', - }, - { - type: 'doc', - id: 'docs/courses/fundamentals/advanced-routes', - }, - { - type: 'doc', - id: 'docs/courses/fundamentals/tcp-routes', - }, - { - type: 'doc', - id: 'docs/courses/fundamentals/self-hosted-pomerium', - }, - { - type: 'doc', - id: 'docs/courses/fundamentals/production-certificates', - }, - { - type: 'doc', - id: 'docs/courses/fundamentals/conclusion', - }, - ], - }, - { - type: 'category', - label: 'Configure Pomerium', - description: 'Configure Pomerium to work with your services', - items: [ - { - type: 'doc', - id: 'docs/guides/cors', - }, - { - type: 'doc', - id: 'docs/guides/verify-jwt', - }, - { - type: 'doc', - id: 'docs/guides/jwt-verification-with-envoy', - }, - { - type: 'doc', - id: 'docs/guides/certificates', - }, - ], - }, - ], + items: [{type: 'autogenerated', dirName: 'docs/guides'}], }, ], }; diff --git a/src/components/HomepageFeatures/index.js b/src/components/HomepageFeatures/index.js index 38a73b34e..0fdd9b24e 100644 --- a/src/components/HomepageFeatures/index.js +++ b/src/components/HomepageFeatures/index.js @@ -17,7 +17,7 @@ const FeatureList = [ }, { title: 'Connect', - path: '/docs/identity-providers/', + path: '/docs/integrations/user-identity/identity-providers/', icon: 'link', description: <>Connect Pomerium to your Identity Provider, }, @@ -35,7 +35,7 @@ const FeatureList = [ }, { title: 'Enterprise', - path: '/docs/enterprise/about', + path: '/docs/deploy/enterprise/about', icon: 'space_dashboard', description: <>Scale your access management to match your business, }, diff --git a/src/components/HomepageLayout/VideoCards.js b/src/components/HomepageLayout/VideoCards.js index b34cce994..6d0cda4a4 100644 --- a/src/components/HomepageLayout/VideoCards.js +++ b/src/components/HomepageLayout/VideoCards.js @@ -52,7 +52,7 @@ export default function VideoMediaCard() { sx={{ bgcolor: colorMode === 'dark' ? '#121212' : '', }}> - Try Quickstart + Try Quickstart diff --git a/static/_redirects b/static/_redirects index 626afd6dd..e14e95678 100644 --- a/static/_redirects +++ b/static/_redirects @@ -28,13 +28,13 @@ # Guide and examples links /guide/ /docs/quick-start/ -/guide/kubernetes.html /docs/k8s -/guide/kubernetes /docs/k8s -/docs/k8s /docs/deploying/k8s/quickstart +/guide/kubernetes.html /docs/deploy/k8s/ +/guide/kubernetes /docs/deploy/k8s/ +/docs/deploy/k8s/ /docs/deploying/k8s/quickstart /guide/synology /docs/guides/synology /guide/synology.html /docs/guides/synology /docs/quick-start/synology.html /docs/guides/synology -/docs/guides/jwt-verification /docs/guides/jwt-verification-with-envoy +/docs/guides/jwt-verification /docs/deploy/jwt-verification-with-envoy /docs/examples.html /docs/guides /docs/examples /docs/guides @@ -69,39 +69,39 @@ https://0-20-0.docs.pomerium.com/category/guides https://0-20-0.docs.pomerium.co /recipes/kubernetes.html https://0-20-0.docs.pomerium.com/docs/guides/kubernetes 301! # /guides/ redirects to capabilities pages -/docs/guides/enroll-device /docs/capabilities/device-identity -/docs/guides/enroll-device.html /docs/capabilities/device-identity -/docs/guides/admin-enroll-device.html /docs/capabilities/device-identity -/docs/guides/admin-enroll-device /docs/capabilities/device-identity +/docs/guides/enroll-device /docs/integrations/device-context/device-identity +/docs/guides/enroll-device.html /docs/integrations/device-context/device-identity +/docs/guides/admin-enroll-device.html /docs/integrations/device-context/device-identity +/docs/guides/admin-enroll-device /docs/integrations/device-context/device-identity /docs/guides/mtls /docs/capabilities/mtls-clients /docs/guides/mtls.html /docs/capabilities/mtls-clients /docs/guides/upstream-mtls /docs/capabilities/mtls-services /docs/guides/upstream-mtls.html /docs/capabilities/mtls-services -/guides/tcp /docs/capabilities/tcp +/guides/tcp /docs/capabilities/non-http /recipes/* /docs/guides/:splat /category/guides /docs/guides # /guides/ splat /guides/* /docs/guides/:splat /docs/guides/tcp /docs/guides/securing-tcp -/docs/guides/securing-tcp /docs/capabilities/tcp +/docs/guides/securing-tcp /docs/capabilities/non-http /docs/guides/tcp.html /docs/guides/securing-tcp /guides/vs-code-server.html /docs/guides/code-server /docs/guides/vs-code-server.html /docs/guides/code-server /guides/local-oidc.html /docs/guides/local-oidc -/docs/guides/local-oidc /docs/identity-providers/oidc -/docs/identity-providers/dex-freeipa /docs 410 +/docs/guides/local-oidc /docs/integrations/user-identity/identity-providers/oidc +/docs/integrations/user-identity/identity-providers/dex-freeipa /docs 410 # Reference, capabilities, topics, concepts links /docs/reference/readme.html /docs/ -/docs/concepts/namespacing /docs/capabilities/namespacing +/docs/concepts/namespacing /docs/internals/namespacing /docs/concepts/policies /docs/internals/glossary#policy /docs/concepts/routes /docs/internals/glossary#route /docs/concepts/service-accounts /docs/internals/glossary#service-account # Redirects incorrectly /docs/reference/certificates.html /docs/topics/certificates /docs/topics/certificates /docs/concepts/certificates -/docs/concepts/certificates /docs/guides/certificates +/docs/concepts/certificates /docs/internals/certificates-and-tls # This link requires multiple redirects /docs/reference/data-storage.html /docs/topics/data-storage @@ -170,10 +170,10 @@ https://0-20-0.docs.pomerium.com/category/guides https://0-20-0.docs.pomerium.co /enterprise/* /docs/enterprise/:splat # /docs/releases/ and /docs/deploying/ splats for v22 sidebar restructure -/docs/releases/changelog /docs/core/changelog -/docs/releases/upgrading /docs/core/upgrading -/docs/deploying/binary /docs/core/binary -/docs/deploying/from-source /docs/core/from-source +/docs/releases/changelog /docs/deploy/core/changelog +/docs/releases/upgrading /docs/deploy/upgrading.mdx +/docs/deploying/binary /docs/deploy/core/binary +/docs/deploying/from-source /docs/deploy/core/from-source /enterprise/about /docs/enterprise /docs/enterprise/about /docs/enterprise /docs/releases/enterprise /docs/enterprise @@ -194,40 +194,40 @@ https://0-20-0.docs.pomerium.com/category/guides https://0-20-0.docs.pomerium.co # Zero sidebar restructure /docs/deploy/enterprise /docs/enterprise /docs/deploy/enterprise/* /docs/enterprise/:splat -/docs/deploy/core /docs/core -/docs/deploy/core/* /docs/core/:splat -/docs/deploy/k8s /docs/k8s/quickstart -/docs/deploy/k8s/* /docs/k8s/:splat +/docs/deploy/core /docs/deploy/core +/docs/deploy/core/* /docs/deploy/core/:splat +/docs/deploy/k8s /docs/deploy/k8s/quickstart +/docs/deploy/k8s/* /docs/deploy/k8s/:splat /docs/zero/cluster-status /docs/troubleshooting/cluster-status -/docs/zero/upgrading /docs/zero/install +/docs/zero/upgrading /docs/get-started/quickstart # Installation and deployment methods redirects /docs/enterprise/install/docker /docs/enterprise/install /docs/enterprise/install/kustomize /docs/enterprise/install /docs/enterprise/install/os-packages /docs/enterprise/install -/docs/installation.html /docs/quickstart -/docs/installation /docs/quickstart -/docs/quick-start /docs/quickstart -/docs/install /docs/quickstart +/docs/installation.html /docs/get-started/quickstart +/docs/installation /docs/get-started/quickstart +/docs/quick-start /docs/get-started/quickstart +/docs/install /docs/get-started/quickstart -/docs/quick-start/binary /docs/core -/docs/quick-start/binary.html /docs/core -/docs/install/binary /docs/core -/docs/releases/core /docs/core +/docs/quick-start/binary /docs/deploy/core +/docs/quick-start/binary.html /docs/deploy/core +/docs/install/binary /docs/deploy/core +/docs/releases/core /docs/deploy/core -/docs/install/binary.html /docs/core/binary +/docs/install/binary.html /docs/deploy/core/binary # Helm links -/docs/quick-start/helm.html /docs/k8s/helm -/docs/k8s/helm /docs/guides/helm +/docs/quick-start/helm.html /docs/deploy/k8s/helm +/docs/deploy/k8s/helm /docs/guides/helm /docs/enterprise/install/helm /docs/guides/helm # /docs/install/helm.html uses multiple redirects -/docs/install/helm.html /docs/k8s/helm -/docs/k8s/helm /docs/guides/helm +/docs/install/helm.html /docs/deploy/k8s/helm +/docs/deploy/k8s/helm /docs/guides/helm -/docs/k8s/helm.html /docs/guides/helm +/docs/deploy/k8s/helm.html /docs/guides/helm /docs/install/helm /docs/releases/enterprise/install/helm # From-source links @@ -236,7 +236,7 @@ https://0-20-0.docs.pomerium.com/category/guides https://0-20-0.docs.pomerium.co /docs/install/from-source.html /docs/deploying/from-source # Enterprise and Core quickstarts -/docs/install/quickstart /docs/quickstart +/docs/install/quickstart /docs/get-started/quickstart /docs/enterprise/install/quickstart /docs/enterprise/quickstart /docs/enterprise/install/quickstart.html /docs/enterprise/quickstart /docs/enterprise/install /docs/enterprise/quickstart @@ -256,8 +256,8 @@ https://0-20-0.docs.pomerium.com/category/guides https://0-20-0.docs.pomerium.co /docs/enterprise/api.html /docs/capabilities/enterprise-api /docs/enterprise/api /docs/capabilities/enterprise-api -# redirects all /docs/enterprise/identity-providers to /docs/identity-providers -/docs/enterprise/identity-providers/* /docs/identity-providers/:splat +# redirects all /docs/enterprise/identity-providers to /docs/integrations/user-identity/identity-providers +/docs/enterprise/identity-providers/* /docs/integrations/user-identity/identity-providers/:splat #redirects External Data examples /docs/enterprise/external-data/* /docs/integrations/:splat @@ -265,21 +265,21 @@ https://0-20-0.docs.pomerium.com/category/guides https://0-20-0.docs.pomerium.co # TCP links /topics/tcp-support.html /docs/tcp /docs/topics/tcp-support.html /docs/tcp/ -/docs/tcp /docs/capabilities/tcp +/docs/tcp /docs/capabilities/non-http /docs/topics/tcp-support /docs/tcp/ -/docs/tcp /docs/capabilities/tcp +/docs/tcp /docs/capabilities/non-http # /docs/client.html uses multiple redirects /docs/client.html /docs/tcp/client -/docs/tcp/client.html /docs/capabilities/tcp/client -/docs/tcp/client /docs/capabilities/tcp/client +/docs/tcp/client.html /docs/capabilities/non-http/client +/docs/tcp/client /docs/capabilities/non-http/client -/docs/capabilities/tcp/reference/tcp-cli-reference /docs/capabilities/tcp/reference -/docs/capabilities/tcp/examples/service-template.html /docs/capabilities/tcp +/docs/capabilities/non-http/tcp-cli-reference /docs/capabilities/non-http +/docs/capabilities/non-http/examples/service-template.html /docs/capabilities/non-http # splats -/docs/tcp/examples/* /docs/capabilities/tcp/examples/:splat -/docs/tcp/* /docs/capabilities/tcp/examples/:splat +/docs/tcp/examples/* /docs/capabilities/non-http/examples/:splat +/docs/tcp/* /docs/capabilities/non-http/examples/:splat # Enterprise metrics links /docs/enterprise/metrics.html /docs/capabilities/metrics @@ -288,15 +288,15 @@ https://0-20-0.docs.pomerium.com/category/guides https://0-20-0.docs.pomerium.co # redirects /examples/ links /examples/js-sdk/express-server /docs/capabilities/jwt-verification /docs/guides/js-sdk /docs/capabilities/jwt-verification -/docs/capabilities/jwt-verification /docs/guides/verify-jwt +/docs/capabilities/jwt-verification /docs/capabilities/getting-users-identity.mdx # Kubernetes links # /docs/topics/kubernetes-integration.html uses multiple redirects -/docs/topics/kubernetes-integration.html /docs/k8s/ -/docs/deploying/k8s/install /docs/k8s/install -/docs/quick-start/kubernetes.html /docs/k8s/quickstart +/docs/topics/kubernetes-integration.html /docs/deploy/k8s/ +/docs/deploying/k8s/install /docs/deploy/k8s/install +/docs/quick-start/kubernetes.html /docs/deploy/k8s/quickstart -/docs/k8s/configure /docs/deploying/k8s/configure +/docs/deploy/k8s/configure /docs/deploying/k8s/configure /docs/topics/kubernetes-integration /docs/deploying/k8s/quickstart /docs/topics/ingress /docs/deploy/k8s/ingress # Still 404s... @@ -338,7 +338,7 @@ https://0-20-0.docs.pomerium.com/category/guides https://0-20-0.docs.pomerium.co /docs/overview/changelog /docs/releases/changelog # Redirects are case sensitive https://answers.netlify.com/t/case-sensitivity-with-redirects/956/2 /docs/CHANGELOG /docs/releases/changelog -/docs/CHANGELOG.html /docs/core/changelog +/docs/CHANGELOG.html /docs/deploy/core/changelog # Consolidated Reference Page redirects # Autocert @@ -488,14 +488,14 @@ https://0-20-0.docs.pomerium.com/category/guides https://0-20-0.docs.pomerium.co /docs/topics/ /docs/concepts/access-control /docs/topics/* /docs/concepts/:splat 301! /docs/topics/device-identity /docs/concepts/device-identity -/docs/topics/mutual-auth /docs/concepts/mutual-auth +/docs/topics/mutual-auth /docs/internals/mutual-auth /docs/topics/original-request-context /docs/concepts/original-request-context /docs/concepts/original-request-context /docs/capabilities/original-request-context /docs/topics/ppl /docs/concepts/ppl -/docs/concepts/ppl /docs/capabilities/ppl +/docs/concepts/ppl /docs/internals/ppl /docs/topics/ppl.html /docs/concepts/ppl.html -/docs/concepts/ppl.html /docs/capabilities/ppl.html +/docs/concepts/ppl.html /docs/internals/ppl.html /docs/topics/load-balancing /docs/concepts/load-balancing /docs/concepts/load-balancing /docs/capabilities/routing @@ -522,3 +522,154 @@ https://0-10-0.docs.pomerium.io/ https://0-10-0.docs.pomerium.com/:splat 301! # Avoid the index flicker in the browser / /docs + +# Newly renamed pages from bdd/2024-reorg-andconsolidate +/_generate-recovery-token /docs/admonitions/_generate-recovery-token +/_generate-recovery-token.html /docs/admonitions/_generate-recovery-token + +/_install-mkcert /docs/admonitions/_install-mkcert +/_install-mkcert.html /docs/admonitions/_install-mkcert + +/docs/manage/custom-domains /docs/capabilities/custom-domains +/docs/manage/custom-domains.html /docs/capabilities/custom-domains + +/docs/get-started/fundamentals/advanced-policies /docs/get-started/fundamentals/core/advanced-policies +/docs/get-started/fundamentals/advanced-policies.html /docs/get-started/fundamentals/core/advanced-policies + +/docs/get-started/fundamentals/advanced-routes /docs/get-started/fundamentals/core/advanced-routes +/docs/get-started/fundamentals/advanced-routes.html /docs/get-started/fundamentals/core/advanced-routes + +/docs/get-started/fundamentals/build-policies /docs/get-started/fundamentals/core/build-policies +/docs/get-started/fundamentals/build-policies.html /docs/get-started/fundamentals/core/build-policies + +/docs/get-started/fundamentals/build-routes /docs/get-started/fundamentals/core/build-routes +/docs/get-started/fundamentals/build-routes.html /docs/get-started/fundamentals/core/build-routes + +/docs/get-started/fundamentals/conclusion /docs/get-started/fundamentals/core/conclusion +/docs/get-started/fundamentals/conclusion.html /docs/get-started/fundamentals/core/conclusion + +/docs/get-started/fundamentals/get-started /docs/get-started/fundamentals/core/get-started +/docs/get-started/fundamentals/get-started.html /docs/get-started/fundamentals/core/get-started + +/docs/get-started/fundamentals/jwt-verification /docs/get-started/fundamentals/core/jwt-verification +/docs/get-started/fundamentals/jwt-verification.html /docs/get-started/fundamentals/core/jwt-verification + +/docs/get-started/fundamentals/production-certificates /docs/get-started/fundamentals/core/production-certificates +/docs/get-started/fundamentals/production-certificates.html /docs/get-started/fundamentals/core/production-certificates + +/docs/get-started/fundamentals/self-hosted-pomerium /docs/get-started/fundamentals/core/self-hosted-pomerium +/docs/get-started/fundamentals/self-hosted-pomerium.html /docs/get-started/fundamentals/core/self-hosted-pomerium + +/docs/get-started/fundamentals/tcp-routes /docs/get-started/fundamentals/core/tcp-routes +/docs/get-started/fundamentals/tcp-routes.html /docs/get-started/fundamentals/core/tcp-routes + +/docs/get-started/fundamentals/zero-advanced-policies /docs/get-started/fundamentals/zero/zero-advanced-policies +/docs/get-started/fundamentals/zero-advanced-policies.html /docs/get-started/fundamentals/zero/zero-advanced-policies + +/docs/get-started/fundamentals/zero-advanced-routes /docs/get-started/fundamentals/zero/zero-advanced-routes +/docs/get-started/fundamentals/zero-advanced-routes.html /docs/get-started/fundamentals/zero/zero-advanced-routes + +/docs/get-started/fundamentals/zero-build-policies /docs/get-started/fundamentals/zero/zero-build-policies +/docs/get-started/fundamentals/zero-build-policies.html /docs/get-started/fundamentals/zero/zero-build-policies + +/docs/get-started/fundamentals/zero-build-routes /docs/get-started/fundamentals/zero/zero-build-routes +/docs/get-started/fundamentals/zero-build-routes.html /docs/get-started/fundamentals/zero/zero-build-routes + +/docs/get-started/fundamentals/zero-custom-idp /docs/get-started/fundamentals/zero/zero-custom-idp +/docs/get-started/fundamentals/zero-custom-idp.html /docs/get-started/fundamentals/zero/zero-custom-idp + +/docs/get-started/fundamentals/zero-single-sign-on /docs/get-started/fundamentals/zero/zero-single-sign-on +/docs/get-started/fundamentals/zero-single-sign-on.html /docs/get-started/fundamentals/zero/zero-single-sign-on + +/docs/get-started/fundamentals/zero-tcp-routes /docs/get-started/fundamentals/zero/zero-tcp-routes +/docs/get-started/fundamentals/zero-tcp-routes.html /docs/get-started/fundamentals/zero/zero-tcp-routes + +/docs/integrations/integrations /docs/integrations +/docs/integrations/integrations.html /docs/integrations + +/docs/integrations/fleetdm /docs/integrations/device-context/fleetdm +/docs/integrations/fleetdm.html /docs/integrations/device-context/fleetdm + +/docs/integrations/geoip /docs/integrations/request-context/geoip +/docs/integrations/geoip.html /docs/integrations/request-context/geoip + +/docs/integrations/ip-ranges /docs/integrations/request-context/ip-ranges +/docs/integrations/ip-ranges.html /docs/integrations/request-context/ip-ranges + +/docs/integrations/tor-exit-nodes /docs/integrations/request-context/tor-exit-nodes +/docs/integrations/tor-exit-nodes.html /docs/integrations/request-context/tor-exit-nodes + +/docs/integrations/vpn-providers /docs/integrations/request-context/vpn-providers +/docs/integrations/vpn-providers.html /docs/integrations/request-context/vpn-providers + +/docs/integrations/apple /docs/integrations/user-identity/apple +/docs/integrations/apple.html /docs/integrations/user-identity/apple + +/docs/integrations/auth0 /docs/integrations/user-identity/auth0 +/docs/integrations/auth0.html /docs/integrations/user-identity/auth0 + +/docs/integrations/azure /docs/integrations/user-identity/azure +/docs/integrations/azure.html /docs/integrations/user-identity/azure + +/docs/integrations/cognito /docs/integrations/user-identity/cognito +/docs/integrations/cognito.html /docs/integrations/user-identity/cognito + +/docs/integrations/github /docs/integrations/user-identity/github +/docs/integrations/github.html /docs/integrations/user-identity/github + +/docs/integrations/gitlab /docs/integrations/user-identity/gitlab +/docs/integrations/gitlab.html /docs/integrations/user-identity/gitlab + +/docs/integrations/google /docs/integrations/user-identity/google +/docs/integrations/google.html /docs/integrations/user-identity/google + +/docs/integrations/index /docs/integrations/user-identity/identity-providers +/docs/integrations/index.html /docs/integrations/user-identity/identity-providers + +/docs/integrations/okta /docs/integrations/user-identity/okta +/docs/integrations/okta.html /docs/integrations/user-identity/okta + +/docs/integrations/one-login /docs/integrations/user-identity/one-login +/docs/integrations/one-login.html /docs/integrations/user-identity/one-login + +/docs/integrations/ping /docs/integrations/user-identity/ping +/docs/integrations/ping.html /docs/integrations/user-identity/ping + +/docs/integrations/bamboohr /docs/integrations/user-standing/bamboohr +/docs/integrations/bamboohr.html /docs/integrations/user-standing/bamboohr + +/docs/capabilities/directory-sync /docs/integrations/user-standing/directory-sync +/docs/capabilities/directory-sync.html /docs/integrations/user-standing/directory-sync + +/docs/integrations/zenefits /docs/integrations/user-standing/zenefits +/docs/integrations/zenefits.html /docs/integrations/user-standing/zenefits + +/docs/capabilities/certificates-and-tls /docs/internals/certificates-and-tls +/docs/capabilities/certificates-and-tls.html /docs/internals/certificates-and-tls + +/docs/manage/clusters /docs/internals/clusters +/docs/manage/clusters.html /docs/internals/clusters + +/docs/capabilities/high-availability /docs/internals/configuration +/docs/capabilities/high-availability.html /docs/internals/configuration + +/docs/capabilities/enterprise-api /docs/internals/management-api-enterprise +/docs/capabilities/enterprise-api.html /docs/internals/management-api-enterprise + +/docs/deploy/cloud/api-guide /docs/internals/management-api-zero +/docs/deploy/cloud/api-guide.html /docs/internals/management-api-zero + +/docs/capabilities/metrics /docs/internals/metrics +/docs/capabilities/metrics.html /docs/internals/metrics + +/docs/manage/mutual-auth /docs/internals/mutual-auth +/docs/manage/mutual-auth.html /docs/internals/mutual-auth + +/docs/capabilities/ppl /docs/internals/ppl +/docs/capabilities/ppl.html /docs/internals/ppl + +/docs/capabilities/programmatic-access /docs/internals/programmatic-access +/docs/capabilities/programmatic-access.html /docs/internals/programmatic-access + +/docs/manage/troubleshooting /docs/internals/troubleshooting +/docs/manage/troubleshooting.html /docs/internals/troubleshooting diff --git a/static/img/logo-dark.svg b/static/img/logo-dark.svg index f04f62664..ab08bcb6a 100644 --- a/static/img/logo-dark.svg +++ b/static/img/logo-dark.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/static/img/logo.svg b/static/img/logo.svg index ef089eb82..a48ca2f46 100644 --- a/static/img/logo.svg +++ b/static/img/logo.svg @@ -1,23 +1 @@ - - - - - - - - - - - - - - - - - - - - - - - + \ No newline at end of file diff --git a/static/img/undraw_docusaurus_mountain.svg b/static/img/undraw_docusaurus_mountain.svg index af961c49a..7296428d8 100644 --- a/static/img/undraw_docusaurus_mountain.svg +++ b/static/img/undraw_docusaurus_mountain.svg @@ -1,171 +1 @@ - - Easy to Use - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + \ No newline at end of file diff --git a/static/img/undraw_docusaurus_react.svg b/static/img/undraw_docusaurus_react.svg index 94b5cf08f..0da8aac20 100644 --- a/static/img/undraw_docusaurus_react.svg +++ b/static/img/undraw_docusaurus_react.svg @@ -1,170 +1 @@ - - Powered by React - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + \ No newline at end of file diff --git a/static/img/undraw_docusaurus_tree.svg b/static/img/undraw_docusaurus_tree.svg index d9161d339..2982d43bd 100644 --- a/static/img/undraw_docusaurus_tree.svg +++ b/static/img/undraw_docusaurus_tree.svg @@ -1,40 +1 @@ - - Focus on What Matters - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + \ No newline at end of file diff --git a/yarn.lock b/yarn.lock index ee4c5d3d2..c913b141e 100644 --- a/yarn.lock +++ b/yarn.lock @@ -2,158 +2,153 @@ # yarn lockfile v1 -"@algolia/autocomplete-core@1.9.3": - version "1.9.3" - resolved "https://registry.yarnpkg.com/@algolia/autocomplete-core/-/autocomplete-core-1.9.3.tgz#1d56482a768c33aae0868c8533049e02e8961be7" - integrity sha512-009HdfugtGCdC4JdXUbVJClA0q0zh24yyePn+KUGk3rP7j8FEe/m5Yo/z65gn6nP/cM39PxpzqKrL7A6fP6PPw== - dependencies: - "@algolia/autocomplete-plugin-algolia-insights" "1.9.3" - "@algolia/autocomplete-shared" "1.9.3" - -"@algolia/autocomplete-plugin-algolia-insights@1.9.3": - version "1.9.3" - resolved "https://registry.yarnpkg.com/@algolia/autocomplete-plugin-algolia-insights/-/autocomplete-plugin-algolia-insights-1.9.3.tgz#9b7f8641052c8ead6d66c1623d444cbe19dde587" - integrity sha512-a/yTUkcO/Vyy+JffmAnTWbr4/90cLzw+CC3bRbhnULr/EM0fGNvM13oQQ14f2moLMcVDyAx/leczLlAOovhSZg== - dependencies: - "@algolia/autocomplete-shared" "1.9.3" - -"@algolia/autocomplete-preset-algolia@1.9.3": - version "1.9.3" - resolved "https://registry.yarnpkg.com/@algolia/autocomplete-preset-algolia/-/autocomplete-preset-algolia-1.9.3.tgz#64cca4a4304cfcad2cf730e83067e0c1b2f485da" - integrity sha512-d4qlt6YmrLMYy95n5TB52wtNDr6EgAIPH81dvvvW8UmuWRgxEtY0NJiPwl/h95JtG2vmRM804M0DSwMCNZlzRA== - dependencies: - "@algolia/autocomplete-shared" "1.9.3" - -"@algolia/autocomplete-shared@1.9.3": - version "1.9.3" - resolved "https://registry.yarnpkg.com/@algolia/autocomplete-shared/-/autocomplete-shared-1.9.3.tgz#2e22e830d36f0a9cf2c0ccd3c7f6d59435b77dfa" - integrity sha512-Wnm9E4Ye6Rl6sTTqjoymD+l8DjSTHsHboVRYrKgEt8Q7UHm9nYbqhN/i0fhUYA3OAEH7WA8x3jfpnmJm3rKvaQ== - -"@algolia/cache-browser-local-storage@4.24.0": - version "4.24.0" - resolved "https://registry.yarnpkg.com/@algolia/cache-browser-local-storage/-/cache-browser-local-storage-4.24.0.tgz#97bc6d067a9fd932b9c922faa6b7fd6e546e1348" - integrity sha512-t63W9BnoXVrGy9iYHBgObNXqYXM3tYXCjDSHeNwnsc324r4o5UiVKUiAB4THQ5z9U5hTj6qUvwg/Ez43ZD85ww== - dependencies: - "@algolia/cache-common" "4.24.0" +"@algolia/autocomplete-core@1.17.7": + version "1.17.7" + resolved "https://registry.yarnpkg.com/@algolia/autocomplete-core/-/autocomplete-core-1.17.7.tgz#2c410baa94a47c5c5f56ed712bb4a00ebe24088b" + integrity sha512-BjiPOW6ks90UKl7TwMv7oNQMnzU+t/wk9mgIDi6b1tXpUek7MW0lbNOUHpvam9pe3lVCf4xPFT+lK7s+e+fs7Q== + dependencies: + "@algolia/autocomplete-plugin-algolia-insights" "1.17.7" + "@algolia/autocomplete-shared" "1.17.7" + +"@algolia/autocomplete-plugin-algolia-insights@1.17.7": + version "1.17.7" + resolved "https://registry.yarnpkg.com/@algolia/autocomplete-plugin-algolia-insights/-/autocomplete-plugin-algolia-insights-1.17.7.tgz#7d2b105f84e7dd8f0370aa4c4ab3b704e6760d82" + integrity sha512-Jca5Ude6yUOuyzjnz57og7Et3aXjbwCSDf/8onLHSQgw1qW3ALl9mrMWaXb5FmPVkV3EtkD2F/+NkT6VHyPu9A== + dependencies: + "@algolia/autocomplete-shared" "1.17.7" + +"@algolia/autocomplete-preset-algolia@1.17.7": + version "1.17.7" + resolved "https://registry.yarnpkg.com/@algolia/autocomplete-preset-algolia/-/autocomplete-preset-algolia-1.17.7.tgz#c9badc0d73d62db5bf565d839d94ec0034680ae9" + integrity sha512-ggOQ950+nwbWROq2MOCIL71RE0DdQZsceqrg32UqnhDz8FlO9rL8ONHNsI2R1MH0tkgVIDKI/D0sMiUchsFdWA== + dependencies: + "@algolia/autocomplete-shared" "1.17.7" + +"@algolia/autocomplete-shared@1.17.7": + version "1.17.7" + resolved "https://registry.yarnpkg.com/@algolia/autocomplete-shared/-/autocomplete-shared-1.17.7.tgz#105e84ad9d1a31d3fb86ba20dc890eefe1a313a0" + integrity sha512-o/1Vurr42U/qskRSuhBH+VKxMvkkUVTLU6WZQr+L5lGZZLYWyhdzWjW0iGXY7EkwRTjBqvN2EsR81yCTGV/kmg== + +"@algolia/client-abtesting@5.19.0": + version "5.19.0" + resolved "https://registry.yarnpkg.com/@algolia/client-abtesting/-/client-abtesting-5.19.0.tgz#0a6e73da05decc8f1bbcd7e5b9a82a8d876e7bf5" + integrity sha512-dMHwy2+nBL0SnIsC1iHvkBao64h4z+roGelOz11cxrDBrAdASxLxmfVMop8gmodQ2yZSacX0Rzevtxa+9SqxCw== + dependencies: + "@algolia/client-common" "5.19.0" + "@algolia/requester-browser-xhr" "5.19.0" + "@algolia/requester-fetch" "5.19.0" + "@algolia/requester-node-http" "5.19.0" + +"@algolia/client-analytics@5.19.0": + version "5.19.0" + resolved "https://registry.yarnpkg.com/@algolia/client-analytics/-/client-analytics-5.19.0.tgz#45e33343fd4517e05a340a97bb37bebb4466000e" + integrity sha512-CDW4RwnCHzU10upPJqS6N6YwDpDHno7w6/qXT9KPbPbt8szIIzCHrva4O9KIfx1OhdsHzfGSI5hMAiOOYl4DEQ== + dependencies: + "@algolia/client-common" "5.19.0" + "@algolia/requester-browser-xhr" "5.19.0" + "@algolia/requester-fetch" "5.19.0" + "@algolia/requester-node-http" "5.19.0" + +"@algolia/client-common@5.19.0": + version "5.19.0" + resolved "https://registry.yarnpkg.com/@algolia/client-common/-/client-common-5.19.0.tgz#efddaaf28f0f478117c2aab22d19c99b06f99761" + integrity sha512-2ERRbICHXvtj5kfFpY5r8qu9pJII/NAHsdgUXnUitQFwPdPL7wXiupcvZJC7DSntOnE8AE0lM7oDsPhrJfj5nQ== + +"@algolia/client-insights@5.19.0": + version "5.19.0" + resolved "https://registry.yarnpkg.com/@algolia/client-insights/-/client-insights-5.19.0.tgz#81ff8eb3df724f6dd8ea3f423966b9ef7d36f903" + integrity sha512-xPOiGjo6I9mfjdJO7Y+p035aWePcbsItizIp+qVyfkfZiGgD+TbNxM12g7QhFAHIkx/mlYaocxPY/TmwPzTe+A== + dependencies: + "@algolia/client-common" "5.19.0" + "@algolia/requester-browser-xhr" "5.19.0" + "@algolia/requester-fetch" "5.19.0" + "@algolia/requester-node-http" "5.19.0" + +"@algolia/client-personalization@5.19.0": + version "5.19.0" + resolved "https://registry.yarnpkg.com/@algolia/client-personalization/-/client-personalization-5.19.0.tgz#9a75230b9dec490a1e0851539a40a9371c8cd987" + integrity sha512-B9eoce/fk8NLboGje+pMr72pw+PV7c5Z01On477heTZ7jkxoZ4X92dobeGuEQop61cJ93Gaevd1of4mBr4hu2A== + dependencies: + "@algolia/client-common" "5.19.0" + "@algolia/requester-browser-xhr" "5.19.0" + "@algolia/requester-fetch" "5.19.0" + "@algolia/requester-node-http" "5.19.0" + +"@algolia/client-query-suggestions@5.19.0": + version "5.19.0" + resolved "https://registry.yarnpkg.com/@algolia/client-query-suggestions/-/client-query-suggestions-5.19.0.tgz#007d1b09818d6a225fbfdf93bbcb2edf8ab17da0" + integrity sha512-6fcP8d4S8XRDtVogrDvmSM6g5g6DndLc0pEm1GCKe9/ZkAzCmM3ZmW1wFYYPxdjMeifWy1vVEDMJK7sbE4W7MA== + dependencies: + "@algolia/client-common" "5.19.0" + "@algolia/requester-browser-xhr" "5.19.0" + "@algolia/requester-fetch" "5.19.0" + "@algolia/requester-node-http" "5.19.0" + +"@algolia/client-search@5.19.0": + version "5.19.0" + resolved "https://registry.yarnpkg.com/@algolia/client-search/-/client-search-5.19.0.tgz#04fc5d7e26d41c99144eb33eedb0ea6f9b1c0056" + integrity sha512-Ctg3xXD/1VtcwmkulR5+cKGOMj4r0wC49Y/KZdGQcqpydKn+e86F6l3tb3utLJQVq4lpEJud6kdRykFgcNsp8Q== + dependencies: + "@algolia/client-common" "5.19.0" + "@algolia/requester-browser-xhr" "5.19.0" + "@algolia/requester-fetch" "5.19.0" + "@algolia/requester-node-http" "5.19.0" -"@algolia/cache-common@4.24.0": - version "4.24.0" - resolved "https://registry.yarnpkg.com/@algolia/cache-common/-/cache-common-4.24.0.tgz#81a8d3a82ceb75302abb9b150a52eba9960c9744" - integrity sha512-emi+v+DmVLpMGhp0V9q9h5CdkURsNmFC+cOS6uK9ndeJm9J4TiqSvPYVu+THUP8P/S08rxf5x2P+p3CfID0Y4g== +"@algolia/events@^4.0.1": + version "4.0.1" + resolved "https://registry.yarnpkg.com/@algolia/events/-/events-4.0.1.tgz#fd39e7477e7bc703d7f893b556f676c032af3950" + integrity sha512-FQzvOCgoFXAbf5Y6mYozw2aj5KCJoA3m4heImceldzPSMbdyS4atVjJzXKMsfX3wnZTFYwkkt8/z8UesLHlSBQ== -"@algolia/cache-in-memory@4.24.0": - version "4.24.0" - resolved "https://registry.yarnpkg.com/@algolia/cache-in-memory/-/cache-in-memory-4.24.0.tgz#ffcf8872f3a10cb85c4f4641bdffd307933a6e44" - integrity sha512-gDrt2so19jW26jY3/MkFg5mEypFIPbPoXsQGQWAi6TrCPsNOSEYepBMPlucqWigsmEy/prp5ug2jy/N3PVG/8w== +"@algolia/ingestion@1.19.0": + version "1.19.0" + resolved "https://registry.yarnpkg.com/@algolia/ingestion/-/ingestion-1.19.0.tgz#b481bd2283866a1df18af9babba0ecb3f1d1d675" + integrity sha512-LO7w1MDV+ZLESwfPmXkp+KLeYeFrYEgtbCZG6buWjddhYraPQ9MuQWLhLLiaMlKxZ/sZvFTcZYuyI6Jx4WBhcg== dependencies: - "@algolia/cache-common" "4.24.0" + "@algolia/client-common" "5.19.0" + "@algolia/requester-browser-xhr" "5.19.0" + "@algolia/requester-fetch" "5.19.0" + "@algolia/requester-node-http" "5.19.0" -"@algolia/client-account@4.24.0": - version "4.24.0" - resolved "https://registry.yarnpkg.com/@algolia/client-account/-/client-account-4.24.0.tgz#eba7a921d828e7c8c40a32d4add21206c7fe12f1" - integrity sha512-adcvyJ3KjPZFDybxlqnf+5KgxJtBjwTPTeyG2aOyoJvx0Y8dUQAEOEVOJ/GBxX0WWNbmaSrhDURMhc+QeevDsA== +"@algolia/monitoring@1.19.0": + version "1.19.0" + resolved "https://registry.yarnpkg.com/@algolia/monitoring/-/monitoring-1.19.0.tgz#abc85ac073c25233c7f8dae3000cc0821d582514" + integrity sha512-Mg4uoS0aIKeTpu6iv6O0Hj81s8UHagi5TLm9k2mLIib4vmMtX7WgIAHAcFIaqIZp5D6s5EVy1BaDOoZ7buuJHA== dependencies: - "@algolia/client-common" "4.24.0" - "@algolia/client-search" "4.24.0" - "@algolia/transporter" "4.24.0" + "@algolia/client-common" "5.19.0" + "@algolia/requester-browser-xhr" "5.19.0" + "@algolia/requester-fetch" "5.19.0" + "@algolia/requester-node-http" "5.19.0" -"@algolia/client-analytics@4.24.0": - version "4.24.0" - resolved "https://registry.yarnpkg.com/@algolia/client-analytics/-/client-analytics-4.24.0.tgz#9d2576c46a9093a14e668833c505ea697a1a3e30" - integrity sha512-y8jOZt1OjwWU4N2qr8G4AxXAzaa8DBvyHTWlHzX/7Me1LX8OayfgHexqrsL4vSBcoMmVw2XnVW9MhL+Y2ZDJXg== +"@algolia/recommend@5.19.0": + version "5.19.0" + resolved "https://registry.yarnpkg.com/@algolia/recommend/-/recommend-5.19.0.tgz#5898219e9457853c563eb527f0d1cbfcb8998c87" + integrity sha512-PbgrMTbUPlmwfJsxjFhal4XqZO2kpBNRjemLVTkUiti4w/+kzcYO4Hg5zaBgVqPwvFDNQ8JS4SS3TBBem88u+g== dependencies: - "@algolia/client-common" "4.24.0" - "@algolia/client-search" "4.24.0" - "@algolia/requester-common" "4.24.0" - "@algolia/transporter" "4.24.0" + "@algolia/client-common" "5.19.0" + "@algolia/requester-browser-xhr" "5.19.0" + "@algolia/requester-fetch" "5.19.0" + "@algolia/requester-node-http" "5.19.0" -"@algolia/client-common@4.24.0": - version "4.24.0" - resolved "https://registry.yarnpkg.com/@algolia/client-common/-/client-common-4.24.0.tgz#77c46eee42b9444a1d1c1583a83f7df4398a649d" - integrity sha512-bc2ROsNL6w6rqpl5jj/UywlIYC21TwSSoFHKl01lYirGMW+9Eek6r02Tocg4gZ8HAw3iBvu6XQiM3BEbmEMoiA== +"@algolia/requester-browser-xhr@5.19.0": + version "5.19.0" + resolved "https://registry.yarnpkg.com/@algolia/requester-browser-xhr/-/requester-browser-xhr-5.19.0.tgz#979a340a81a381214c0dbdd235b51204098e3b4a" + integrity sha512-GfnhnQBT23mW/VMNs7m1qyEyZzhZz093aY2x8p0era96MMyNv8+FxGek5pjVX0b57tmSCZPf4EqNCpkGcGsmbw== dependencies: - "@algolia/requester-common" "4.24.0" - "@algolia/transporter" "4.24.0" + "@algolia/client-common" "5.19.0" -"@algolia/client-personalization@4.24.0": - version "4.24.0" - resolved "https://registry.yarnpkg.com/@algolia/client-personalization/-/client-personalization-4.24.0.tgz#8b47789fb1cb0f8efbea0f79295b7c5a3850f6ae" - integrity sha512-l5FRFm/yngztweU0HdUzz1rC4yoWCFo3IF+dVIVTfEPg906eZg5BOd1k0K6rZx5JzyyoP4LdmOikfkfGsKVE9w== +"@algolia/requester-fetch@5.19.0": + version "5.19.0" + resolved "https://registry.yarnpkg.com/@algolia/requester-fetch/-/requester-fetch-5.19.0.tgz#59fe52733a718fc23bde548b377b52baf7228993" + integrity sha512-oyTt8ZJ4T4fYvW5avAnuEc6Laedcme9fAFryMD9ndUTIUe/P0kn3BuGcCLFjN3FDmdrETHSFkgPPf1hGy3sLCw== dependencies: - "@algolia/client-common" "4.24.0" - "@algolia/requester-common" "4.24.0" - "@algolia/transporter" "4.24.0" + "@algolia/client-common" "5.19.0" -"@algolia/client-search@4.24.0": - version "4.24.0" - resolved "https://registry.yarnpkg.com/@algolia/client-search/-/client-search-4.24.0.tgz#75e6c02d33ef3e0f34afd9962c085b856fc4a55f" - integrity sha512-uRW6EpNapmLAD0mW47OXqTP8eiIx5F6qN9/x/7HHO6owL3N1IXqydGwW5nhDFBrV+ldouro2W1VX3XlcUXEFCA== +"@algolia/requester-node-http@5.19.0": + version "5.19.0" + resolved "https://registry.yarnpkg.com/@algolia/requester-node-http/-/requester-node-http-5.19.0.tgz#edbd58158d9dec774d608fbf2b2196d0ca4b257c" + integrity sha512-p6t8ue0XZNjcRiqNkb5QAM0qQRAKsCiebZ6n9JjWA+p8fWf8BvnhO55y2fO28g3GW0Imj7PrAuyBuxq8aDVQwQ== dependencies: - "@algolia/client-common" "4.24.0" - "@algolia/requester-common" "4.24.0" - "@algolia/transporter" "4.24.0" - -"@algolia/events@^4.0.1": - version "4.0.1" - resolved "https://registry.yarnpkg.com/@algolia/events/-/events-4.0.1.tgz#fd39e7477e7bc703d7f893b556f676c032af3950" - integrity sha512-FQzvOCgoFXAbf5Y6mYozw2aj5KCJoA3m4heImceldzPSMbdyS4atVjJzXKMsfX3wnZTFYwkkt8/z8UesLHlSBQ== - -"@algolia/logger-common@4.24.0": - version "4.24.0" - resolved "https://registry.yarnpkg.com/@algolia/logger-common/-/logger-common-4.24.0.tgz#28d439976019ec0a46ba7a1a739ef493d4ef8123" - integrity sha512-LLUNjkahj9KtKYrQhFKCzMx0BY3RnNP4FEtO+sBybCjJ73E8jNdaKJ/Dd8A/VA4imVHP5tADZ8pn5B8Ga/wTMA== - -"@algolia/logger-console@4.24.0": - version "4.24.0" - resolved "https://registry.yarnpkg.com/@algolia/logger-console/-/logger-console-4.24.0.tgz#c6ff486036cd90b81d07a95aaba04461da7e1c65" - integrity sha512-X4C8IoHgHfiUROfoRCV+lzSy+LHMgkoEEU1BbKcsfnV0i0S20zyy0NLww9dwVHUWNfPPxdMU+/wKmLGYf96yTg== - dependencies: - "@algolia/logger-common" "4.24.0" - -"@algolia/recommend@4.24.0": - version "4.24.0" - resolved "https://registry.yarnpkg.com/@algolia/recommend/-/recommend-4.24.0.tgz#8a3f78aea471ee0a4836b78fd2aad4e9abcaaf34" - integrity sha512-P9kcgerfVBpfYHDfVZDvvdJv0lEoCvzNlOy2nykyt5bK8TyieYyiD0lguIJdRZZYGre03WIAFf14pgE+V+IBlw== - dependencies: - "@algolia/cache-browser-local-storage" "4.24.0" - "@algolia/cache-common" "4.24.0" - "@algolia/cache-in-memory" "4.24.0" - "@algolia/client-common" "4.24.0" - "@algolia/client-search" "4.24.0" - "@algolia/logger-common" "4.24.0" - "@algolia/logger-console" "4.24.0" - "@algolia/requester-browser-xhr" "4.24.0" - "@algolia/requester-common" "4.24.0" - "@algolia/requester-node-http" "4.24.0" - "@algolia/transporter" "4.24.0" - -"@algolia/requester-browser-xhr@4.24.0": - version "4.24.0" - resolved "https://registry.yarnpkg.com/@algolia/requester-browser-xhr/-/requester-browser-xhr-4.24.0.tgz#313c5edab4ed73a052e75803855833b62dd19c16" - integrity sha512-Z2NxZMb6+nVXSjF13YpjYTdvV3032YTBSGm2vnYvYPA6mMxzM3v5rsCiSspndn9rzIW4Qp1lPHBvuoKJV6jnAA== - dependencies: - "@algolia/requester-common" "4.24.0" - -"@algolia/requester-common@4.24.0": - version "4.24.0" - resolved "https://registry.yarnpkg.com/@algolia/requester-common/-/requester-common-4.24.0.tgz#1c60c198031f48fcdb9e34c4057a3ea987b9a436" - integrity sha512-k3CXJ2OVnvgE3HMwcojpvY6d9kgKMPRxs/kVohrwF5WMr2fnqojnycZkxPoEg+bXm8fi5BBfFmOqgYztRtHsQA== - -"@algolia/requester-node-http@4.24.0": - version "4.24.0" - resolved "https://registry.yarnpkg.com/@algolia/requester-node-http/-/requester-node-http-4.24.0.tgz#4461593714031d02aa7da221c49df675212f482f" - integrity sha512-JF18yTjNOVYvU/L3UosRcvbPMGT9B+/GQWNWnenIImglzNVGpyzChkXLnrSf6uxwVNO6ESGu6oN8MqcGQcjQJw== - dependencies: - "@algolia/requester-common" "4.24.0" - -"@algolia/transporter@4.24.0": - version "4.24.0" - resolved "https://registry.yarnpkg.com/@algolia/transporter/-/transporter-4.24.0.tgz#226bb1f8af62430374c1972b2e5c8580ab275102" - integrity sha512-86nI7w6NzWxd1Zp9q3413dRshDqAzSbsQjhcDhPIatEFiZrL1/TjnHL8S7jVKFePlIMzDsZWXAXwXzcok9c5oA== - dependencies: - "@algolia/cache-common" "4.24.0" - "@algolia/logger-common" "4.24.0" - "@algolia/requester-common" "4.24.0" + "@algolia/client-common" "5.19.0" "@ampproject/remapping@^2.2.0": version "2.3.0" @@ -163,7 +158,7 @@ "@jridgewell/gen-mapping" "^0.3.5" "@jridgewell/trace-mapping" "^0.3.24" -"@antfu/install-pkg@^0.4.0": +"@antfu/install-pkg@^0.4.1": version "0.4.1" resolved "https://registry.yarnpkg.com/@antfu/install-pkg/-/install-pkg-0.4.1.tgz#d1d7f3be96ecdb41581629cafe8626d1748c0cf1" integrity sha512-T7yB5QNG29afhWVkVq7XeIMBa5U/vs9mX69YqayXypPRmYzUmzwnYltplHmPtZ4HPCn+sQKeXW8I47wCbuBOjw== @@ -176,15 +171,7 @@ resolved "https://registry.yarnpkg.com/@antfu/utils/-/utils-0.7.10.tgz#ae829f170158e297a9b6a28f161a8e487d00814d" integrity sha512-+562v9k4aI80m1+VuMHehNJWLOFjBnXn3tdOitzD0il5b7smkSBal4+a3oKiQTbrwMmN/TBUMDvbdoWDehgOww== -"@babel/code-frame@^7.0.0", "@babel/code-frame@^7.16.0", "@babel/code-frame@^7.24.7", "@babel/code-frame@^7.8.3": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.24.7.tgz#882fd9e09e8ee324e496bd040401c6f046ef4465" - integrity sha512-BcYH1CVJBO9tvyIZ2jVeXgSIMvGZ2FDRvDdOIVQyuklNKSsx+eppDEBq/g47Ayw+RqNFE+URvOShmf+f/qwAlA== - dependencies: - "@babel/highlight" "^7.24.7" - picocolors "^1.0.0" - -"@babel/code-frame@^7.25.9", "@babel/code-frame@^7.26.0": +"@babel/code-frame@^7.0.0", "@babel/code-frame@^7.16.0", "@babel/code-frame@^7.25.9", "@babel/code-frame@^7.26.0", "@babel/code-frame@^7.26.2", "@babel/code-frame@^7.8.3": version "7.26.2" resolved "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.26.2.tgz#4b5fab97d33338eff916235055f0ebc21e573a85" integrity sha512-RJlIHRueQgwWitWgF8OdFYGZX328Ax5BCemNGlqHfplnRT9ESi8JkFlvaVYbS+UubVY6dpv87Fs2u5M29iNFVQ== @@ -193,38 +180,12 @@ js-tokens "^4.0.0" picocolors "^1.0.0" -"@babel/compat-data@^7.22.6", "@babel/compat-data@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/compat-data/-/compat-data-7.24.7.tgz#d23bbea508c3883ba8251fb4164982c36ea577ed" - integrity sha512-qJzAIcv03PyaWqxRgO4mSU3lihncDT296vnyuE2O8uA4w3UHWI4S3hgeZd1L8W1Bft40w9JxJ2b412iDUFFRhw== - -"@babel/compat-data@^7.25.9", "@babel/compat-data@^7.26.0": - version "7.26.2" - resolved "https://registry.yarnpkg.com/@babel/compat-data/-/compat-data-7.26.2.tgz#278b6b13664557de95b8f35b90d96785850bb56e" - integrity sha512-Z0WgzSEa+aUcdiJuCIqgujCshpMWgUpgOxXotrYPSA53hA3qopNaqcJpyr0hVb1FeWdnqFA35/fUtXgBK8srQg== - -"@babel/core@^7.21.3": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/core/-/core-7.24.7.tgz#b676450141e0b52a3d43bc91da86aa608f950ac4" - integrity sha512-nykK+LEK86ahTkX/3TgauT0ikKoNCfKHEaZYTUVupJdTLzGNvrblu4u6fa7DhZONAltdf8e662t/abY8idrd/g== - dependencies: - "@ampproject/remapping" "^2.2.0" - "@babel/code-frame" "^7.24.7" - "@babel/generator" "^7.24.7" - "@babel/helper-compilation-targets" "^7.24.7" - "@babel/helper-module-transforms" "^7.24.7" - "@babel/helpers" "^7.24.7" - "@babel/parser" "^7.24.7" - "@babel/template" "^7.24.7" - "@babel/traverse" "^7.24.7" - "@babel/types" "^7.24.7" - convert-source-map "^2.0.0" - debug "^4.1.0" - gensync "^1.0.0-beta.2" - json5 "^2.2.3" - semver "^6.3.1" +"@babel/compat-data@^7.22.6", "@babel/compat-data@^7.26.0", "@babel/compat-data@^7.26.5": + version "7.26.5" + resolved "https://registry.yarnpkg.com/@babel/compat-data/-/compat-data-7.26.5.tgz#df93ac37f4417854130e21d72c66ff3d4b897fc7" + integrity sha512-XvcZi1KWf88RVbF9wn8MN6tYFloU5qX8KjuF3E1PVBmJ9eypXfs4GRiJwLuTZL0iSnJUKn1BFPa5BPZZJyFzPg== -"@babel/core@^7.25.9": +"@babel/core@^7.21.3", "@babel/core@^7.25.9": version "7.26.0" resolved "https://registry.yarnpkg.com/@babel/core/-/core-7.26.0.tgz#d78b6023cc8f3114ccf049eb219613f74a747b40" integrity sha512-i1SLeK+DzNnQ3LL/CswPCa/E5u4lh1k6IAEphON8F+cXt0t9euTshDru0q7/IqMa1PMPz5RnHuHscF8/ZJsStg== @@ -245,34 +206,17 @@ json5 "^2.2.3" semver "^6.3.1" -"@babel/generator@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/generator/-/generator-7.24.7.tgz#1654d01de20ad66b4b4d99c135471bc654c55e6d" - integrity sha512-oipXieGC3i45Y1A41t4tAqpnEZWgB/lC6Ehh6+rOviR5XWpTtMmLN+fGjz9vOiNRt0p6RtO6DtD0pdU3vpqdSA== - dependencies: - "@babel/types" "^7.24.7" - "@jridgewell/gen-mapping" "^0.3.5" - "@jridgewell/trace-mapping" "^0.3.25" - jsesc "^2.5.1" - -"@babel/generator@^7.25.9", "@babel/generator@^7.26.0": - version "7.26.2" - resolved "https://registry.yarnpkg.com/@babel/generator/-/generator-7.26.2.tgz#87b75813bec87916210e5e01939a4c823d6bb74f" - integrity sha512-zevQbhbau95nkoxSq3f/DC/SC+EEOUZd3DYqfSkMhY2/wfSeaHV1Ew4vk8e+x8lja31IbyuUa2uQ3JONqKbysw== +"@babel/generator@^7.25.9", "@babel/generator@^7.26.0", "@babel/generator@^7.26.5": + version "7.26.5" + resolved "https://registry.yarnpkg.com/@babel/generator/-/generator-7.26.5.tgz#e44d4ab3176bbcaf78a5725da5f1dc28802a9458" + integrity sha512-2caSP6fN9I7HOe6nqhtft7V4g7/V/gfDsC3Ag4W7kEzzvRGKqiv0pu0HogPiZ3KaVSoNDhUws6IJjDjpfmYIXw== dependencies: - "@babel/parser" "^7.26.2" - "@babel/types" "^7.26.0" + "@babel/parser" "^7.26.5" + "@babel/types" "^7.26.5" "@jridgewell/gen-mapping" "^0.3.5" "@jridgewell/trace-mapping" "^0.3.25" jsesc "^3.0.2" -"@babel/helper-annotate-as-pure@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.24.7.tgz#5373c7bc8366b12a033b4be1ac13a206c6656aab" - integrity sha512-BaDeOonYvhdKw+JoMVkAixAAJzG2jVPIwWoKBPdYuY9b452e2rPuI9QPYh3KpofZ3pW2akOmwZLOiOsHMiqRAg== - dependencies: - "@babel/types" "^7.24.7" - "@babel/helper-annotate-as-pure@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.25.9.tgz#d8eac4d2dc0d7b6e11fa6e535332e0d3184f06b4" @@ -280,59 +224,17 @@ dependencies: "@babel/types" "^7.25.9" -"@babel/helper-builder-binary-assignment-operator-visitor@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helper-builder-binary-assignment-operator-visitor/-/helper-builder-binary-assignment-operator-visitor-7.24.7.tgz#37d66feb012024f2422b762b9b2a7cfe27c7fba3" - integrity sha512-xZeCVVdwb4MsDBkkyZ64tReWYrLRHlMN72vP7Bdm3OUOuyFZExhsHUUnuWnm2/XOlAJzR0LfPpB56WXZn0X/lA== - dependencies: - "@babel/traverse" "^7.24.7" - "@babel/types" "^7.24.7" - -"@babel/helper-builder-binary-assignment-operator-visitor@^7.25.9": - version "7.25.9" - resolved "https://registry.yarnpkg.com/@babel/helper-builder-binary-assignment-operator-visitor/-/helper-builder-binary-assignment-operator-visitor-7.25.9.tgz#f41752fe772a578e67286e6779a68a5a92de1ee9" - integrity sha512-C47lC7LIDCnz0h4vai/tpNOI95tCd5ZT3iBt/DBH5lXKHZsyNQv18yf1wIIg2ntiQNgmAvA+DgZ82iW8Qdym8g== - dependencies: - "@babel/traverse" "^7.25.9" - "@babel/types" "^7.25.9" - -"@babel/helper-compilation-targets@^7.22.6", "@babel/helper-compilation-targets@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helper-compilation-targets/-/helper-compilation-targets-7.24.7.tgz#4eb6c4a80d6ffeac25ab8cd9a21b5dfa48d503a9" - integrity sha512-ctSdRHBi20qWOfy27RUb4Fhp07KSJ3sXcuSvTrXrc4aG8NSYDo1ici3Vhg9bg69y5bj0Mr1lh0aeEgTvc12rMg== - dependencies: - "@babel/compat-data" "^7.24.7" - "@babel/helper-validator-option" "^7.24.7" - browserslist "^4.22.2" - lru-cache "^5.1.1" - semver "^6.3.1" - -"@babel/helper-compilation-targets@^7.25.9": - version "7.25.9" - resolved "https://registry.yarnpkg.com/@babel/helper-compilation-targets/-/helper-compilation-targets-7.25.9.tgz#55af025ce365be3cdc0c1c1e56c6af617ce88875" - integrity sha512-j9Db8Suy6yV/VHa4qzrj9yZfZxhLWQdVnRlXxmKLYlhWUVB1sB2G5sxuWYXk/whHD9iW76PmNzxZ4UCnTQTVEQ== +"@babel/helper-compilation-targets@^7.22.6", "@babel/helper-compilation-targets@^7.25.9": + version "7.26.5" + resolved "https://registry.yarnpkg.com/@babel/helper-compilation-targets/-/helper-compilation-targets-7.26.5.tgz#75d92bb8d8d51301c0d49e52a65c9a7fe94514d8" + integrity sha512-IXuyn5EkouFJscIDuFF5EsiSolseme1s0CZB+QxVugqJLYmKdxI1VfIBOst0SUu4rnk2Z7kqTwmoO1lp3HIfnA== dependencies: - "@babel/compat-data" "^7.25.9" + "@babel/compat-data" "^7.26.5" "@babel/helper-validator-option" "^7.25.9" browserslist "^4.24.0" lru-cache "^5.1.1" semver "^6.3.1" -"@babel/helper-create-class-features-plugin@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.24.7.tgz#2eaed36b3a1c11c53bdf80d53838b293c52f5b3b" - integrity sha512-kTkaDl7c9vO80zeX1rJxnuRpEsD5tA81yh11X1gQo+PhSti3JS+7qeZo9U4RHobKRiFPKaGK3svUAeb8D0Q7eg== - dependencies: - "@babel/helper-annotate-as-pure" "^7.24.7" - "@babel/helper-environment-visitor" "^7.24.7" - "@babel/helper-function-name" "^7.24.7" - "@babel/helper-member-expression-to-functions" "^7.24.7" - "@babel/helper-optimise-call-expression" "^7.24.7" - "@babel/helper-replace-supers" "^7.24.7" - "@babel/helper-skip-transparent-expression-wrappers" "^7.24.7" - "@babel/helper-split-export-declaration" "^7.24.7" - semver "^6.3.1" - "@babel/helper-create-class-features-plugin@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.25.9.tgz#7644147706bb90ff613297d49ed5266bde729f83" @@ -346,28 +248,19 @@ "@babel/traverse" "^7.25.9" semver "^6.3.1" -"@babel/helper-create-regexp-features-plugin@^7.18.6", "@babel/helper-create-regexp-features-plugin@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helper-create-regexp-features-plugin/-/helper-create-regexp-features-plugin-7.24.7.tgz#be4f435a80dc2b053c76eeb4b7d16dd22cfc89da" - integrity sha512-03TCmXy2FtXJEZfbXDTSqq1fRJArk7lX9DOFC/47VthYcxyIOx+eXQmdo6DOQvrbpIix+KfXwvuXdFDZHxt+rA== - dependencies: - "@babel/helper-annotate-as-pure" "^7.24.7" - regexpu-core "^5.3.1" - semver "^6.3.1" - -"@babel/helper-create-regexp-features-plugin@^7.25.9": - version "7.25.9" - resolved "https://registry.yarnpkg.com/@babel/helper-create-regexp-features-plugin/-/helper-create-regexp-features-plugin-7.25.9.tgz#3e8999db94728ad2b2458d7a470e7770b7764e26" - integrity sha512-ORPNZ3h6ZRkOyAa/SaHU+XsLZr0UQzRwuDQ0cczIA17nAzZ+85G5cVkOJIj7QavLZGSe8QXUmNFxSZzjcZF9bw== +"@babel/helper-create-regexp-features-plugin@^7.18.6", "@babel/helper-create-regexp-features-plugin@^7.25.9": + version "7.26.3" + resolved "https://registry.yarnpkg.com/@babel/helper-create-regexp-features-plugin/-/helper-create-regexp-features-plugin-7.26.3.tgz#5169756ecbe1d95f7866b90bb555b022595302a0" + integrity sha512-G7ZRb40uUgdKOQqPLjfD12ZmGA54PzqDFUv2BKImnC9QIfGhIHKvVML0oN8IUiDq4iRqpq74ABpvOaerfWdong== dependencies: "@babel/helper-annotate-as-pure" "^7.25.9" - regexpu-core "^6.1.1" + regexpu-core "^6.2.0" semver "^6.3.1" -"@babel/helper-define-polyfill-provider@^0.6.1", "@babel/helper-define-polyfill-provider@^0.6.2": - version "0.6.2" - resolved "https://registry.yarnpkg.com/@babel/helper-define-polyfill-provider/-/helper-define-polyfill-provider-0.6.2.tgz#18594f789c3594acb24cfdb4a7f7b7d2e8bd912d" - integrity sha512-LV76g+C502biUK6AyZ3LK10vDpDyCzZnhZFXkH1L75zHPj68+qc8Zfpx2th+gzwA2MzyK+1g/3EPl62yFnVttQ== +"@babel/helper-define-polyfill-provider@^0.6.2", "@babel/helper-define-polyfill-provider@^0.6.3": + version "0.6.3" + resolved "https://registry.yarnpkg.com/@babel/helper-define-polyfill-provider/-/helper-define-polyfill-provider-0.6.3.tgz#f4f2792fae2ef382074bc2d713522cf24e6ddb21" + integrity sha512-HK7Bi+Hj6H+VTHA3ZvBis7V/6hu9QuTrnMXNybfUf2iiuU/N97I8VjB+KbhFF8Rld/Lx5MzoCwPCpPjfK+n8Cg== dependencies: "@babel/helper-compilation-targets" "^7.22.6" "@babel/helper-plugin-utils" "^7.22.5" @@ -375,36 +268,6 @@ lodash.debounce "^4.0.8" resolve "^1.14.2" -"@babel/helper-environment-visitor@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helper-environment-visitor/-/helper-environment-visitor-7.24.7.tgz#4b31ba9551d1f90781ba83491dd59cf9b269f7d9" - integrity sha512-DoiN84+4Gnd0ncbBOM9AZENV4a5ZiL39HYMyZJGZ/AZEykHYdJw0wW3kdcsh9/Kn+BRXHLkkklZ51ecPKmI1CQ== - dependencies: - "@babel/types" "^7.24.7" - -"@babel/helper-function-name@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helper-function-name/-/helper-function-name-7.24.7.tgz#75f1e1725742f39ac6584ee0b16d94513da38dd2" - integrity sha512-FyoJTsj/PEUWu1/TYRiXTIHc8lbw+TDYkZuoE43opPS5TrI7MyONBE1oNvfguEXAD9yhQRrVBnXdXzSLQl9XnA== - dependencies: - "@babel/template" "^7.24.7" - "@babel/types" "^7.24.7" - -"@babel/helper-hoist-variables@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helper-hoist-variables/-/helper-hoist-variables-7.24.7.tgz#b4ede1cde2fd89436397f30dc9376ee06b0f25ee" - integrity sha512-MJJwhkoGy5c4ehfoRyrJ/owKeMl19U54h27YYftT0o2teQ3FJ3nQUf/I3LlJsX4l3qlw7WRXUmiyajvHXoTubQ== - dependencies: - "@babel/types" "^7.24.7" - -"@babel/helper-member-expression-to-functions@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.24.7.tgz#67613d068615a70e4ed5101099affc7a41c5225f" - integrity sha512-LGeMaf5JN4hAT471eJdBs/GK1DoYIJ5GCtZN/EsL6KUiiDZOvO/eKE11AMZJa2zP4zk4qe9V2O/hxAmkRc8p6w== - dependencies: - "@babel/traverse" "^7.24.7" - "@babel/types" "^7.24.7" - "@babel/helper-member-expression-to-functions@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.25.9.tgz#9dfffe46f727005a5ea29051ac835fb735e4c1a3" @@ -413,7 +276,7 @@ "@babel/traverse" "^7.25.9" "@babel/types" "^7.25.9" -"@babel/helper-module-imports@^7.16.7", "@babel/helper-module-imports@^7.24.7": +"@babel/helper-module-imports@^7.16.7": version "7.24.7" resolved "https://registry.yarnpkg.com/@babel/helper-module-imports/-/helper-module-imports-7.24.7.tgz#f2f980392de5b84c3328fc71d38bd81bbb83042b" integrity sha512-8AyH3C+74cgCVVXow/myrynrAGv+nTVg5vKu2nZph9x7RcRwzmh0VFallJuFTZ9mx6u4eSdXZfcOzSqTUm0HCA== @@ -429,17 +292,6 @@ "@babel/traverse" "^7.25.9" "@babel/types" "^7.25.9" -"@babel/helper-module-transforms@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helper-module-transforms/-/helper-module-transforms-7.24.7.tgz#31b6c9a2930679498db65b685b1698bfd6c7daf8" - integrity sha512-1fuJEwIrp+97rM4RWdO+qrRsZlAeL1lQJoPqtCYWv0NL115XM93hIH4CSRln2w52SqvmY5hqdtauB6QFCDiZNQ== - dependencies: - "@babel/helper-environment-visitor" "^7.24.7" - "@babel/helper-module-imports" "^7.24.7" - "@babel/helper-simple-access" "^7.24.7" - "@babel/helper-split-export-declaration" "^7.24.7" - "@babel/helper-validator-identifier" "^7.24.7" - "@babel/helper-module-transforms@^7.25.9", "@babel/helper-module-transforms@^7.26.0": version "7.26.0" resolved "https://registry.yarnpkg.com/@babel/helper-module-transforms/-/helper-module-transforms-7.26.0.tgz#8ce54ec9d592695e58d84cd884b7b5c6a2fdeeae" @@ -449,13 +301,6 @@ "@babel/helper-validator-identifier" "^7.25.9" "@babel/traverse" "^7.25.9" -"@babel/helper-optimise-call-expression@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.24.7.tgz#8b0a0456c92f6b323d27cfd00d1d664e76692a0f" - integrity sha512-jKiTsW2xmWwxT1ixIdfXUZp+P5yURx2suzLZr5Hi64rURpDYdMW0pv+Uf17EYk2Rd428Lx4tLsnjGJzYKDM/6A== - dependencies: - "@babel/types" "^7.24.7" - "@babel/helper-optimise-call-expression@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.25.9.tgz#3324ae50bae7e2ab3c33f60c9a877b6a0146b54e" @@ -463,24 +308,10 @@ dependencies: "@babel/types" "^7.25.9" -"@babel/helper-plugin-utils@^7.0.0", "@babel/helper-plugin-utils@^7.10.4", "@babel/helper-plugin-utils@^7.12.13", "@babel/helper-plugin-utils@^7.14.5", "@babel/helper-plugin-utils@^7.18.6", "@babel/helper-plugin-utils@^7.22.5", "@babel/helper-plugin-utils@^7.24.7", "@babel/helper-plugin-utils@^7.8.0", "@babel/helper-plugin-utils@^7.8.3": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helper-plugin-utils/-/helper-plugin-utils-7.24.7.tgz#98c84fe6fe3d0d3ae7bfc3a5e166a46844feb2a0" - integrity sha512-Rq76wjt7yz9AAc1KnlRKNAi/dMSVWgDRx43FHoJEbcYU6xOWaE2dVPwcdTukJrjxS65GITyfbvEYHvkirZ6uEg== - -"@babel/helper-plugin-utils@^7.25.9": - version "7.25.9" - resolved "https://registry.yarnpkg.com/@babel/helper-plugin-utils/-/helper-plugin-utils-7.25.9.tgz#9cbdd63a9443a2c92a725cca7ebca12cc8dd9f46" - integrity sha512-kSMlyUVdWe25rEsRGviIgOWnoT/nfABVWlqt9N19/dIPWViAOW2s9wznP5tURbs/IDuNk4gPy3YdYRgH3uxhBw== - -"@babel/helper-remap-async-to-generator@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helper-remap-async-to-generator/-/helper-remap-async-to-generator-7.24.7.tgz#b3f0f203628522713849d49403f1a414468be4c7" - integrity sha512-9pKLcTlZ92hNZMQfGCHImUpDOlAgkkpqalWEeftW5FBya75k8Li2ilerxkM/uBEj01iBZXcCIB/bwvDYgWyibA== - dependencies: - "@babel/helper-annotate-as-pure" "^7.24.7" - "@babel/helper-environment-visitor" "^7.24.7" - "@babel/helper-wrap-function" "^7.24.7" +"@babel/helper-plugin-utils@^7.0.0", "@babel/helper-plugin-utils@^7.18.6", "@babel/helper-plugin-utils@^7.22.5", "@babel/helper-plugin-utils@^7.25.9", "@babel/helper-plugin-utils@^7.26.5", "@babel/helper-plugin-utils@^7.8.0": + version "7.26.5" + resolved "https://registry.yarnpkg.com/@babel/helper-plugin-utils/-/helper-plugin-utils-7.26.5.tgz#18580d00c9934117ad719392c4f6585c9333cc35" + integrity sha512-RS+jZcRdZdRFzMyr+wcsaqOmld1/EqTghfaBGQQd/WnRdzdlvSZ//kF7U8VQTxf1ynZ4cjUcYgjVGx13ewNPMg== "@babel/helper-remap-async-to-generator@^7.25.9": version "7.25.9" @@ -491,47 +322,14 @@ "@babel/helper-wrap-function" "^7.25.9" "@babel/traverse" "^7.25.9" -"@babel/helper-replace-supers@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helper-replace-supers/-/helper-replace-supers-7.24.7.tgz#f933b7eed81a1c0265740edc91491ce51250f765" - integrity sha512-qTAxxBM81VEyoAY0TtLrx1oAEJc09ZK67Q9ljQToqCnA+55eNwCORaxlKyu+rNfX86o8OXRUSNUnrtsAZXM9sg== - dependencies: - "@babel/helper-environment-visitor" "^7.24.7" - "@babel/helper-member-expression-to-functions" "^7.24.7" - "@babel/helper-optimise-call-expression" "^7.24.7" - "@babel/helper-replace-supers@^7.25.9": - version "7.25.9" - resolved "https://registry.yarnpkg.com/@babel/helper-replace-supers/-/helper-replace-supers-7.25.9.tgz#ba447224798c3da3f8713fc272b145e33da6a5c5" - integrity sha512-IiDqTOTBQy0sWyeXyGSC5TBJpGFXBkRynjBeXsvbhQFKj2viwJC76Epz35YLU1fpe/Am6Vppb7W7zM4fPQzLsQ== + version "7.26.5" + resolved "https://registry.yarnpkg.com/@babel/helper-replace-supers/-/helper-replace-supers-7.26.5.tgz#6cb04e82ae291dae8e72335dfe438b0725f14c8d" + integrity sha512-bJ6iIVdYX1YooY2X7w1q6VITt+LnUILtNk7zT78ykuwStx8BauCzxvFqFaHjOpW1bVnSUM1PN1f0p5P21wHxvg== dependencies: "@babel/helper-member-expression-to-functions" "^7.25.9" "@babel/helper-optimise-call-expression" "^7.25.9" - "@babel/traverse" "^7.25.9" - -"@babel/helper-simple-access@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helper-simple-access/-/helper-simple-access-7.24.7.tgz#bcade8da3aec8ed16b9c4953b74e506b51b5edb3" - integrity sha512-zBAIvbCMh5Ts+b86r/CjU+4XGYIs+R1j951gxI3KmmxBMhCg4oQMsv6ZXQ64XOm/cvzfU1FmoCyt6+owc5QMYg== - dependencies: - "@babel/traverse" "^7.24.7" - "@babel/types" "^7.24.7" - -"@babel/helper-simple-access@^7.25.9": - version "7.25.9" - resolved "https://registry.yarnpkg.com/@babel/helper-simple-access/-/helper-simple-access-7.25.9.tgz#6d51783299884a2c74618d6ef0f86820ec2e7739" - integrity sha512-c6WHXuiaRsJTyHYLJV75t9IqsmTbItYfdj99PnzYGQZkYKvan5/2jKJ7gu31J3/BJ/A18grImSPModuyG/Eo0Q== - dependencies: - "@babel/traverse" "^7.25.9" - "@babel/types" "^7.25.9" - -"@babel/helper-skip-transparent-expression-wrappers@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helper-skip-transparent-expression-wrappers/-/helper-skip-transparent-expression-wrappers-7.24.7.tgz#5f8fa83b69ed5c27adc56044f8be2b3ea96669d9" - integrity sha512-IO+DLT3LQUElMbpzlatRASEyQtfhSE0+m465v++3jyyXeBTBUjtVZg28/gHeV5mrTJqvEKhKroBGAvhW+qPHiQ== - dependencies: - "@babel/traverse" "^7.24.7" - "@babel/types" "^7.24.7" + "@babel/traverse" "^7.26.5" "@babel/helper-skip-transparent-expression-wrappers@^7.25.9": version "7.25.9" @@ -541,53 +339,21 @@ "@babel/traverse" "^7.25.9" "@babel/types" "^7.25.9" -"@babel/helper-split-export-declaration@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.24.7.tgz#83949436890e07fa3d6873c61a96e3bbf692d856" - integrity sha512-oy5V7pD+UvfkEATUKvIjvIAH/xCzfsFVw7ygW2SI6NClZzquT+mwdTfgfdbUiceh6iQO0CHtCPsyze/MZ2YbAA== - dependencies: - "@babel/types" "^7.24.7" - -"@babel/helper-string-parser@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helper-string-parser/-/helper-string-parser-7.24.7.tgz#4d2d0f14820ede3b9807ea5fc36dfc8cd7da07f2" - integrity sha512-7MbVt6xrwFQbunH2DNQsAP5sTGxfqQtErvBIvIMi6EQnbgUOuVYanvREcmFrOPhoXBrTtjhhP+lW+o5UfK+tDg== - "@babel/helper-string-parser@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/helper-string-parser/-/helper-string-parser-7.25.9.tgz#1aabb72ee72ed35789b4bbcad3ca2862ce614e8c" integrity sha512-4A/SCr/2KLd5jrtOMFzaKjVtAei3+2r/NChoBNoZ3EyP/+GlhoaEGoWOZUmFmoITP7zOJyHIMm+DYRd8o3PvHA== -"@babel/helper-validator-identifier@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helper-validator-identifier/-/helper-validator-identifier-7.24.7.tgz#75b889cfaf9e35c2aaf42cf0d72c8e91719251db" - integrity sha512-rR+PBcQ1SMQDDyF6X0wxtG8QyLCgUB0eRAGguqRLfkCA87l7yAP7ehq8SNj96OOGTO8OBV70KhuFYcIkHXOg0w== - "@babel/helper-validator-identifier@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/helper-validator-identifier/-/helper-validator-identifier-7.25.9.tgz#24b64e2c3ec7cd3b3c547729b8d16871f22cbdc7" integrity sha512-Ed61U6XJc3CVRfkERJWDz4dJwKe7iLmmJsbOGu9wSloNSFttHV0I8g6UAgb7qnK5ly5bGLPd4oXZlxCdANBOWQ== -"@babel/helper-validator-option@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helper-validator-option/-/helper-validator-option-7.24.7.tgz#24c3bb77c7a425d1742eec8fb433b5a1b38e62f6" - integrity sha512-yy1/KvjhV/ZCL+SM7hBrvnZJ3ZuT9OuZgIJAGpPEToANvc3iM6iDvBnRjtElWibHU6n8/LPR/EjX9EtIEYO3pw== - "@babel/helper-validator-option@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/helper-validator-option/-/helper-validator-option-7.25.9.tgz#86e45bd8a49ab7e03f276577f96179653d41da72" integrity sha512-e/zv1co8pp55dNdEcCynfj9X7nyUKUXoUEwfXqaZt0omVOmDe9oOTdKStH4GmAw6zxMFs50ZayuMfHDKlO7Tfw== -"@babel/helper-wrap-function@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helper-wrap-function/-/helper-wrap-function-7.24.7.tgz#52d893af7e42edca7c6d2c6764549826336aae1f" - integrity sha512-N9JIYk3TD+1vq/wn77YnJOqMtfWhNewNE+DJV4puD2X7Ew9J4JvrzrFDfTfyv5EgEXVy9/Wt8QiOErzEmv5Ifw== - dependencies: - "@babel/helper-function-name" "^7.24.7" - "@babel/template" "^7.24.7" - "@babel/traverse" "^7.24.7" - "@babel/types" "^7.24.7" - "@babel/helper-wrap-function@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/helper-wrap-function/-/helper-wrap-function-7.25.9.tgz#d99dfd595312e6c894bd7d237470025c85eea9d0" @@ -597,14 +363,6 @@ "@babel/traverse" "^7.25.9" "@babel/types" "^7.25.9" -"@babel/helpers@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/helpers/-/helpers-7.24.7.tgz#aa2ccda29f62185acb5d42fb4a3a1b1082107416" - integrity sha512-NlmJJtvcw72yRJRcnCmGvSi+3jDEg8qFu3z0AFoymmzLx5ERVWyzd9kVXr7Th9/8yIJi2Zc6av4Tqz3wFs8QWg== - dependencies: - "@babel/template" "^7.24.7" - "@babel/types" "^7.24.7" - "@babel/helpers@^7.26.0": version "7.26.0" resolved "https://registry.yarnpkg.com/@babel/helpers/-/helpers-7.26.0.tgz#30e621f1eba5aa45fe6f4868d2e9154d884119a4" @@ -613,35 +371,12 @@ "@babel/template" "^7.25.9" "@babel/types" "^7.26.0" -"@babel/highlight@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/highlight/-/highlight-7.24.7.tgz#a05ab1df134b286558aae0ed41e6c5f731bf409d" - integrity sha512-EStJpq4OuY8xYfhGVXngigBJRWxftKX9ksiGDnmlY3o7B/V7KIAc9X4oiK87uPJSc/vs5L869bem5fhZa8caZw== - dependencies: - "@babel/helper-validator-identifier" "^7.24.7" - chalk "^2.4.2" - js-tokens "^4.0.0" - picocolors "^1.0.0" - -"@babel/parser@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.24.7.tgz#9a5226f92f0c5c8ead550b750f5608e766c8ce85" - integrity sha512-9uUYRm6OqQrCqQdG1iCBwBPZgN8ciDBro2nIOFaiRz1/BCxaI7CNvQbDHvsArAC7Tw9Hda/B3U+6ui9u4HWXPw== - -"@babel/parser@^7.25.9", "@babel/parser@^7.26.0", "@babel/parser@^7.26.2": - version "7.26.2" - resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.26.2.tgz#fd7b6f487cfea09889557ef5d4eeb9ff9a5abd11" - integrity sha512-DWMCZH9WA4Maitz2q21SRKHo9QXZxkDsbNZoVD62gusNtNBBqDg9i7uOhASfTfIGNzW+O+r7+jAlM8dwphcJKQ== - dependencies: - "@babel/types" "^7.26.0" - -"@babel/plugin-bugfix-firefox-class-in-computed-class-key@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-bugfix-firefox-class-in-computed-class-key/-/plugin-bugfix-firefox-class-in-computed-class-key-7.24.7.tgz#fd059fd27b184ea2b4c7e646868a9a381bbc3055" - integrity sha512-TiT1ss81W80eQsN+722OaeQMY/G4yTb4G9JrqeiDADs3N8lbPMGldWi9x8tyqCW5NLx1Jh2AvkE6r6QvEltMMQ== +"@babel/parser@^7.25.9", "@babel/parser@^7.26.0", "@babel/parser@^7.26.5": + version "7.26.5" + resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.26.5.tgz#6fec9aebddef25ca57a935c86dbb915ae2da3e1f" + integrity sha512-SRJ4jYmXRqV1/Xc+TIVG84WjHBXKlxO9sHQnA2Pf12QQEAp1LOh6kDzNHXcUnbH1QI0FDoPPVOt+vyUDucxpaw== dependencies: - "@babel/helper-environment-visitor" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" + "@babel/types" "^7.26.5" "@babel/plugin-bugfix-firefox-class-in-computed-class-key@^7.25.9": version "7.25.9" @@ -658,13 +393,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression/-/plugin-bugfix-safari-id-destructuring-collision-in-function-expression-7.24.7.tgz#468096ca44bbcbe8fcc570574e12eb1950e18107" - integrity sha512-unaQgZ/iRu/By6tsjMZzpeBZjChYfLYry6HrEXPoz3KmfF0sVBQ1l8zKMQ4xRGLWVsjuvB8nQfjNP/DcfEOCsg== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression/-/plugin-bugfix-safari-id-destructuring-collision-in-function-expression-7.25.9.tgz#e8dc26fcd616e6c5bf2bd0d5a2c151d4f92a9137" @@ -672,15 +400,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining/-/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.24.7.tgz#e4eabdd5109acc399b38d7999b2ef66fc2022f89" - integrity sha512-+izXIbke1T33mY4MSNnrqhPXDz01WYhEf3yF5NbnUtkiNnm+XBZJl3kNfoK6NKmYlz/D07+l2GWVK/QfDkNCuQ== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/helper-skip-transparent-expression-wrappers" "^7.24.7" - "@babel/plugin-transform-optional-chaining" "^7.24.7" - "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining/-/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.25.9.tgz#807a667f9158acac6f6164b4beb85ad9ebc9e1d1" @@ -690,14 +409,6 @@ "@babel/helper-skip-transparent-expression-wrappers" "^7.25.9" "@babel/plugin-transform-optional-chaining" "^7.25.9" -"@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly/-/plugin-bugfix-v8-static-class-fields-redefine-readonly-7.24.7.tgz#71b21bb0286d5810e63a1538aa901c58e87375ec" - integrity sha512-utA4HuR6F4Vvcr+o4DnjL8fCOlgRFGbeeBEGNg3ZTrLFw6VWG5XmUrvcQ0FjIYMU2ST4XcR2Wsp7t9qOAPnxMg== - dependencies: - "@babel/helper-environment-visitor" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly/-/plugin-bugfix-v8-static-class-fields-redefine-readonly-7.25.9.tgz#de7093f1e7deaf68eadd7cc6b07f2ab82543269e" @@ -711,27 +422,6 @@ resolved "https://registry.yarnpkg.com/@babel/plugin-proposal-private-property-in-object/-/plugin-proposal-private-property-in-object-7.21.0-placeholder-for-preset-env.2.tgz#7844f9289546efa9febac2de4cfe358a050bd703" integrity sha512-SOSkfJDddaM7mak6cPEpswyTRnuRltl429hMraQEglW+OkovnCzsiszTmsrlY//qLFjCpQDFRvjdm2wA5pPm9w== -"@babel/plugin-syntax-async-generators@^7.8.4": - version "7.8.4" - resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-async-generators/-/plugin-syntax-async-generators-7.8.4.tgz#a983fb1aeb2ec3f6ed042a210f640e90e786fe0d" - integrity sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw== - dependencies: - "@babel/helper-plugin-utils" "^7.8.0" - -"@babel/plugin-syntax-class-properties@^7.12.13": - version "7.12.13" - resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-class-properties/-/plugin-syntax-class-properties-7.12.13.tgz#b5c987274c4a3a82b89714796931a6b53544ae10" - integrity sha512-fm4idjKla0YahUNgFNLCB0qySdsoPiZP3iQE3rky0mBUtMZ23yDJ9SJdg6dXTSDnulOVqiF3Hgr9nbXvXTQZYA== - dependencies: - "@babel/helper-plugin-utils" "^7.12.13" - -"@babel/plugin-syntax-class-static-block@^7.14.5": - version "7.14.5" - resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-class-static-block/-/plugin-syntax-class-static-block-7.14.5.tgz#195df89b146b4b78b3bf897fd7a257c84659d406" - integrity sha512-b+YyPmr6ldyNnM6sqYeMWE+bgJcJpO6yS4QD7ymxgH34GBPNDM/THBh8iunyvKIZztiwLH4CJZ0RxTk9emgpjw== - dependencies: - "@babel/helper-plugin-utils" "^7.14.5" - "@babel/plugin-syntax-dynamic-import@^7.8.3": version "7.8.3" resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-dynamic-import/-/plugin-syntax-dynamic-import-7.8.3.tgz#62bf98b2da3cd21d626154fc96ee5b3cb68eacb3" @@ -739,20 +429,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.8.0" -"@babel/plugin-syntax-export-namespace-from@^7.8.3": - version "7.8.3" - resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-export-namespace-from/-/plugin-syntax-export-namespace-from-7.8.3.tgz#028964a9ba80dbc094c915c487ad7c4e7a66465a" - integrity sha512-MXf5laXo6c1IbEbegDmzGPwGNTsHZmEy6QGznu5Sh2UCWvueywb2ee+CCE4zQiZstxU9BMoQO9i6zUFSY0Kj0Q== - dependencies: - "@babel/helper-plugin-utils" "^7.8.3" - -"@babel/plugin-syntax-import-assertions@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-import-assertions/-/plugin-syntax-import-assertions-7.24.7.tgz#2a0b406b5871a20a841240586b1300ce2088a778" - integrity sha512-Ec3NRUMoi8gskrkBe3fNmEQfxDvY8bgfQpz6jlk/41kX9eUjvpyqWU7PBP/pLAvMaSQjbMNKJmvX57jP+M6bPg== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-syntax-import-assertions@^7.26.0": version "7.26.0" resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-import-assertions/-/plugin-syntax-import-assertions-7.26.0.tgz#620412405058efa56e4a564903b79355020f445f" @@ -760,13 +436,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-syntax-import-attributes@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-import-attributes/-/plugin-syntax-import-attributes-7.24.7.tgz#b4f9ea95a79e6912480c4b626739f86a076624ca" - integrity sha512-hbX+lKKeUMGihnK8nvKqmXBInriT3GVjzXKFriV3YC6APGxMbP8RZNFwy91+hocLXq90Mta+HshoB31802bb8A== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-syntax-import-attributes@^7.26.0": version "7.26.0" resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-import-attributes/-/plugin-syntax-import-attributes-7.26.0.tgz#3b1412847699eea739b4f2602c74ce36f6b0b0f7" @@ -774,27 +443,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-syntax-import-meta@^7.10.4": - version "7.10.4" - resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-import-meta/-/plugin-syntax-import-meta-7.10.4.tgz#ee601348c370fa334d2207be158777496521fd51" - integrity sha512-Yqfm+XDx0+Prh3VSeEQCPU81yC+JWZ2pDPFSS4ZdpfZhp4MkFMaDC1UqseovEKwSUpnIL7+vK+Clp7bfh0iD7g== - dependencies: - "@babel/helper-plugin-utils" "^7.10.4" - -"@babel/plugin-syntax-json-strings@^7.8.3": - version "7.8.3" - resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-json-strings/-/plugin-syntax-json-strings-7.8.3.tgz#01ca21b668cd8218c9e640cb6dd88c5412b2c96a" - integrity sha512-lY6kdGpWHvjoe2vk4WrAapEuBR69EMxZl+RoGRhrFGNYVK8mOPAW8VfbT/ZgrFbXlDNiiaxQnAtgVCZ6jv30EA== - dependencies: - "@babel/helper-plugin-utils" "^7.8.0" - -"@babel/plugin-syntax-jsx@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.24.7.tgz#39a1fa4a7e3d3d7f34e2acc6be585b718d30e02d" - integrity sha512-6ddciUPe/mpMnOKv/U+RSd2vvVy+Yw/JfBB0ZHYjEZt9NLHmCUylNYlsbqCCS1Bffjlb0fCwC9Vqz+sBz6PsiQ== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-syntax-jsx@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.25.9.tgz#a34313a178ea56f1951599b929c1ceacee719290" @@ -802,69 +450,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-syntax-logical-assignment-operators@^7.10.4": - version "7.10.4" - resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-logical-assignment-operators/-/plugin-syntax-logical-assignment-operators-7.10.4.tgz#ca91ef46303530448b906652bac2e9fe9941f699" - integrity sha512-d8waShlpFDinQ5MtvGU9xDAOzKH47+FFoney2baFIoMr952hKOLp1HR7VszoZvOsV/4+RRszNY7D17ba0te0ig== - dependencies: - "@babel/helper-plugin-utils" "^7.10.4" - -"@babel/plugin-syntax-nullish-coalescing-operator@^7.8.3": - version "7.8.3" - resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-nullish-coalescing-operator/-/plugin-syntax-nullish-coalescing-operator-7.8.3.tgz#167ed70368886081f74b5c36c65a88c03b66d1a9" - integrity sha512-aSff4zPII1u2QD7y+F8oDsz19ew4IGEJg9SVW+bqwpwtfFleiQDMdzA/R+UlWDzfnHFCxxleFT0PMIrR36XLNQ== - dependencies: - "@babel/helper-plugin-utils" "^7.8.0" - -"@babel/plugin-syntax-numeric-separator@^7.10.4": - version "7.10.4" - resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-numeric-separator/-/plugin-syntax-numeric-separator-7.10.4.tgz#b9b070b3e33570cd9fd07ba7fa91c0dd37b9af97" - integrity sha512-9H6YdfkcK/uOnY/K7/aA2xpzaAgkQn37yzWUMRK7OaPOqOpGS1+n0H5hxT9AUw9EsSjPW8SVyMJwYRtWs3X3ug== - dependencies: - "@babel/helper-plugin-utils" "^7.10.4" - -"@babel/plugin-syntax-object-rest-spread@^7.8.3": - version "7.8.3" - resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-object-rest-spread/-/plugin-syntax-object-rest-spread-7.8.3.tgz#60e225edcbd98a640332a2e72dd3e66f1af55871" - integrity sha512-XoqMijGZb9y3y2XskN+P1wUGiVwWZ5JmoDRwx5+3GmEplNyVM2s2Dg8ILFQm8rWM48orGy5YpI5Bl8U1y7ydlA== - dependencies: - "@babel/helper-plugin-utils" "^7.8.0" - -"@babel/plugin-syntax-optional-catch-binding@^7.8.3": - version "7.8.3" - resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-optional-catch-binding/-/plugin-syntax-optional-catch-binding-7.8.3.tgz#6111a265bcfb020eb9efd0fdfd7d26402b9ed6c1" - integrity sha512-6VPD0Pc1lpTqw0aKoeRTMiB+kWhAoT24PA+ksWSBrFtl5SIRVpZlwN3NNPQjehA2E/91FV3RjLWoVTglWcSV3Q== - dependencies: - "@babel/helper-plugin-utils" "^7.8.0" - -"@babel/plugin-syntax-optional-chaining@^7.8.3": - version "7.8.3" - resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-optional-chaining/-/plugin-syntax-optional-chaining-7.8.3.tgz#4f69c2ab95167e0180cd5336613f8c5788f7d48a" - integrity sha512-KoK9ErH1MBlCPxV0VANkXW2/dw4vlbGDrFgz8bmUsBGYkFRcbRwMh6cIJubdPrkxRwuGdtCk0v/wPTKbQgBjkg== - dependencies: - "@babel/helper-plugin-utils" "^7.8.0" - -"@babel/plugin-syntax-private-property-in-object@^7.14.5": - version "7.14.5" - resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-private-property-in-object/-/plugin-syntax-private-property-in-object-7.14.5.tgz#0dc6671ec0ea22b6e94a1114f857970cd39de1ad" - integrity sha512-0wVnp9dxJ72ZUJDV27ZfbSj6iHLoytYZmh3rFcxNnvsJF3ktkzLDZPy/mA17HGsaQT3/DQsWYX1f1QGWkCoVUg== - dependencies: - "@babel/helper-plugin-utils" "^7.14.5" - -"@babel/plugin-syntax-top-level-await@^7.14.5": - version "7.14.5" - resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-top-level-await/-/plugin-syntax-top-level-await-7.14.5.tgz#c1cfdadc35a646240001f06138247b741c34d94c" - integrity sha512-hx++upLv5U1rgYfwe1xBQUhRmU41NEvpUvrp8jkrSCdvGSnM5/qdRMtylJ6PG5OFkBaHkbTAKTnd3/YyESRHFw== - dependencies: - "@babel/helper-plugin-utils" "^7.14.5" - -"@babel/plugin-syntax-typescript@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.24.7.tgz#58d458271b4d3b6bb27ee6ac9525acbb259bad1c" - integrity sha512-c/+fVeJBB0FeKsFvwytYiUD+LBvhHjGSI0g446PRGdSVGZLRNArBUno2PETbAly3tpiNAQR5XaZ+JslxkotsbA== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-syntax-typescript@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.25.9.tgz#67dda2b74da43727cf21d46cf9afef23f4365399" @@ -880,13 +465,6 @@ "@babel/helper-create-regexp-features-plugin" "^7.18.6" "@babel/helper-plugin-utils" "^7.18.6" -"@babel/plugin-transform-arrow-functions@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-arrow-functions/-/plugin-transform-arrow-functions-7.24.7.tgz#4f6886c11e423bd69f3ce51dbf42424a5f275514" - integrity sha512-Dt9LQs6iEY++gXUwY03DNFat5C2NbO48jj+j/bSAz6b3HgPs39qcPiYt77fDObIcFwj3/C2ICX9YMwGflUoSHQ== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-arrow-functions@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-arrow-functions/-/plugin-transform-arrow-functions-7.25.9.tgz#7821d4410bee5daaadbb4cdd9a6649704e176845" @@ -894,16 +472,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-async-generator-functions@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-async-generator-functions/-/plugin-transform-async-generator-functions-7.24.7.tgz#7330a5c50e05181ca52351b8fd01642000c96cfd" - integrity sha512-o+iF77e3u7ZS4AoAuJvapz9Fm001PuD2V3Lp6OSE4FYQke+cSewYtnek+THqGRWyQloRCyvWL1OkyfNEl9vr/g== - dependencies: - "@babel/helper-environment-visitor" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/helper-remap-async-to-generator" "^7.24.7" - "@babel/plugin-syntax-async-generators" "^7.8.4" - "@babel/plugin-transform-async-generator-functions@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-async-generator-functions/-/plugin-transform-async-generator-functions-7.25.9.tgz#1b18530b077d18a407c494eb3d1d72da505283a2" @@ -913,15 +481,6 @@ "@babel/helper-remap-async-to-generator" "^7.25.9" "@babel/traverse" "^7.25.9" -"@babel/plugin-transform-async-to-generator@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-async-to-generator/-/plugin-transform-async-to-generator-7.24.7.tgz#72a3af6c451d575842a7e9b5a02863414355bdcc" - integrity sha512-SQY01PcJfmQ+4Ash7NE+rpbLFbmqA2GPIgqzxfFTL4t1FKRq4zTms/7htKpoCUI9OcFYgzqfmCdH53s6/jn5fA== - dependencies: - "@babel/helper-module-imports" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/helper-remap-async-to-generator" "^7.24.7" - "@babel/plugin-transform-async-to-generator@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-async-to-generator/-/plugin-transform-async-to-generator-7.25.9.tgz#c80008dacae51482793e5a9c08b39a5be7e12d71" @@ -931,26 +490,12 @@ "@babel/helper-plugin-utils" "^7.25.9" "@babel/helper-remap-async-to-generator" "^7.25.9" -"@babel/plugin-transform-block-scoped-functions@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-block-scoped-functions/-/plugin-transform-block-scoped-functions-7.24.7.tgz#a4251d98ea0c0f399dafe1a35801eaba455bbf1f" - integrity sha512-yO7RAz6EsVQDaBH18IDJcMB1HnrUn2FJ/Jslc/WtPPWcjhpUJXU/rjbwmluzp7v/ZzWcEhTMXELnnsz8djWDwQ== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-block-scoped-functions@^7.25.9": - version "7.25.9" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-block-scoped-functions/-/plugin-transform-block-scoped-functions-7.25.9.tgz#5700691dbd7abb93de300ca7be94203764fce458" - integrity sha512-toHc9fzab0ZfenFpsyYinOX0J/5dgJVA2fm64xPewu7CoYHWEivIWKxkK2rMi4r3yQqLnVmheMXRdG+k239CgA== - dependencies: - "@babel/helper-plugin-utils" "^7.25.9" - -"@babel/plugin-transform-block-scoping@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-block-scoping/-/plugin-transform-block-scoping-7.24.7.tgz#42063e4deb850c7bd7c55e626bf4e7ab48e6ce02" - integrity sha512-Nd5CvgMbWc+oWzBsuaMcbwjJWAcp5qzrbg69SZdHSP7AMY0AbWFqFO0WTFCA1jxhMCwodRwvRec8k0QUbZk7RQ== + version "7.26.5" + resolved "https://registry.yarnpkg.com/@babel/plugin-transform-block-scoped-functions/-/plugin-transform-block-scoped-functions-7.26.5.tgz#3dc4405d31ad1cbe45293aa57205a6e3b009d53e" + integrity sha512-chuTSY+hq09+/f5lMj8ZSYgCFpppV2CbYrhNFJ1BFoXpiWPnnAb7R0MqrafCpN8E1+YRrtM1MXZHJdIx8B6rMQ== dependencies: - "@babel/helper-plugin-utils" "^7.24.7" + "@babel/helper-plugin-utils" "^7.26.5" "@babel/plugin-transform-block-scoping@^7.25.9": version "7.25.9" @@ -959,14 +504,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-class-properties@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-class-properties/-/plugin-transform-class-properties-7.24.7.tgz#256879467b57b0b68c7ddfc5b76584f398cd6834" - integrity sha512-vKbfawVYayKcSeSR5YYzzyXvsDFWU2mD8U5TFeXtbCPLFUqe7GyCgvO6XDHzje862ODrOwy6WCPmKeWHbCFJ4w== - dependencies: - "@babel/helper-create-class-features-plugin" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-class-properties@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-class-properties/-/plugin-transform-class-properties-7.25.9.tgz#a8ce84fedb9ad512549984101fa84080a9f5f51f" @@ -975,15 +512,6 @@ "@babel/helper-create-class-features-plugin" "^7.25.9" "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-class-static-block@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-class-static-block/-/plugin-transform-class-static-block-7.24.7.tgz#c82027ebb7010bc33c116d4b5044fbbf8c05484d" - integrity sha512-HMXK3WbBPpZQufbMG4B46A90PkuuhN9vBCb5T8+VAHqvAqvcLi+2cKoukcpmUYkszLhScU3l1iudhrks3DggRQ== - dependencies: - "@babel/helper-create-class-features-plugin" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-syntax-class-static-block" "^7.14.5" - "@babel/plugin-transform-class-static-block@^7.26.0": version "7.26.0" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-class-static-block/-/plugin-transform-class-static-block-7.26.0.tgz#6c8da219f4eb15cae9834ec4348ff8e9e09664a0" @@ -992,20 +520,6 @@ "@babel/helper-create-class-features-plugin" "^7.25.9" "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-classes@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-classes/-/plugin-transform-classes-7.24.7.tgz#4ae6ef43a12492134138c1e45913f7c46c41b4bf" - integrity sha512-CFbbBigp8ln4FU6Bpy6g7sE8B/WmCmzvivzUC6xDAdWVsjYTXijpuuGJmYkAaoWAzcItGKT3IOAbxRItZ5HTjw== - dependencies: - "@babel/helper-annotate-as-pure" "^7.24.7" - "@babel/helper-compilation-targets" "^7.24.7" - "@babel/helper-environment-visitor" "^7.24.7" - "@babel/helper-function-name" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/helper-replace-supers" "^7.24.7" - "@babel/helper-split-export-declaration" "^7.24.7" - globals "^11.1.0" - "@babel/plugin-transform-classes@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-classes/-/plugin-transform-classes-7.25.9.tgz#7152457f7880b593a63ade8a861e6e26a4469f52" @@ -1018,14 +532,6 @@ "@babel/traverse" "^7.25.9" globals "^11.1.0" -"@babel/plugin-transform-computed-properties@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-computed-properties/-/plugin-transform-computed-properties-7.24.7.tgz#4cab3214e80bc71fae3853238d13d097b004c707" - integrity sha512-25cS7v+707Gu6Ds2oY6tCkUwsJ9YIDbggd9+cu9jzzDgiNq7hR/8dkzxWfKWnTic26vsI3EsCXNd4iEB6e8esQ== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/template" "^7.24.7" - "@babel/plugin-transform-computed-properties@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-computed-properties/-/plugin-transform-computed-properties-7.25.9.tgz#db36492c78460e534b8852b1d5befe3c923ef10b" @@ -1034,13 +540,6 @@ "@babel/helper-plugin-utils" "^7.25.9" "@babel/template" "^7.25.9" -"@babel/plugin-transform-destructuring@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-destructuring/-/plugin-transform-destructuring-7.24.7.tgz#a097f25292defb6e6cc16d6333a4cfc1e3c72d9e" - integrity sha512-19eJO/8kdCQ9zISOf+SEUJM/bAUIsvY3YDnXZTupUCQ8LgrWnsG/gFB9dvXqdXnRXMAM8fvt7b0CBKQHNGy1mw== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-destructuring@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-destructuring/-/plugin-transform-destructuring-7.25.9.tgz#966ea2595c498224340883602d3cfd7a0c79cea1" @@ -1048,14 +547,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-dotall-regex@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-dotall-regex/-/plugin-transform-dotall-regex-7.24.7.tgz#5f8bf8a680f2116a7207e16288a5f974ad47a7a0" - integrity sha512-ZOA3W+1RRTSWvyqcMJDLqbchh7U4NRGqwRfFSVbOLS/ePIP4vHB5e8T8eXcuqyN1QkgKyj5wuW0lcS85v4CrSw== - dependencies: - "@babel/helper-create-regexp-features-plugin" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-dotall-regex@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-dotall-regex/-/plugin-transform-dotall-regex-7.25.9.tgz#bad7945dd07734ca52fe3ad4e872b40ed09bb09a" @@ -1064,13 +555,6 @@ "@babel/helper-create-regexp-features-plugin" "^7.25.9" "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-duplicate-keys@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-duplicate-keys/-/plugin-transform-duplicate-keys-7.24.7.tgz#dd20102897c9a2324e5adfffb67ff3610359a8ee" - integrity sha512-JdYfXyCRihAe46jUIliuL2/s0x0wObgwwiGxw/UbgJBr20gQBThrokO4nYKgWkD7uBaqM7+9x5TU7NkExZJyzw== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-duplicate-keys@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-duplicate-keys/-/plugin-transform-duplicate-keys-7.25.9.tgz#8850ddf57dce2aebb4394bb434a7598031059e6d" @@ -1086,14 +570,6 @@ "@babel/helper-create-regexp-features-plugin" "^7.25.9" "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-dynamic-import@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-dynamic-import/-/plugin-transform-dynamic-import-7.24.7.tgz#4d8b95e3bae2b037673091aa09cd33fecd6419f4" - integrity sha512-sc3X26PhZQDb3JhORmakcbvkeInvxz+A8oda99lj7J60QRuPZvNAk9wQlTBS1ZynelDrDmTU4pw1tyc5d5ZMUg== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-syntax-dynamic-import" "^7.8.3" - "@babel/plugin-transform-dynamic-import@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-dynamic-import/-/plugin-transform-dynamic-import-7.25.9.tgz#23e917de63ed23c6600c5dd06d94669dce79f7b8" @@ -1101,30 +577,13 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-exponentiation-operator@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-exponentiation-operator/-/plugin-transform-exponentiation-operator-7.24.7.tgz#b629ee22645f412024297d5245bce425c31f9b0d" - integrity sha512-Rqe/vSc9OYgDajNIK35u7ot+KeCoetqQYFXM4Epf7M7ez3lWlOjrDjrwMei6caCVhfdw+mIKD4cgdGNy5JQotQ== - dependencies: - "@babel/helper-builder-binary-assignment-operator-visitor" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-exponentiation-operator@^7.25.9": - version "7.25.9" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-exponentiation-operator/-/plugin-transform-exponentiation-operator-7.25.9.tgz#ece47b70d236c1d99c263a1e22b62dc20a4c8b0f" - integrity sha512-KRhdhlVk2nObA5AYa7QMgTMTVJdfHprfpAk4DjZVtllqRg9qarilstTKEhpVjyt+Npi8ThRyiV8176Am3CodPA== + version "7.26.3" + resolved "https://registry.yarnpkg.com/@babel/plugin-transform-exponentiation-operator/-/plugin-transform-exponentiation-operator-7.26.3.tgz#e29f01b6de302c7c2c794277a48f04a9ca7f03bc" + integrity sha512-7CAHcQ58z2chuXPWblnn1K6rLDnDWieghSOEmqQsrBenH0P9InCUtOJYD89pvngljmZlJcz3fcmgYsXFNGa1ZQ== dependencies: - "@babel/helper-builder-binary-assignment-operator-visitor" "^7.25.9" "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-export-namespace-from@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-export-namespace-from/-/plugin-transform-export-namespace-from-7.24.7.tgz#176d52d8d8ed516aeae7013ee9556d540c53f197" - integrity sha512-v0K9uNYsPL3oXZ/7F9NNIbAj2jv1whUEtyA6aujhekLs56R++JDQuzRcP2/z4WX5Vg/c5lE9uWZA0/iUoFhLTA== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-syntax-export-namespace-from" "^7.8.3" - "@babel/plugin-transform-export-namespace-from@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-export-namespace-from/-/plugin-transform-export-namespace-from-7.25.9.tgz#90745fe55053394f554e40584cda81f2c8a402a2" @@ -1132,14 +591,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-for-of@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-for-of/-/plugin-transform-for-of-7.24.7.tgz#f25b33f72df1d8be76399e1b8f3f9d366eb5bc70" - integrity sha512-wo9ogrDG1ITTTBsy46oGiN1dS9A7MROBTcYsfS8DtsImMkHk9JXJ3EWQM6X2SUw4x80uGPlwj0o00Uoc6nEE3g== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/helper-skip-transparent-expression-wrappers" "^7.24.7" - "@babel/plugin-transform-for-of@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-for-of/-/plugin-transform-for-of-7.25.9.tgz#4bdc7d42a213397905d89f02350c5267866d5755" @@ -1148,15 +599,6 @@ "@babel/helper-plugin-utils" "^7.25.9" "@babel/helper-skip-transparent-expression-wrappers" "^7.25.9" -"@babel/plugin-transform-function-name@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-function-name/-/plugin-transform-function-name-7.24.7.tgz#6d8601fbffe665c894440ab4470bc721dd9131d6" - integrity sha512-U9FcnA821YoILngSmYkW6FjyQe2TyZD5pHt4EVIhmcTkrJw/3KqcrRSxuOo5tFZJi7TE19iDyI1u+weTI7bn2w== - dependencies: - "@babel/helper-compilation-targets" "^7.24.7" - "@babel/helper-function-name" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-function-name@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-function-name/-/plugin-transform-function-name-7.25.9.tgz#939d956e68a606661005bfd550c4fc2ef95f7b97" @@ -1166,14 +608,6 @@ "@babel/helper-plugin-utils" "^7.25.9" "@babel/traverse" "^7.25.9" -"@babel/plugin-transform-json-strings@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-json-strings/-/plugin-transform-json-strings-7.24.7.tgz#f3e9c37c0a373fee86e36880d45b3664cedaf73a" - integrity sha512-2yFnBGDvRuxAaE/f0vfBKvtnvvqU8tGpMHqMNpTN2oWMKIR3NqFkjaAgGwawhqK/pIN2T3XdjGPdaG0vDhOBGw== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-syntax-json-strings" "^7.8.3" - "@babel/plugin-transform-json-strings@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-json-strings/-/plugin-transform-json-strings-7.25.9.tgz#c86db407cb827cded902a90c707d2781aaa89660" @@ -1181,13 +615,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-literals@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-literals/-/plugin-transform-literals-7.24.7.tgz#36b505c1e655151a9d7607799a9988fc5467d06c" - integrity sha512-vcwCbb4HDH+hWi8Pqenwnjy+UiklO4Kt1vfspcQYFhJdpthSnW8XvWGyDZWKNVrVbVViI/S7K9PDJZiUmP2fYQ== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-literals@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-literals/-/plugin-transform-literals-7.25.9.tgz#1a1c6b4d4aa59bc4cad5b6b3a223a0abd685c9de" @@ -1195,14 +622,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-logical-assignment-operators@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-logical-assignment-operators/-/plugin-transform-logical-assignment-operators-7.24.7.tgz#a58fb6eda16c9dc8f9ff1c7b1ba6deb7f4694cb0" - integrity sha512-4D2tpwlQ1odXmTEIFWy9ELJcZHqrStlzK/dAOWYyxX3zT0iXQB6banjgeOJQXzEc4S0E0a5A+hahxPaEFYftsw== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-syntax-logical-assignment-operators" "^7.10.4" - "@babel/plugin-transform-logical-assignment-operators@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-logical-assignment-operators/-/plugin-transform-logical-assignment-operators-7.25.9.tgz#b19441a8c39a2fda0902900b306ea05ae1055db7" @@ -1210,13 +629,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-member-expression-literals@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-member-expression-literals/-/plugin-transform-member-expression-literals-7.24.7.tgz#3b4454fb0e302e18ba4945ba3246acb1248315df" - integrity sha512-T/hRC1uqrzXMKLQ6UCwMT85S3EvqaBXDGf0FaMf4446Qx9vKwlghvee0+uuZcDUCZU5RuNi4781UQ7R308zzBw== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-member-expression-literals@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-member-expression-literals/-/plugin-transform-member-expression-literals-7.25.9.tgz#63dff19763ea64a31f5e6c20957e6a25e41ed5de" @@ -1224,14 +636,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-modules-amd@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-modules-amd/-/plugin-transform-modules-amd-7.24.7.tgz#65090ed493c4a834976a3ca1cde776e6ccff32d7" - integrity sha512-9+pB1qxV3vs/8Hdmz/CulFB8w2tuu6EB94JZFsjdqxQokwGa9Unap7Bo2gGBGIvPmDIVvQrom7r5m/TCDMURhg== - dependencies: - "@babel/helper-module-transforms" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-modules-amd@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-modules-amd/-/plugin-transform-modules-amd-7.25.9.tgz#49ba478f2295101544abd794486cd3088dddb6c5" @@ -1240,33 +644,13 @@ "@babel/helper-module-transforms" "^7.25.9" "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-modules-commonjs@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-modules-commonjs/-/plugin-transform-modules-commonjs-7.24.7.tgz#9fd5f7fdadee9085886b183f1ad13d1ab260f4ab" - integrity sha512-iFI8GDxtevHJ/Z22J5xQpVqFLlMNstcLXh994xifFwxxGslr2ZXXLWgtBeLctOD63UFDArdvN6Tg8RFw+aEmjQ== - dependencies: - "@babel/helper-module-transforms" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/helper-simple-access" "^7.24.7" - "@babel/plugin-transform-modules-commonjs@^7.25.9": - version "7.25.9" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-modules-commonjs/-/plugin-transform-modules-commonjs-7.25.9.tgz#d165c8c569a080baf5467bda88df6425fc060686" - integrity sha512-dwh2Ol1jWwL2MgkCzUSOvfmKElqQcuswAZypBSUsScMXvgdT8Ekq5YA6TtqpTVWH+4903NmboMuH1o9i8Rxlyg== + version "7.26.3" + resolved "https://registry.yarnpkg.com/@babel/plugin-transform-modules-commonjs/-/plugin-transform-modules-commonjs-7.26.3.tgz#8f011d44b20d02c3de44d8850d971d8497f981fb" + integrity sha512-MgR55l4q9KddUDITEzEFYn5ZsGDXMSsU9E+kh7fjRXTIC3RHqfCo8RPRbyReYJh44HQ/yomFkqbOFohXvDCiIQ== dependencies: - "@babel/helper-module-transforms" "^7.25.9" + "@babel/helper-module-transforms" "^7.26.0" "@babel/helper-plugin-utils" "^7.25.9" - "@babel/helper-simple-access" "^7.25.9" - -"@babel/plugin-transform-modules-systemjs@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.24.7.tgz#f8012316c5098f6e8dee6ecd58e2bc6f003d0ce7" - integrity sha512-GYQE0tW7YoaN13qFh3O1NCY4MPkUiAH3fiF7UcV/I3ajmDKEdG3l+UOcbAm4zUE3gnvUU+Eni7XrVKo9eO9auw== - dependencies: - "@babel/helper-hoist-variables" "^7.24.7" - "@babel/helper-module-transforms" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/helper-validator-identifier" "^7.24.7" "@babel/plugin-transform-modules-systemjs@^7.25.9": version "7.25.9" @@ -1278,14 +662,6 @@ "@babel/helper-validator-identifier" "^7.25.9" "@babel/traverse" "^7.25.9" -"@babel/plugin-transform-modules-umd@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-modules-umd/-/plugin-transform-modules-umd-7.24.7.tgz#edd9f43ec549099620df7df24e7ba13b5c76efc8" - integrity sha512-3aytQvqJ/h9z4g8AsKPLvD4Zqi2qT+L3j7XoFFu1XBlZWEl2/1kWnhmAbxpLgPrHSY0M6UA02jyTiwUVtiKR6A== - dependencies: - "@babel/helper-module-transforms" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-modules-umd@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-modules-umd/-/plugin-transform-modules-umd-7.25.9.tgz#6710079cdd7c694db36529a1e8411e49fcbf14c9" @@ -1294,14 +670,6 @@ "@babel/helper-module-transforms" "^7.25.9" "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-named-capturing-groups-regex@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-named-capturing-groups-regex/-/plugin-transform-named-capturing-groups-regex-7.24.7.tgz#9042e9b856bc6b3688c0c2e4060e9e10b1460923" - integrity sha512-/jr7h/EWeJtk1U/uz2jlsCioHkZk1JJZVcc8oQsJ1dUlaJD83f4/6Zeh2aHt9BIFokHIsSeDfhUmju0+1GPd6g== - dependencies: - "@babel/helper-create-regexp-features-plugin" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-named-capturing-groups-regex@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-named-capturing-groups-regex/-/plugin-transform-named-capturing-groups-regex-7.25.9.tgz#454990ae6cc22fd2a0fa60b3a2c6f63a38064e6a" @@ -1310,13 +678,6 @@ "@babel/helper-create-regexp-features-plugin" "^7.25.9" "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-new-target@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-new-target/-/plugin-transform-new-target-7.24.7.tgz#31ff54c4e0555cc549d5816e4ab39241dfb6ab00" - integrity sha512-RNKwfRIXg4Ls/8mMTza5oPF5RkOW8Wy/WgMAp1/F1yZ8mMbtwXW+HDoJiOsagWrAhI5f57Vncrmr9XeT4CVapA== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-new-target@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-new-target/-/plugin-transform-new-target-7.25.9.tgz#42e61711294b105c248336dcb04b77054ea8becd" @@ -1324,28 +685,12 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-nullish-coalescing-operator@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-nullish-coalescing-operator/-/plugin-transform-nullish-coalescing-operator-7.24.7.tgz#1de4534c590af9596f53d67f52a92f12db984120" - integrity sha512-Ts7xQVk1OEocqzm8rHMXHlxvsfZ0cEF2yomUqpKENHWMF4zKk175Y4q8H5knJes6PgYad50uuRmt3UJuhBw8pQ== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-syntax-nullish-coalescing-operator" "^7.8.3" - "@babel/plugin-transform-nullish-coalescing-operator@^7.25.9": - version "7.25.9" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-nullish-coalescing-operator/-/plugin-transform-nullish-coalescing-operator-7.25.9.tgz#bcb1b0d9e948168102d5f7104375ca21c3266949" - integrity sha512-ENfftpLZw5EItALAD4WsY/KUWvhUlZndm5GC7G3evUsVeSJB6p0pBeLQUnRnBCBx7zV0RKQjR9kCuwrsIrjWog== - dependencies: - "@babel/helper-plugin-utils" "^7.25.9" - -"@babel/plugin-transform-numeric-separator@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-numeric-separator/-/plugin-transform-numeric-separator-7.24.7.tgz#bea62b538c80605d8a0fac9b40f48e97efa7de63" - integrity sha512-e6q1TiVUzvH9KRvicuxdBTUj4AdKSRwzIyFFnfnezpCfP2/7Qmbb8qbU2j7GODbl4JMkblitCQjKYUaX/qkkwA== + version "7.26.6" + resolved "https://registry.yarnpkg.com/@babel/plugin-transform-nullish-coalescing-operator/-/plugin-transform-nullish-coalescing-operator-7.26.6.tgz#fbf6b3c92cb509e7b319ee46e3da89c5bedd31fe" + integrity sha512-CKW8Vu+uUZneQCPtXmSBUC6NCAUdya26hWCElAWh5mVSlSRsmiCPUUDKb3Z0szng1hiAJa098Hkhg9o4SE35Qw== dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-syntax-numeric-separator" "^7.10.4" + "@babel/helper-plugin-utils" "^7.26.5" "@babel/plugin-transform-numeric-separator@^7.25.9": version "7.25.9" @@ -1354,16 +699,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-object-rest-spread@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-object-rest-spread/-/plugin-transform-object-rest-spread-7.24.7.tgz#d13a2b93435aeb8a197e115221cab266ba6e55d6" - integrity sha512-4QrHAr0aXQCEFni2q4DqKLD31n2DL+RxcwnNjDFkSG0eNQ/xCavnRkfCUjsyqGC2OviNJvZOF/mQqZBw7i2C5Q== - dependencies: - "@babel/helper-compilation-targets" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-syntax-object-rest-spread" "^7.8.3" - "@babel/plugin-transform-parameters" "^7.24.7" - "@babel/plugin-transform-object-rest-spread@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-object-rest-spread/-/plugin-transform-object-rest-spread-7.25.9.tgz#0203725025074164808bcf1a2cfa90c652c99f18" @@ -1373,14 +708,6 @@ "@babel/helper-plugin-utils" "^7.25.9" "@babel/plugin-transform-parameters" "^7.25.9" -"@babel/plugin-transform-object-super@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-object-super/-/plugin-transform-object-super-7.24.7.tgz#66eeaff7830bba945dd8989b632a40c04ed625be" - integrity sha512-A/vVLwN6lBrMFmMDmPPz0jnE6ZGx7Jq7d6sT/Ev4H65RER6pZ+kczlf1DthF5N0qaPHBsI7UXiE8Zy66nmAovg== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/helper-replace-supers" "^7.24.7" - "@babel/plugin-transform-object-super@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-object-super/-/plugin-transform-object-super-7.25.9.tgz#385d5de135162933beb4a3d227a2b7e52bb4cf03" @@ -1389,14 +716,6 @@ "@babel/helper-plugin-utils" "^7.25.9" "@babel/helper-replace-supers" "^7.25.9" -"@babel/plugin-transform-optional-catch-binding@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-optional-catch-binding/-/plugin-transform-optional-catch-binding-7.24.7.tgz#00eabd883d0dd6a60c1c557548785919b6e717b4" - integrity sha512-uLEndKqP5BfBbC/5jTwPxLh9kqPWWgzN/f8w6UwAIirAEqiIVJWWY312X72Eub09g5KF9+Zn7+hT7sDxmhRuKA== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-syntax-optional-catch-binding" "^7.8.3" - "@babel/plugin-transform-optional-catch-binding@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-optional-catch-binding/-/plugin-transform-optional-catch-binding-7.25.9.tgz#10e70d96d52bb1f10c5caaac59ac545ea2ba7ff3" @@ -1404,15 +723,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-optional-chaining@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-optional-chaining/-/plugin-transform-optional-chaining-7.24.7.tgz#b8f6848a80cf2da98a8a204429bec04756c6d454" - integrity sha512-tK+0N9yd4j+x/4hxF3F0e0fu/VdcxU18y5SevtyM/PCFlQvXbR0Zmlo2eBrKtVipGNFzpq56o8WsIIKcJFUCRQ== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/helper-skip-transparent-expression-wrappers" "^7.24.7" - "@babel/plugin-syntax-optional-chaining" "^7.8.3" - "@babel/plugin-transform-optional-chaining@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-optional-chaining/-/plugin-transform-optional-chaining-7.25.9.tgz#e142eb899d26ef715435f201ab6e139541eee7dd" @@ -1421,13 +731,6 @@ "@babel/helper-plugin-utils" "^7.25.9" "@babel/helper-skip-transparent-expression-wrappers" "^7.25.9" -"@babel/plugin-transform-parameters@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-parameters/-/plugin-transform-parameters-7.24.7.tgz#5881f0ae21018400e320fc7eb817e529d1254b68" - integrity sha512-yGWW5Rr+sQOhK0Ot8hjDJuxU3XLRQGflvT4lhlSY0DFvdb3TwKaY26CJzHtYllU0vT9j58hc37ndFPsqT1SrzA== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-parameters@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-parameters/-/plugin-transform-parameters-7.25.9.tgz#b856842205b3e77e18b7a7a1b94958069c7ba257" @@ -1435,14 +738,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-private-methods@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-private-methods/-/plugin-transform-private-methods-7.24.7.tgz#e6318746b2ae70a59d023d5cc1344a2ba7a75f5e" - integrity sha512-COTCOkG2hn4JKGEKBADkA8WNb35TGkkRbI5iT845dB+NyqgO8Hn+ajPbSnIQznneJTa3d30scb6iz/DhH8GsJQ== - dependencies: - "@babel/helper-create-class-features-plugin" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-private-methods@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-private-methods/-/plugin-transform-private-methods-7.25.9.tgz#847f4139263577526455d7d3223cd8bda51e3b57" @@ -1451,16 +746,6 @@ "@babel/helper-create-class-features-plugin" "^7.25.9" "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-private-property-in-object@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-private-property-in-object/-/plugin-transform-private-property-in-object-7.24.7.tgz#4eec6bc701288c1fab5f72e6a4bbc9d67faca061" - integrity sha512-9z76mxwnwFxMyxZWEgdgECQglF2Q7cFLm0kMf8pGwt+GSJsY0cONKj/UuO4bOH0w/uAel3ekS4ra5CEAyJRmDA== - dependencies: - "@babel/helper-annotate-as-pure" "^7.24.7" - "@babel/helper-create-class-features-plugin" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-syntax-private-property-in-object" "^7.14.5" - "@babel/plugin-transform-private-property-in-object@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-private-property-in-object/-/plugin-transform-private-property-in-object-7.25.9.tgz#9c8b73e64e6cc3cbb2743633885a7dd2c385fe33" @@ -1470,13 +755,6 @@ "@babel/helper-create-class-features-plugin" "^7.25.9" "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-property-literals@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-property-literals/-/plugin-transform-property-literals-7.24.7.tgz#f0d2ed8380dfbed949c42d4d790266525d63bbdc" - integrity sha512-EMi4MLQSHfd2nrCqQEWxFdha2gBCqU4ZcCng4WBGZ5CJL4bBRW0ptdqqDdeirGZcpALazVVNJqRmsO8/+oNCBA== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-property-literals@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-property-literals/-/plugin-transform-property-literals-7.25.9.tgz#d72d588bd88b0dec8b62e36f6fda91cedfe28e3f" @@ -1485,18 +763,11 @@ "@babel/helper-plugin-utils" "^7.25.9" "@babel/plugin-transform-react-constant-elements@^7.21.3": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-react-constant-elements/-/plugin-transform-react-constant-elements-7.24.7.tgz#b85e8f240b14400277f106c9c9b585d9acf608a1" - integrity sha512-7LidzZfUXyfZ8/buRW6qIIHBY8wAZ1OrY9c/wTr8YhZ6vMPo+Uc/CVFLYY1spZrEQlD4w5u8wjqk5NQ3OVqQKA== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - -"@babel/plugin-transform-react-display-name@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-react-display-name/-/plugin-transform-react-display-name-7.24.7.tgz#9caff79836803bc666bcfe210aeb6626230c293b" - integrity sha512-H/Snz9PFxKsS1JLI4dJLtnJgCJRoo0AUm3chP6NYr+9En1JMKloheEiLIhlp5MDVznWo+H3AAC1Mc8lmUEpsgg== + version "7.25.9" + resolved "https://registry.yarnpkg.com/@babel/plugin-transform-react-constant-elements/-/plugin-transform-react-constant-elements-7.25.9.tgz#08a1de35a301929b60fdf2788a54b46cd8ecd0ef" + integrity sha512-Ncw2JFsJVuvfRsa2lSHiC55kETQVLSnsYGQ1JDDwkUeWGTL/8Tom8aLTnlqgoeuopWrbbGndrc9AlLYrIosrow== dependencies: - "@babel/helper-plugin-utils" "^7.24.7" + "@babel/helper-plugin-utils" "^7.25.9" "@babel/plugin-transform-react-display-name@^7.25.9": version "7.25.9" @@ -1505,13 +776,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-react-jsx-development@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-react-jsx-development/-/plugin-transform-react-jsx-development-7.24.7.tgz#eaee12f15a93f6496d852509a850085e6361470b" - integrity sha512-QG9EnzoGn+Qar7rxuW+ZOsbWOt56FvvI93xInqsZDC5fsekx1AlIO4KIJ5M+D0p0SqSH156EpmZyXq630B8OlQ== - dependencies: - "@babel/plugin-transform-react-jsx" "^7.24.7" - "@babel/plugin-transform-react-jsx-development@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-react-jsx-development/-/plugin-transform-react-jsx-development-7.25.9.tgz#8fd220a77dd139c07e25225a903b8be8c829e0d7" @@ -1519,17 +783,6 @@ dependencies: "@babel/plugin-transform-react-jsx" "^7.25.9" -"@babel/plugin-transform-react-jsx@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-react-jsx/-/plugin-transform-react-jsx-7.24.7.tgz#17cd06b75a9f0e2bd076503400e7c4b99beedac4" - integrity sha512-+Dj06GDZEFRYvclU6k4bme55GKBEWUmByM/eoKuqg4zTNQHiApWRhQph5fxQB2wAEFvRzL1tOEj1RJ19wJrhoA== - dependencies: - "@babel/helper-annotate-as-pure" "^7.24.7" - "@babel/helper-module-imports" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-syntax-jsx" "^7.24.7" - "@babel/types" "^7.24.7" - "@babel/plugin-transform-react-jsx@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-react-jsx/-/plugin-transform-react-jsx-7.25.9.tgz#06367940d8325b36edff5e2b9cbe782947ca4166" @@ -1541,14 +794,6 @@ "@babel/plugin-syntax-jsx" "^7.25.9" "@babel/types" "^7.25.9" -"@babel/plugin-transform-react-pure-annotations@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-react-pure-annotations/-/plugin-transform-react-pure-annotations-7.24.7.tgz#bdd9d140d1c318b4f28b29a00fb94f97ecab1595" - integrity sha512-PLgBVk3fzbmEjBJ/u8kFzOqS9tUeDjiaWud/rRym/yjCo/M9cASPlnrd2ZmmZpQT40fOOrvR8jh+n8jikrOhNA== - dependencies: - "@babel/helper-annotate-as-pure" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-react-pure-annotations@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-react-pure-annotations/-/plugin-transform-react-pure-annotations-7.25.9.tgz#ea1c11b2f9dbb8e2d97025f43a3b5bc47e18ae62" @@ -1557,14 +802,6 @@ "@babel/helper-annotate-as-pure" "^7.25.9" "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-regenerator@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-regenerator/-/plugin-transform-regenerator-7.24.7.tgz#021562de4534d8b4b1851759fd7af4e05d2c47f8" - integrity sha512-lq3fvXPdimDrlg6LWBoqj+r/DEWgONuwjuOuQCSYgRroXDH/IdM1C0IZf59fL5cHLpjEH/O6opIRBbqv7ELnuA== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - regenerator-transform "^0.15.2" - "@babel/plugin-transform-regenerator@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-regenerator/-/plugin-transform-regenerator-7.25.9.tgz#03a8a4670d6cebae95305ac6defac81ece77740b" @@ -1581,13 +818,6 @@ "@babel/helper-create-regexp-features-plugin" "^7.25.9" "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-reserved-words@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-reserved-words/-/plugin-transform-reserved-words-7.24.7.tgz#80037fe4fbf031fc1125022178ff3938bb3743a4" - integrity sha512-0DUq0pHcPKbjFZCfTss/pGkYMfy3vFWydkUBd9r0GHpIyfs2eCDENvqadMycRS9wZCXR41wucAfJHJmwA0UmoQ== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-reserved-words@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-reserved-words/-/plugin-transform-reserved-words-7.25.9.tgz#0398aed2f1f10ba3f78a93db219b27ef417fb9ce" @@ -1607,13 +837,6 @@ babel-plugin-polyfill-regenerator "^0.6.1" semver "^6.3.1" -"@babel/plugin-transform-shorthand-properties@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-shorthand-properties/-/plugin-transform-shorthand-properties-7.24.7.tgz#85448c6b996e122fa9e289746140aaa99da64e73" - integrity sha512-KsDsevZMDsigzbA09+vacnLpmPH4aWjcZjXdyFKGzpplxhbeB4wYtury3vglQkg6KM/xEPKt73eCjPPf1PgXBA== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-shorthand-properties@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-shorthand-properties/-/plugin-transform-shorthand-properties-7.25.9.tgz#bb785e6091f99f826a95f9894fc16fde61c163f2" @@ -1621,14 +844,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-spread@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-spread/-/plugin-transform-spread-7.24.7.tgz#e8a38c0fde7882e0fb8f160378f74bd885cc7bb3" - integrity sha512-x96oO0I09dgMDxJaANcRyD4ellXFLLiWhuwDxKZX5g2rWP1bTPkBSwCYv96VDXVT1bD9aPj8tppr5ITIh8hBng== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/helper-skip-transparent-expression-wrappers" "^7.24.7" - "@babel/plugin-transform-spread@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-spread/-/plugin-transform-spread-7.25.9.tgz#24a35153931b4ba3d13cec4a7748c21ab5514ef9" @@ -1637,13 +852,6 @@ "@babel/helper-plugin-utils" "^7.25.9" "@babel/helper-skip-transparent-expression-wrappers" "^7.25.9" -"@babel/plugin-transform-sticky-regex@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-sticky-regex/-/plugin-transform-sticky-regex-7.24.7.tgz#96ae80d7a7e5251f657b5cf18f1ea6bf926f5feb" - integrity sha512-kHPSIJc9v24zEml5geKg9Mjx5ULpfncj0wRpYtxbvKyTtHCYDkVE3aHQ03FrpEo4gEe2vrJJS1Y9CJTaThA52g== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-sticky-regex@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-sticky-regex/-/plugin-transform-sticky-regex-7.25.9.tgz#c7f02b944e986a417817b20ba2c504dfc1453d32" @@ -1651,13 +859,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-template-literals@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-template-literals/-/plugin-transform-template-literals-7.24.7.tgz#a05debb4a9072ae8f985bcf77f3f215434c8f8c8" - integrity sha512-AfDTQmClklHCOLxtGoP7HkeMw56k1/bTQjwsfhL6pppo/M4TOBSq+jjBUBLmV/4oeFg4GWMavIl44ZeCtmmZTw== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-template-literals@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-template-literals/-/plugin-transform-template-literals-7.25.9.tgz#6dbd4a24e8fad024df76d1fac6a03cf413f60fe1" @@ -1665,13 +866,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-typeof-symbol@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-typeof-symbol/-/plugin-transform-typeof-symbol-7.24.7.tgz#f074be466580d47d6e6b27473a840c9f9ca08fb0" - integrity sha512-VtR8hDy7YLB7+Pet9IarXjg/zgCMSF+1mNS/EQEiEaUPoFXCVsHG64SIxcaaI2zJgRiv+YmgaQESUfWAdbjzgg== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-typeof-symbol@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-typeof-symbol/-/plugin-transform-typeof-symbol-7.25.9.tgz#224ba48a92869ddbf81f9b4a5f1204bbf5a2bc4b" @@ -1679,34 +873,17 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-typescript@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-typescript/-/plugin-transform-typescript-7.24.7.tgz#b006b3e0094bf0813d505e0c5485679eeaf4a881" - integrity sha512-iLD3UNkgx2n/HrjBesVbYX6j0yqn/sJktvbtKKgcaLIQ4bTTQ8obAypc1VpyHPD2y4Phh9zHOaAt8e/L14wCpw== - dependencies: - "@babel/helper-annotate-as-pure" "^7.24.7" - "@babel/helper-create-class-features-plugin" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-syntax-typescript" "^7.24.7" - "@babel/plugin-transform-typescript@^7.25.9": - version "7.25.9" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-typescript/-/plugin-transform-typescript-7.25.9.tgz#69267905c2b33c2ac6d8fe765e9dc2ddc9df3849" - integrity sha512-7PbZQZP50tzv2KGGnhh82GSyMB01yKY9scIjf1a+GfZCtInOWqUH5+1EBU4t9fyR5Oykkkc9vFTs4OHrhHXljQ== + version "7.26.5" + resolved "https://registry.yarnpkg.com/@babel/plugin-transform-typescript/-/plugin-transform-typescript-7.26.5.tgz#6d9b48e8ee40a45a3ed12ebc013449fdf261714c" + integrity sha512-GJhPO0y8SD5EYVCy2Zr+9dSZcEgaSmq5BLR0Oc25TOEhC+ba49vUAGZFjy8v79z9E1mdldq4x9d1xgh4L1d5dQ== dependencies: "@babel/helper-annotate-as-pure" "^7.25.9" "@babel/helper-create-class-features-plugin" "^7.25.9" - "@babel/helper-plugin-utils" "^7.25.9" + "@babel/helper-plugin-utils" "^7.26.5" "@babel/helper-skip-transparent-expression-wrappers" "^7.25.9" "@babel/plugin-syntax-typescript" "^7.25.9" -"@babel/plugin-transform-unicode-escapes@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-unicode-escapes/-/plugin-transform-unicode-escapes-7.24.7.tgz#2023a82ced1fb4971630a2e079764502c4148e0e" - integrity sha512-U3ap1gm5+4edc2Q/P+9VrBNhGkfnf+8ZqppY71Bo/pzZmXhhLdqgaUl6cuB07O1+AQJtCLfaOmswiNbSQ9ivhw== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-unicode-escapes@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-unicode-escapes/-/plugin-transform-unicode-escapes-7.25.9.tgz#a75ef3947ce15363fccaa38e2dd9bc70b2788b82" @@ -1714,14 +891,6 @@ dependencies: "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-unicode-property-regex@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-unicode-property-regex/-/plugin-transform-unicode-property-regex-7.24.7.tgz#9073a4cd13b86ea71c3264659590ac086605bbcd" - integrity sha512-uH2O4OV5M9FZYQrwc7NdVmMxQJOCCzFeYudlZSzUAHRFeOujQefa92E74TQDVskNHCzOXoigEuoyzHDhaEaK5w== - dependencies: - "@babel/helper-create-regexp-features-plugin" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-unicode-property-regex@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-unicode-property-regex/-/plugin-transform-unicode-property-regex-7.25.9.tgz#a901e96f2c1d071b0d1bb5dc0d3c880ce8f53dd3" @@ -1730,14 +899,6 @@ "@babel/helper-create-regexp-features-plugin" "^7.25.9" "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-unicode-regex@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-unicode-regex/-/plugin-transform-unicode-regex-7.24.7.tgz#dfc3d4a51127108099b19817c0963be6a2adf19f" - integrity sha512-hlQ96MBZSAXUq7ltkjtu3FJCCSMx/j629ns3hA3pXnBXjanNP0LHi+JpPeA81zaWgVK1VGH95Xuy7u0RyQ8kMg== - dependencies: - "@babel/helper-create-regexp-features-plugin" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-unicode-regex@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-unicode-regex/-/plugin-transform-unicode-regex-7.25.9.tgz#5eae747fe39eacf13a8bd006a4fb0b5d1fa5e9b1" @@ -1746,14 +907,6 @@ "@babel/helper-create-regexp-features-plugin" "^7.25.9" "@babel/helper-plugin-utils" "^7.25.9" -"@babel/plugin-transform-unicode-sets-regex@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/plugin-transform-unicode-sets-regex/-/plugin-transform-unicode-sets-regex-7.24.7.tgz#d40705d67523803a576e29c63cef6e516b858ed9" - integrity sha512-2G8aAvF4wy1w/AGZkemprdGMRg5o6zPNhbHVImRz3lss55TYCBd6xStN19rt8XJHq20sqV0JbyWjOWwQRwV/wg== - dependencies: - "@babel/helper-create-regexp-features-plugin" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/plugin-transform-unicode-sets-regex@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/plugin-transform-unicode-sets-regex/-/plugin-transform-unicode-sets-regex-7.25.9.tgz#65114c17b4ffc20fa5b163c63c70c0d25621fabe" @@ -1762,94 +915,7 @@ "@babel/helper-create-regexp-features-plugin" "^7.25.9" "@babel/helper-plugin-utils" "^7.25.9" -"@babel/preset-env@^7.20.2": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/preset-env/-/preset-env-7.24.7.tgz#ff067b4e30ba4a72f225f12f123173e77b987f37" - integrity sha512-1YZNsc+y6cTvWlDHidMBsQZrZfEFjRIo/BZCT906PMdzOyXtSLTgqGdrpcuTDCXyd11Am5uQULtDIcCfnTc8fQ== - dependencies: - "@babel/compat-data" "^7.24.7" - "@babel/helper-compilation-targets" "^7.24.7" - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/helper-validator-option" "^7.24.7" - "@babel/plugin-bugfix-firefox-class-in-computed-class-key" "^7.24.7" - "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression" "^7.24.7" - "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining" "^7.24.7" - "@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly" "^7.24.7" - "@babel/plugin-proposal-private-property-in-object" "7.21.0-placeholder-for-preset-env.2" - "@babel/plugin-syntax-async-generators" "^7.8.4" - "@babel/plugin-syntax-class-properties" "^7.12.13" - "@babel/plugin-syntax-class-static-block" "^7.14.5" - "@babel/plugin-syntax-dynamic-import" "^7.8.3" - "@babel/plugin-syntax-export-namespace-from" "^7.8.3" - "@babel/plugin-syntax-import-assertions" "^7.24.7" - "@babel/plugin-syntax-import-attributes" "^7.24.7" - "@babel/plugin-syntax-import-meta" "^7.10.4" - "@babel/plugin-syntax-json-strings" "^7.8.3" - "@babel/plugin-syntax-logical-assignment-operators" "^7.10.4" - "@babel/plugin-syntax-nullish-coalescing-operator" "^7.8.3" - "@babel/plugin-syntax-numeric-separator" "^7.10.4" - "@babel/plugin-syntax-object-rest-spread" "^7.8.3" - "@babel/plugin-syntax-optional-catch-binding" "^7.8.3" - "@babel/plugin-syntax-optional-chaining" "^7.8.3" - "@babel/plugin-syntax-private-property-in-object" "^7.14.5" - "@babel/plugin-syntax-top-level-await" "^7.14.5" - "@babel/plugin-syntax-unicode-sets-regex" "^7.18.6" - "@babel/plugin-transform-arrow-functions" "^7.24.7" - "@babel/plugin-transform-async-generator-functions" "^7.24.7" - "@babel/plugin-transform-async-to-generator" "^7.24.7" - "@babel/plugin-transform-block-scoped-functions" "^7.24.7" - "@babel/plugin-transform-block-scoping" "^7.24.7" - "@babel/plugin-transform-class-properties" "^7.24.7" - "@babel/plugin-transform-class-static-block" "^7.24.7" - "@babel/plugin-transform-classes" "^7.24.7" - "@babel/plugin-transform-computed-properties" "^7.24.7" - "@babel/plugin-transform-destructuring" "^7.24.7" - "@babel/plugin-transform-dotall-regex" "^7.24.7" - "@babel/plugin-transform-duplicate-keys" "^7.24.7" - "@babel/plugin-transform-dynamic-import" "^7.24.7" - "@babel/plugin-transform-exponentiation-operator" "^7.24.7" - "@babel/plugin-transform-export-namespace-from" "^7.24.7" - "@babel/plugin-transform-for-of" "^7.24.7" - "@babel/plugin-transform-function-name" "^7.24.7" - "@babel/plugin-transform-json-strings" "^7.24.7" - "@babel/plugin-transform-literals" "^7.24.7" - "@babel/plugin-transform-logical-assignment-operators" "^7.24.7" - "@babel/plugin-transform-member-expression-literals" "^7.24.7" - "@babel/plugin-transform-modules-amd" "^7.24.7" - "@babel/plugin-transform-modules-commonjs" "^7.24.7" - "@babel/plugin-transform-modules-systemjs" "^7.24.7" - "@babel/plugin-transform-modules-umd" "^7.24.7" - "@babel/plugin-transform-named-capturing-groups-regex" "^7.24.7" - "@babel/plugin-transform-new-target" "^7.24.7" - "@babel/plugin-transform-nullish-coalescing-operator" "^7.24.7" - "@babel/plugin-transform-numeric-separator" "^7.24.7" - "@babel/plugin-transform-object-rest-spread" "^7.24.7" - "@babel/plugin-transform-object-super" "^7.24.7" - "@babel/plugin-transform-optional-catch-binding" "^7.24.7" - "@babel/plugin-transform-optional-chaining" "^7.24.7" - "@babel/plugin-transform-parameters" "^7.24.7" - "@babel/plugin-transform-private-methods" "^7.24.7" - "@babel/plugin-transform-private-property-in-object" "^7.24.7" - "@babel/plugin-transform-property-literals" "^7.24.7" - "@babel/plugin-transform-regenerator" "^7.24.7" - "@babel/plugin-transform-reserved-words" "^7.24.7" - "@babel/plugin-transform-shorthand-properties" "^7.24.7" - "@babel/plugin-transform-spread" "^7.24.7" - "@babel/plugin-transform-sticky-regex" "^7.24.7" - "@babel/plugin-transform-template-literals" "^7.24.7" - "@babel/plugin-transform-typeof-symbol" "^7.24.7" - "@babel/plugin-transform-unicode-escapes" "^7.24.7" - "@babel/plugin-transform-unicode-property-regex" "^7.24.7" - "@babel/plugin-transform-unicode-regex" "^7.24.7" - "@babel/plugin-transform-unicode-sets-regex" "^7.24.7" - "@babel/preset-modules" "0.1.6-no-external-plugins" - babel-plugin-polyfill-corejs2 "^0.4.10" - babel-plugin-polyfill-corejs3 "^0.10.4" - babel-plugin-polyfill-regenerator "^0.6.1" - core-js-compat "^3.31.0" - semver "^6.3.1" - -"@babel/preset-env@^7.25.9": +"@babel/preset-env@^7.20.2", "@babel/preset-env@^7.25.9": version "7.26.0" resolved "https://registry.yarnpkg.com/@babel/preset-env/-/preset-env-7.26.0.tgz#30e5c6bc1bcc54865bff0c5a30f6d4ccdc7fa8b1" integrity sha512-H84Fxq0CQJNdPFT2DrfnylZ3cf5K43rGfWK4LJGPpjKHiZlk0/RzwEus3PDDZZg+/Er7lCA03MVacueUuXdzfw== @@ -1933,22 +999,10 @@ "@babel/types" "^7.4.4" esutils "^2.0.2" -"@babel/preset-react@^7.18.6": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/preset-react/-/preset-react-7.24.7.tgz#480aeb389b2a798880bf1f889199e3641cbb22dc" - integrity sha512-AAH4lEkpmzFWrGVlHaxJB7RLH21uPQ9+He+eFLWHmF9IuFQVugz8eAsamaW0DXRrTfco5zj1wWtpdcXJUOfsag== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/helper-validator-option" "^7.24.7" - "@babel/plugin-transform-react-display-name" "^7.24.7" - "@babel/plugin-transform-react-jsx" "^7.24.7" - "@babel/plugin-transform-react-jsx-development" "^7.24.7" - "@babel/plugin-transform-react-pure-annotations" "^7.24.7" - -"@babel/preset-react@^7.25.9": - version "7.25.9" - resolved "https://registry.yarnpkg.com/@babel/preset-react/-/preset-react-7.25.9.tgz#5f473035dc2094bcfdbc7392d0766bd42dce173e" - integrity sha512-D3to0uSPiWE7rBrdIICCd0tJSIGpLaaGptna2+w7Pft5xMqLpA1sz99DK5TZ1TjGbdQ/VI1eCSZ06dv3lT4JOw== +"@babel/preset-react@^7.18.6", "@babel/preset-react@^7.25.9": + version "7.26.3" + resolved "https://registry.yarnpkg.com/@babel/preset-react/-/preset-react-7.26.3.tgz#7c5e028d623b4683c1f83a0bd4713b9100560caa" + integrity sha512-Nl03d6T9ky516DGK2YMxrTqvnpUW63TnJMOMonj+Zae0JiPC5BC9xPMSL6L8fiSpA5vP88qfygavVQvnLp+6Cw== dependencies: "@babel/helper-plugin-utils" "^7.25.9" "@babel/helper-validator-option" "^7.25.9" @@ -1957,18 +1011,7 @@ "@babel/plugin-transform-react-jsx-development" "^7.25.9" "@babel/plugin-transform-react-pure-annotations" "^7.25.9" -"@babel/preset-typescript@^7.21.0": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/preset-typescript/-/preset-typescript-7.24.7.tgz#66cd86ea8f8c014855671d5ea9a737139cbbfef1" - integrity sha512-SyXRe3OdWwIwalxDg5UtJnJQO+YPcTfwiIY2B0Xlddh9o7jpWLvv8X1RthIeDOxQ+O1ML5BLPCONToObyVQVuQ== - dependencies: - "@babel/helper-plugin-utils" "^7.24.7" - "@babel/helper-validator-option" "^7.24.7" - "@babel/plugin-syntax-jsx" "^7.24.7" - "@babel/plugin-transform-modules-commonjs" "^7.24.7" - "@babel/plugin-transform-typescript" "^7.24.7" - -"@babel/preset-typescript@^7.25.9": +"@babel/preset-typescript@^7.21.0", "@babel/preset-typescript@^7.25.9": version "7.26.0" resolved "https://registry.yarnpkg.com/@babel/preset-typescript/-/preset-typescript-7.26.0.tgz#4a570f1b8d104a242d923957ffa1eaff142a106d" integrity sha512-NMk1IGZ5I/oHhoXEElcm+xUnL/szL6xflkFZmoEU9xj1qSJXpiS7rsspYo92B4DRCDvZn2erT5LdsCeXAKNCkg== @@ -1979,11 +1022,6 @@ "@babel/plugin-transform-modules-commonjs" "^7.25.9" "@babel/plugin-transform-typescript" "^7.25.9" -"@babel/regjsgen@^0.8.0": - version "0.8.0" - resolved "https://registry.yarnpkg.com/@babel/regjsgen/-/regjsgen-0.8.0.tgz#f0ba69b075e1f05fb2825b7fad991e7adbb18310" - integrity sha512-x/rqGMdzj+fWZvCOYForTghzbtqPDZ5gPwaoNGHdgDfF2QA/XZbCBp4Moo5scrkAMPhB7z26XM/AaHuIJdgauA== - "@babel/runtime-corejs3@^7.25.9": version "7.26.0" resolved "https://registry.yarnpkg.com/@babel/runtime-corejs3/-/runtime-corejs3-7.26.0.tgz#5af6bed16073eb4a0191233d61e158a5c768c430" @@ -1992,29 +1030,13 @@ core-js-pure "^3.30.2" regenerator-runtime "^0.14.0" -"@babel/runtime@^7.1.2", "@babel/runtime@^7.10.3", "@babel/runtime@^7.12.13", "@babel/runtime@^7.12.5", "@babel/runtime@^7.17.8", "@babel/runtime@^7.18.3", "@babel/runtime@^7.22.6", "@babel/runtime@^7.23.2", "@babel/runtime@^7.23.9", "@babel/runtime@^7.5.5", "@babel/runtime@^7.8.4", "@babel/runtime@^7.8.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/runtime/-/runtime-7.24.7.tgz#f4f0d5530e8dbdf59b3451b9b3e594b6ba082e12" - integrity sha512-UwgBRMjJP+xv857DCngvqXI3Iq6J4v0wXmwc6sapg+zyhbwmQX67LUEFrkK5tbyJ30jGuG3ZvWpBiB9LCy1kWw== - dependencies: - regenerator-runtime "^0.14.0" - -"@babel/runtime@^7.25.9": +"@babel/runtime@^7.1.2", "@babel/runtime@^7.10.3", "@babel/runtime@^7.12.13", "@babel/runtime@^7.12.5", "@babel/runtime@^7.17.8", "@babel/runtime@^7.18.3", "@babel/runtime@^7.25.7", "@babel/runtime@^7.25.9", "@babel/runtime@^7.26.0", "@babel/runtime@^7.5.5", "@babel/runtime@^7.8.4", "@babel/runtime@^7.8.7": version "7.26.0" resolved "https://registry.yarnpkg.com/@babel/runtime/-/runtime-7.26.0.tgz#8600c2f595f277c60815256418b85356a65173c1" integrity sha512-FDSOghenHTiToteC/QRlv2q3DhPZ/oOXTBoirfWNx1Cx3TMVcGWQtMMmQcSvb/JjpNeGzx8Pq/b4fKEJuWm1sw== dependencies: regenerator-runtime "^0.14.0" -"@babel/template@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/template/-/template-7.24.7.tgz#02efcee317d0609d2c07117cb70ef8fb17ab7315" - integrity sha512-jYqfPrU9JTF0PmPy1tLYHW4Mp4KlgxJD9l2nP9fD6yT/ICi554DmrWBAEYpIelzjHf1msDP3PxJIRt/nFNfBig== - dependencies: - "@babel/code-frame" "^7.24.7" - "@babel/parser" "^7.24.7" - "@babel/types" "^7.24.7" - "@babel/template@^7.25.9": version "7.25.9" resolved "https://registry.yarnpkg.com/@babel/template/-/template-7.25.9.tgz#ecb62d81a8a6f5dc5fe8abfc3901fc52ddf15016" @@ -2024,134 +1046,426 @@ "@babel/parser" "^7.25.9" "@babel/types" "^7.25.9" -"@babel/traverse@^7.24.7": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.24.7.tgz#de2b900163fa741721ba382163fe46a936c40cf5" - integrity sha512-yb65Ed5S/QAcewNPh0nZczy9JdYXkkAbIsEo+P7BE7yO3txAY30Y/oPa3QkQ5It3xVG2kpKMg9MsdxZaO31uKA== - dependencies: - "@babel/code-frame" "^7.24.7" - "@babel/generator" "^7.24.7" - "@babel/helper-environment-visitor" "^7.24.7" - "@babel/helper-function-name" "^7.24.7" - "@babel/helper-hoist-variables" "^7.24.7" - "@babel/helper-split-export-declaration" "^7.24.7" - "@babel/parser" "^7.24.7" - "@babel/types" "^7.24.7" - debug "^4.3.1" - globals "^11.1.0" - -"@babel/traverse@^7.25.9": - version "7.25.9" - resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.25.9.tgz#a50f8fe49e7f69f53de5bea7e413cd35c5e13c84" - integrity sha512-ZCuvfwOwlz/bawvAuvcj8rrithP2/N55Tzz342AkTvq4qaWbGfmCk/tKhNaV2cthijKrPAA8SRJV5WWe7IBMJw== +"@babel/traverse@^7.24.7", "@babel/traverse@^7.25.9", "@babel/traverse@^7.26.5": + version "7.26.5" + resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.26.5.tgz#6d0be3e772ff786456c1a37538208286f6e79021" + integrity sha512-rkOSPOw+AXbgtwUga3U4u8RpoK9FEFWBNAlTpcnkLFjL5CT+oyHNuUUC/xx6XefEJ16r38r8Bc/lfp6rYuHeJQ== dependencies: - "@babel/code-frame" "^7.25.9" - "@babel/generator" "^7.25.9" - "@babel/parser" "^7.25.9" + "@babel/code-frame" "^7.26.2" + "@babel/generator" "^7.26.5" + "@babel/parser" "^7.26.5" "@babel/template" "^7.25.9" - "@babel/types" "^7.25.9" + "@babel/types" "^7.26.5" debug "^4.3.1" globals "^11.1.0" -"@babel/types@^7.21.3", "@babel/types@^7.24.7", "@babel/types@^7.4.4": - version "7.24.7" - resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.24.7.tgz#6027fe12bc1aa724cd32ab113fb7f1988f1f66f2" - integrity sha512-XEFXSlxiG5td2EJRe8vOmRbaXVgfcBlszKujvVmWIK/UpywWljQCfzAv3RQCGujWQ1RD4YYWEAqDXfuJiy8f5Q== - dependencies: - "@babel/helper-string-parser" "^7.24.7" - "@babel/helper-validator-identifier" "^7.24.7" - to-fast-properties "^2.0.0" - -"@babel/types@^7.25.9", "@babel/types@^7.26.0": - version "7.26.0" - resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.26.0.tgz#deabd08d6b753bc8e0f198f8709fb575e31774ff" - integrity sha512-Z/yiTPj+lDVnF7lWeKCIJzaIkI0vYO87dMpZ4bg4TDrFe4XXLFWL1TbXU27gBP3QccxV9mZICCrnjnYlJjXHOA== +"@babel/types@^7.21.3", "@babel/types@^7.24.7", "@babel/types@^7.25.9", "@babel/types@^7.26.0", "@babel/types@^7.26.5", "@babel/types@^7.4.4": + version "7.26.5" + resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.26.5.tgz#7a1e1c01d28e26d1fe7f8ec9567b3b92b9d07747" + integrity sha512-L6mZmwFDK6Cjh1nRCLXpa6no13ZIioJDz7mdkzHv399pThrTa/k0nUlNaenOeh2kWu/iaOQYElEpKPUswUa9Vg== dependencies: "@babel/helper-string-parser" "^7.25.9" "@babel/helper-validator-identifier" "^7.25.9" -"@braintree/sanitize-url@^6.0.1": - version "6.0.4" - resolved "https://registry.yarnpkg.com/@braintree/sanitize-url/-/sanitize-url-6.0.4.tgz#923ca57e173c6b232bbbb07347b1be982f03e783" - integrity sha512-s3jaWicZd0pkP0jf5ysyHUI/RE7MHos6qlToFcGWXVp+ykHOy77OUMrfbgJ9it2C5bow7OIQwYYaHjk9XlBQ2A== +"@braintree/sanitize-url@^7.0.1": + version "7.1.1" + resolved "https://registry.yarnpkg.com/@braintree/sanitize-url/-/sanitize-url-7.1.1.tgz#15e19737d946559289b915e5dad3b4c28407735e" + integrity sha512-i1L7noDNxtFyL5DmZafWy1wRVhGehQmzZaz1HiN5e7iylJMSZR7ekOV7NsIqa5qBldlLrsKv4HbgFUVlQrz8Mw== + +"@cfaester/enzyme-adapter-react-18@^0.8.0": + version "0.8.0" + resolved "https://registry.yarnpkg.com/@cfaester/enzyme-adapter-react-18/-/enzyme-adapter-react-18-0.8.0.tgz#313814eb79658a6e74209f9f1743bcefff14a46f" + integrity sha512-3Z3ThTUouHwz8oIyhTYQljEMNRFtlVyc3VOOHCbxs47U6cnXs8K9ygi/c1tv49s7MBlTXeIcuN+Ttd9aPtILFQ== + dependencies: + enzyme-shallow-equal "^1.0.0" + function.prototype.name "^1.1.6" + has "^1.0.4" + react-is "^18.2.0" + react-shallow-renderer "^16.15.0" + +"@chevrotain/cst-dts-gen@11.0.3": + version "11.0.3" + resolved "https://registry.yarnpkg.com/@chevrotain/cst-dts-gen/-/cst-dts-gen-11.0.3.tgz#5e0863cc57dc45e204ccfee6303225d15d9d4783" + integrity sha512-BvIKpRLeS/8UbfxXxgC33xOumsacaeCKAjAeLyOn7Pcp95HiRbrpl14S+9vaZLolnbssPIUuiUd8IvgkRyt6NQ== + dependencies: + "@chevrotain/gast" "11.0.3" + "@chevrotain/types" "11.0.3" + lodash-es "4.17.21" + +"@chevrotain/gast@11.0.3": + version "11.0.3" + resolved "https://registry.yarnpkg.com/@chevrotain/gast/-/gast-11.0.3.tgz#e84d8880323fe8cbe792ef69ce3ffd43a936e818" + integrity sha512-+qNfcoNk70PyS/uxmj3li5NiECO+2YKZZQMbmjTqRI3Qchu8Hig/Q9vgkHpI3alNjr7M+a2St5pw5w5F6NL5/Q== + dependencies: + "@chevrotain/types" "11.0.3" + lodash-es "4.17.21" + +"@chevrotain/regexp-to-ast@11.0.3": + version "11.0.3" + resolved "https://registry.yarnpkg.com/@chevrotain/regexp-to-ast/-/regexp-to-ast-11.0.3.tgz#11429a81c74a8e6a829271ce02fc66166d56dcdb" + integrity sha512-1fMHaBZxLFvWI067AVbGJav1eRY7N8DDvYCTwGBiE/ytKBgP8azTdgyrKyWZ9Mfh09eHWb5PgTSO8wi7U824RA== + +"@chevrotain/types@11.0.3": + version "11.0.3" + resolved "https://registry.yarnpkg.com/@chevrotain/types/-/types-11.0.3.tgz#f8a03914f7b937f594f56eb89312b3b8f1c91848" + integrity sha512-gsiM3G8b58kZC2HaWR50gu6Y1440cHiJ+i3JUvcp/35JchYejb2+5MVeJK0iKThYpAa/P2PYFV4hoi44HD+aHQ== + +"@chevrotain/utils@11.0.3": + version "11.0.3" + resolved "https://registry.yarnpkg.com/@chevrotain/utils/-/utils-11.0.3.tgz#e39999307b102cff3645ec4f5b3665f5297a2224" + integrity sha512-YslZMgtJUyuMbZ+aKvfF3x1f5liK4mWNxghFRv7jqRR9C3R3fAOGTTKvxXDa2Y1s9zSbcpuO0cAxDYsc9SrXoQ== + +"@colors/colors@1.5.0": + version "1.5.0" + resolved "https://registry.yarnpkg.com/@colors/colors/-/colors-1.5.0.tgz#bb504579c1cae923e6576a4f5da43d25f97bdbd9" + integrity sha512-ooWCrlZP11i8GImSjTHYHLkvFDP48nS4+204nGb1RiX/WXYHmJA2III9/e2DWVabCESdW7hBAEzHRqUn9OUVvQ== + +"@csstools/cascade-layer-name-parser@^2.0.4": + version "2.0.4" + resolved "https://registry.yarnpkg.com/@csstools/cascade-layer-name-parser/-/cascade-layer-name-parser-2.0.4.tgz#64d128529397aa1e1c986f685713363b262b81b1" + integrity sha512-7DFHlPuIxviKYZrOiwVU/PiHLm3lLUR23OMuEEtfEOQTOp9hzQ2JjdY6X5H18RVuUPJqSCI+qNnD5iOLMVE0bA== + +"@csstools/color-helpers@^5.0.1": + version "5.0.1" + resolved "https://registry.yarnpkg.com/@csstools/color-helpers/-/color-helpers-5.0.1.tgz#829f1c76f5800b79c51c709e2f36821b728e0e10" + integrity sha512-MKtmkA0BX87PKaO1NFRTFH+UnkgnmySQOvNxJubsadusqPEC2aJ9MOQiMceZJJ6oitUl/i0L6u0M1IrmAOmgBA== + +"@csstools/css-calc@^2.1.1": + version "2.1.1" + resolved "https://registry.yarnpkg.com/@csstools/css-calc/-/css-calc-2.1.1.tgz#a7dbc66627f5cf458d42aed14bda0d3860562383" + integrity sha512-rL7kaUnTkL9K+Cvo2pnCieqNpTKgQzy5f+N+5Iuko9HAoasP+xgprVh7KN/MaJVvVL1l0EzQq2MoqBHKSrDrag== + +"@csstools/css-color-parser@^3.0.7": + version "3.0.7" + resolved "https://registry.yarnpkg.com/@csstools/css-color-parser/-/css-color-parser-3.0.7.tgz#442d61d58e54ad258d52c309a787fceb33906484" + integrity sha512-nkMp2mTICw32uE5NN+EsJ4f5N+IGFeCFu4bGpiKgb2Pq/7J/MpyLBeQ5ry4KKtRFZaYs6sTmcMYrSRIyj5DFKA== + dependencies: + "@csstools/color-helpers" "^5.0.1" + "@csstools/css-calc" "^2.1.1" + +"@csstools/css-parser-algorithms@^3.0.4": + version "3.0.4" + resolved "https://registry.yarnpkg.com/@csstools/css-parser-algorithms/-/css-parser-algorithms-3.0.4.tgz#74426e93bd1c4dcab3e441f5cc7ba4fb35d94356" + integrity sha512-Up7rBoV77rv29d3uKHUIVubz1BTcgyUK72IvCQAbfbMv584xHcGKCKbWh7i8hPrRJ7qU4Y8IO3IY9m+iTB7P3A== + +"@csstools/css-tokenizer@^3.0.3": + version "3.0.3" + resolved "https://registry.yarnpkg.com/@csstools/css-tokenizer/-/css-tokenizer-3.0.3.tgz#a5502c8539265fecbd873c1e395a890339f119c2" + integrity sha512-UJnjoFsmxfKUdNYdWgOB0mWUypuLvAfQPH1+pyvRJs6euowbFkFC6P13w1l8mJyi3vxYMxc9kld5jZEGRQs6bw== + +"@csstools/media-query-list-parser@^4.0.2": + version "4.0.2" + resolved "https://registry.yarnpkg.com/@csstools/media-query-list-parser/-/media-query-list-parser-4.0.2.tgz#e80e17eba1693fceafb8d6f2cfc68c0e7a9ab78a" + integrity sha512-EUos465uvVvMJehckATTlNqGj4UJWkTmdWuDMjqvSUkjGpmOyFZBVwb4knxCm/k2GMTXY+c/5RkdndzFYWeX5A== + +"@csstools/postcss-cascade-layers@^5.0.1": + version "5.0.1" + resolved "https://registry.yarnpkg.com/@csstools/postcss-cascade-layers/-/postcss-cascade-layers-5.0.1.tgz#9640313e64b5e39133de7e38a5aa7f40dc259597" + integrity sha512-XOfhI7GShVcKiKwmPAnWSqd2tBR0uxt+runAxttbSp/LY2U16yAVPmAf7e9q4JJ0d+xMNmpwNDLBXnmRCl3HMQ== + dependencies: + "@csstools/selector-specificity" "^5.0.0" + postcss-selector-parser "^7.0.0" + +"@csstools/postcss-color-function@^4.0.7": + version "4.0.7" + resolved "https://registry.yarnpkg.com/@csstools/postcss-color-function/-/postcss-color-function-4.0.7.tgz#d31d2044d8a4f8b3154ac54ac77014879eae9f56" + integrity sha512-aDHYmhNIHR6iLw4ElWhf+tRqqaXwKnMl0YsQ/X105Zc4dQwe6yJpMrTN6BwOoESrkDjOYMOfORviSSLeDTJkdQ== + dependencies: + "@csstools/css-color-parser" "^3.0.7" + "@csstools/css-parser-algorithms" "^3.0.4" + "@csstools/css-tokenizer" "^3.0.3" + "@csstools/postcss-progressive-custom-properties" "^4.0.0" + "@csstools/utilities" "^2.0.0" + +"@csstools/postcss-color-mix-function@^3.0.7": + version "3.0.7" + resolved "https://registry.yarnpkg.com/@csstools/postcss-color-mix-function/-/postcss-color-mix-function-3.0.7.tgz#39735bbc84dc173061e4c2842ec656bb9bc6ed2e" + integrity sha512-e68Nev4CxZYCLcrfWhHH4u/N1YocOfTmw67/kVX5Rb7rnguqqLyxPjhHWjSBX8o4bmyuukmNf3wrUSU3//kT7g== + dependencies: + "@csstools/css-color-parser" "^3.0.7" + "@csstools/css-parser-algorithms" "^3.0.4" + "@csstools/css-tokenizer" "^3.0.3" + "@csstools/postcss-progressive-custom-properties" "^4.0.0" + "@csstools/utilities" "^2.0.0" + +"@csstools/postcss-content-alt-text@^2.0.4": + version "2.0.4" + resolved "https://registry.yarnpkg.com/@csstools/postcss-content-alt-text/-/postcss-content-alt-text-2.0.4.tgz#76f4687fb15ed45bc1139bb71e5775779762897a" + integrity sha512-YItlZUOuZJCBlRaCf8Aucc1lgN41qYGALMly0qQllrxYJhiyzlI6RxOTMUvtWk+KhS8GphMDsDhKQ7KTPfEMSw== + dependencies: + "@csstools/css-parser-algorithms" "^3.0.4" + "@csstools/css-tokenizer" "^3.0.3" + "@csstools/postcss-progressive-custom-properties" "^4.0.0" + "@csstools/utilities" "^2.0.0" + +"@csstools/postcss-exponential-functions@^2.0.6": + version "2.0.6" + resolved "https://registry.yarnpkg.com/@csstools/postcss-exponential-functions/-/postcss-exponential-functions-2.0.6.tgz#dcee86d22102576b13d8bea059125fbcf98e83cc" + integrity sha512-IgJA5DQsQLu/upA3HcdvC6xEMR051ufebBTIXZ5E9/9iiaA7juXWz1ceYj814lnDYP/7eWjZnw0grRJlX4eI6g== + dependencies: + "@csstools/css-calc" "^2.1.1" + "@csstools/css-parser-algorithms" "^3.0.4" + "@csstools/css-tokenizer" "^3.0.3" + +"@csstools/postcss-font-format-keywords@^4.0.0": + version "4.0.0" + resolved "https://registry.yarnpkg.com/@csstools/postcss-font-format-keywords/-/postcss-font-format-keywords-4.0.0.tgz#6730836eb0153ff4f3840416cc2322f129c086e6" + integrity sha512-usBzw9aCRDvchpok6C+4TXC57btc4bJtmKQWOHQxOVKen1ZfVqBUuCZ/wuqdX5GHsD0NRSr9XTP+5ID1ZZQBXw== + dependencies: + "@csstools/utilities" "^2.0.0" + postcss-value-parser "^4.2.0" + +"@csstools/postcss-gamut-mapping@^2.0.7": + version "2.0.7" + resolved "https://registry.yarnpkg.com/@csstools/postcss-gamut-mapping/-/postcss-gamut-mapping-2.0.7.tgz#8aaa4b6ffb6e2187379a83d253607f988533be25" + integrity sha512-gzFEZPoOkY0HqGdyeBXR3JP218Owr683u7KOZazTK7tQZBE8s2yhg06W1tshOqk7R7SWvw9gkw2TQogKpIW8Xw== + dependencies: + "@csstools/css-color-parser" "^3.0.7" + "@csstools/css-parser-algorithms" "^3.0.4" + "@csstools/css-tokenizer" "^3.0.3" + +"@csstools/postcss-gradients-interpolation-method@^5.0.7": + version "5.0.7" + resolved "https://registry.yarnpkg.com/@csstools/postcss-gradients-interpolation-method/-/postcss-gradients-interpolation-method-5.0.7.tgz#57e19d25e98aa028b98e22ef392ea24c3e61c568" + integrity sha512-WgEyBeg6glUeTdS2XT7qeTFBthTJuXlS9GFro/DVomj7W7WMTamAwpoP4oQCq/0Ki2gvfRYFi/uZtmRE14/DFA== + dependencies: + "@csstools/css-color-parser" "^3.0.7" + "@csstools/css-parser-algorithms" "^3.0.4" + "@csstools/css-tokenizer" "^3.0.3" + "@csstools/postcss-progressive-custom-properties" "^4.0.0" + "@csstools/utilities" "^2.0.0" + +"@csstools/postcss-hwb-function@^4.0.7": + version "4.0.7" + resolved "https://registry.yarnpkg.com/@csstools/postcss-hwb-function/-/postcss-hwb-function-4.0.7.tgz#d09528098c4b99c49c76de686a4ae35585acc691" + integrity sha512-LKYqjO+wGwDCfNIEllessCBWfR4MS/sS1WXO+j00KKyOjm7jDW2L6jzUmqASEiv/kkJO39GcoIOvTTfB3yeBUA== + dependencies: + "@csstools/css-color-parser" "^3.0.7" + "@csstools/css-parser-algorithms" "^3.0.4" + "@csstools/css-tokenizer" "^3.0.3" + "@csstools/postcss-progressive-custom-properties" "^4.0.0" + "@csstools/utilities" "^2.0.0" + +"@csstools/postcss-ic-unit@^4.0.0": + version "4.0.0" + resolved "https://registry.yarnpkg.com/@csstools/postcss-ic-unit/-/postcss-ic-unit-4.0.0.tgz#b60ec06500717c337447c39ae7fe7952eeb9d48f" + integrity sha512-9QT5TDGgx7wD3EEMN3BSUG6ckb6Eh5gSPT5kZoVtUuAonfPmLDJyPhqR4ntPpMYhUKAMVKAg3I/AgzqHMSeLhA== + dependencies: + "@csstools/postcss-progressive-custom-properties" "^4.0.0" + "@csstools/utilities" "^2.0.0" + postcss-value-parser "^4.2.0" + +"@csstools/postcss-initial@^2.0.0": + version "2.0.0" + resolved "https://registry.yarnpkg.com/@csstools/postcss-initial/-/postcss-initial-2.0.0.tgz#a86f5fc59ab9f16f1422dade4c58bd941af5df22" + integrity sha512-dv2lNUKR+JV+OOhZm9paWzYBXOCi+rJPqJ2cJuhh9xd8USVrd0cBEPczla81HNOyThMQWeCcdln3gZkQV2kYxA== + +"@csstools/postcss-is-pseudo-class@^5.0.1": + version "5.0.1" + resolved "https://registry.yarnpkg.com/@csstools/postcss-is-pseudo-class/-/postcss-is-pseudo-class-5.0.1.tgz#12041448fedf01090dd4626022c28b7f7623f58e" + integrity sha512-JLp3POui4S1auhDR0n8wHd/zTOWmMsmK3nQd3hhL6FhWPaox5W7j1se6zXOG/aP07wV2ww0lxbKYGwbBszOtfQ== + dependencies: + "@csstools/selector-specificity" "^5.0.0" + postcss-selector-parser "^7.0.0" + +"@csstools/postcss-light-dark-function@^2.0.7": + version "2.0.7" + resolved "https://registry.yarnpkg.com/@csstools/postcss-light-dark-function/-/postcss-light-dark-function-2.0.7.tgz#807c170cd28eebb0c00e64dfc6ab0bf418f19209" + integrity sha512-ZZ0rwlanYKOHekyIPaU+sVm3BEHCe+Ha0/px+bmHe62n0Uc1lL34vbwrLYn6ote8PHlsqzKeTQdIejQCJ05tfw== + dependencies: + "@csstools/css-parser-algorithms" "^3.0.4" + "@csstools/css-tokenizer" "^3.0.3" + "@csstools/postcss-progressive-custom-properties" "^4.0.0" + "@csstools/utilities" "^2.0.0" + +"@csstools/postcss-logical-float-and-clear@^3.0.0": + version "3.0.0" + resolved "https://registry.yarnpkg.com/@csstools/postcss-logical-float-and-clear/-/postcss-logical-float-and-clear-3.0.0.tgz#62617564182cf86ab5d4e7485433ad91e4c58571" + integrity sha512-SEmaHMszwakI2rqKRJgE+8rpotFfne1ZS6bZqBoQIicFyV+xT1UF42eORPxJkVJVrH9C0ctUgwMSn3BLOIZldQ== + +"@csstools/postcss-logical-overflow@^2.0.0": + version "2.0.0" + resolved "https://registry.yarnpkg.com/@csstools/postcss-logical-overflow/-/postcss-logical-overflow-2.0.0.tgz#c6de7c5f04e3d4233731a847f6c62819bcbcfa1d" + integrity sha512-spzR1MInxPuXKEX2csMamshR4LRaSZ3UXVaRGjeQxl70ySxOhMpP2252RAFsg8QyyBXBzuVOOdx1+bVO5bPIzA== + +"@csstools/postcss-logical-overscroll-behavior@^2.0.0": + version "2.0.0" + resolved "https://registry.yarnpkg.com/@csstools/postcss-logical-overscroll-behavior/-/postcss-logical-overscroll-behavior-2.0.0.tgz#43c03eaecdf34055ef53bfab691db6dc97a53d37" + integrity sha512-e/webMjoGOSYfqLunyzByZj5KKe5oyVg/YSbie99VEaSDE2kimFm0q1f6t/6Jo+VVCQ/jbe2Xy+uX+C4xzWs4w== + +"@csstools/postcss-logical-resize@^3.0.0": + version "3.0.0" + resolved "https://registry.yarnpkg.com/@csstools/postcss-logical-resize/-/postcss-logical-resize-3.0.0.tgz#4df0eeb1a61d7bd85395e56a5cce350b5dbfdca6" + integrity sha512-DFbHQOFW/+I+MY4Ycd/QN6Dg4Hcbb50elIJCfnwkRTCX05G11SwViI5BbBlg9iHRl4ytB7pmY5ieAFk3ws7yyg== + dependencies: + postcss-value-parser "^4.2.0" + +"@csstools/postcss-logical-viewport-units@^3.0.3": + version "3.0.3" + resolved "https://registry.yarnpkg.com/@csstools/postcss-logical-viewport-units/-/postcss-logical-viewport-units-3.0.3.tgz#f6cc63520ca2a6eb76b9cd946070c38dda66d733" + integrity sha512-OC1IlG/yoGJdi0Y+7duz/kU/beCwO+Gua01sD6GtOtLi7ByQUpcIqs7UE/xuRPay4cHgOMatWdnDdsIDjnWpPw== + dependencies: + "@csstools/css-tokenizer" "^3.0.3" + "@csstools/utilities" "^2.0.0" + +"@csstools/postcss-media-minmax@^2.0.6": + version "2.0.6" + resolved "https://registry.yarnpkg.com/@csstools/postcss-media-minmax/-/postcss-media-minmax-2.0.6.tgz#427921c0f08033203810af16dfed0baedc538eab" + integrity sha512-J1+4Fr2W3pLZsfxkFazK+9kr96LhEYqoeBszLmFjb6AjYs+g9oDAw3J5oQignLKk3rC9XHW+ebPTZ9FaW5u5pg== + dependencies: + "@csstools/css-calc" "^2.1.1" + "@csstools/css-parser-algorithms" "^3.0.4" + "@csstools/css-tokenizer" "^3.0.3" + "@csstools/media-query-list-parser" "^4.0.2" + +"@csstools/postcss-media-queries-aspect-ratio-number-values@^3.0.4": + version "3.0.4" + resolved "https://registry.yarnpkg.com/@csstools/postcss-media-queries-aspect-ratio-number-values/-/postcss-media-queries-aspect-ratio-number-values-3.0.4.tgz#d71102172c74baf3f892fac88cf1ea46a961600d" + integrity sha512-AnGjVslHMm5xw9keusQYvjVWvuS7KWK+OJagaG0+m9QnIjZsrysD2kJP/tr/UJIyYtMCtu8OkUd+Rajb4DqtIQ== + dependencies: + "@csstools/css-parser-algorithms" "^3.0.4" + "@csstools/css-tokenizer" "^3.0.3" + "@csstools/media-query-list-parser" "^4.0.2" + +"@csstools/postcss-nested-calc@^4.0.0": + version "4.0.0" + resolved "https://registry.yarnpkg.com/@csstools/postcss-nested-calc/-/postcss-nested-calc-4.0.0.tgz#754e10edc6958d664c11cde917f44ba144141c62" + integrity sha512-jMYDdqrQQxE7k9+KjstC3NbsmC063n1FTPLCgCRS2/qHUbHM0mNy9pIn4QIiQGs9I/Bg98vMqw7mJXBxa0N88A== + dependencies: + "@csstools/utilities" "^2.0.0" + postcss-value-parser "^4.2.0" + +"@csstools/postcss-normalize-display-values@^4.0.0": + version "4.0.0" + resolved "https://registry.yarnpkg.com/@csstools/postcss-normalize-display-values/-/postcss-normalize-display-values-4.0.0.tgz#ecdde2daf4e192e5da0c6fd933b6d8aff32f2a36" + integrity sha512-HlEoG0IDRoHXzXnkV4in47dzsxdsjdz6+j7MLjaACABX2NfvjFS6XVAnpaDyGesz9gK2SC7MbNwdCHusObKJ9Q== + dependencies: + postcss-value-parser "^4.2.0" + +"@csstools/postcss-oklab-function@^4.0.7": + version "4.0.7" + resolved "https://registry.yarnpkg.com/@csstools/postcss-oklab-function/-/postcss-oklab-function-4.0.7.tgz#33b3322dfb27b0b5eb83a7ad36e67f08bc4e66cd" + integrity sha512-I6WFQIbEKG2IO3vhaMGZDkucbCaUSXMxvHNzDdnfsTCF5tc0UlV3Oe2AhamatQoKFjBi75dSEMrgWq3+RegsOQ== + dependencies: + "@csstools/css-color-parser" "^3.0.7" + "@csstools/css-parser-algorithms" "^3.0.4" + "@csstools/css-tokenizer" "^3.0.3" + "@csstools/postcss-progressive-custom-properties" "^4.0.0" + "@csstools/utilities" "^2.0.0" + +"@csstools/postcss-progressive-custom-properties@^4.0.0": + version "4.0.0" + resolved "https://registry.yarnpkg.com/@csstools/postcss-progressive-custom-properties/-/postcss-progressive-custom-properties-4.0.0.tgz#ecdb85bcdb1852d73970a214a376684a91f82bdc" + integrity sha512-XQPtROaQjomnvLUSy/bALTR5VCtTVUFwYs1SblvYgLSeTo2a/bMNwUwo2piXw5rTv/FEYiy5yPSXBqg9OKUx7Q== + dependencies: + postcss-value-parser "^4.2.0" + +"@csstools/postcss-random-function@^1.0.2": + version "1.0.2" + resolved "https://registry.yarnpkg.com/@csstools/postcss-random-function/-/postcss-random-function-1.0.2.tgz#699702820f19bb6b9632966ff44d8957db6889d2" + integrity sha512-vBCT6JvgdEkvRc91NFoNrLjgGtkLWt47GKT6E2UDn3nd8ZkMBiziQ1Md1OiKoSsgzxsSnGKG3RVdhlbdZEkHjA== + dependencies: + "@csstools/css-calc" "^2.1.1" + "@csstools/css-parser-algorithms" "^3.0.4" + "@csstools/css-tokenizer" "^3.0.3" + +"@csstools/postcss-relative-color-syntax@^3.0.7": + version "3.0.7" + resolved "https://registry.yarnpkg.com/@csstools/postcss-relative-color-syntax/-/postcss-relative-color-syntax-3.0.7.tgz#862f8c6a2bbbab1a46aff8265b6a095fd267a3a6" + integrity sha512-apbT31vsJVd18MabfPOnE977xgct5B1I+Jpf+Munw3n6kKb1MMuUmGGH+PT9Hm/fFs6fe61Q/EWnkrb4bNoNQw== + dependencies: + "@csstools/css-color-parser" "^3.0.7" + "@csstools/css-parser-algorithms" "^3.0.4" + "@csstools/css-tokenizer" "^3.0.3" + "@csstools/postcss-progressive-custom-properties" "^4.0.0" + "@csstools/utilities" "^2.0.0" + +"@csstools/postcss-scope-pseudo-class@^4.0.1": + version "4.0.1" + resolved "https://registry.yarnpkg.com/@csstools/postcss-scope-pseudo-class/-/postcss-scope-pseudo-class-4.0.1.tgz#9fe60e9d6d91d58fb5fc6c768a40f6e47e89a235" + integrity sha512-IMi9FwtH6LMNuLea1bjVMQAsUhFxJnyLSgOp/cpv5hrzWmrUYU5fm0EguNDIIOHUqzXode8F/1qkC/tEo/qN8Q== + dependencies: + postcss-selector-parser "^7.0.0" -"@braintree/sanitize-url@^7.0.1": - version "7.1.0" - resolved "https://registry.yarnpkg.com/@braintree/sanitize-url/-/sanitize-url-7.1.0.tgz#048e48aab4f1460e3121e22aa62459d16653dc85" - integrity sha512-o+UlMLt49RvtCASlOMW0AkHnabN9wR9rwCCherxO0yG4Npy34GkvrAqdXQvrhNs+jh+gkK8gB8Lf05qL/O7KWg== +"@csstools/postcss-sign-functions@^1.1.1": + version "1.1.1" + resolved "https://registry.yarnpkg.com/@csstools/postcss-sign-functions/-/postcss-sign-functions-1.1.1.tgz#eb8e4a5ac637982aeb9264cb99f85817612ad3e8" + integrity sha512-MslYkZCeMQDxetNkfmmQYgKCy4c+w9pPDfgOBCJOo/RI1RveEUdZQYtOfrC6cIZB7sD7/PHr2VGOcMXlZawrnA== + dependencies: + "@csstools/css-calc" "^2.1.1" + "@csstools/css-parser-algorithms" "^3.0.4" + "@csstools/css-tokenizer" "^3.0.3" -"@cfaester/enzyme-adapter-react-18@^0.8.0": - version "0.8.0" - resolved "https://registry.yarnpkg.com/@cfaester/enzyme-adapter-react-18/-/enzyme-adapter-react-18-0.8.0.tgz#313814eb79658a6e74209f9f1743bcefff14a46f" - integrity sha512-3Z3ThTUouHwz8oIyhTYQljEMNRFtlVyc3VOOHCbxs47U6cnXs8K9ygi/c1tv49s7MBlTXeIcuN+Ttd9aPtILFQ== +"@csstools/postcss-stepped-value-functions@^4.0.6": + version "4.0.6" + resolved "https://registry.yarnpkg.com/@csstools/postcss-stepped-value-functions/-/postcss-stepped-value-functions-4.0.6.tgz#ee88c6122daf58a1b8641f462e8e33427c60b1f1" + integrity sha512-/dwlO9w8vfKgiADxpxUbZOWlL5zKoRIsCymYoh1IPuBsXODKanKnfuZRr32DEqT0//3Av1VjfNZU9yhxtEfIeA== dependencies: - enzyme-shallow-equal "^1.0.0" - function.prototype.name "^1.1.6" - has "^1.0.4" - react-is "^18.2.0" - react-shallow-renderer "^16.15.0" + "@csstools/css-calc" "^2.1.1" + "@csstools/css-parser-algorithms" "^3.0.4" + "@csstools/css-tokenizer" "^3.0.3" -"@chevrotain/cst-dts-gen@11.0.3": - version "11.0.3" - resolved "https://registry.yarnpkg.com/@chevrotain/cst-dts-gen/-/cst-dts-gen-11.0.3.tgz#5e0863cc57dc45e204ccfee6303225d15d9d4783" - integrity sha512-BvIKpRLeS/8UbfxXxgC33xOumsacaeCKAjAeLyOn7Pcp95HiRbrpl14S+9vaZLolnbssPIUuiUd8IvgkRyt6NQ== +"@csstools/postcss-text-decoration-shorthand@^4.0.1": + version "4.0.1" + resolved "https://registry.yarnpkg.com/@csstools/postcss-text-decoration-shorthand/-/postcss-text-decoration-shorthand-4.0.1.tgz#251fab0939d50c6fd73bb2b830b2574188efa087" + integrity sha512-xPZIikbx6jyzWvhms27uugIc0I4ykH4keRvoa3rxX5K7lEhkbd54rjj/dv60qOCTisoS+3bmwJTeyV1VNBrXaw== dependencies: - "@chevrotain/gast" "11.0.3" - "@chevrotain/types" "11.0.3" - lodash-es "4.17.21" + "@csstools/color-helpers" "^5.0.1" + postcss-value-parser "^4.2.0" -"@chevrotain/gast@11.0.3": - version "11.0.3" - resolved "https://registry.yarnpkg.com/@chevrotain/gast/-/gast-11.0.3.tgz#e84d8880323fe8cbe792ef69ce3ffd43a936e818" - integrity sha512-+qNfcoNk70PyS/uxmj3li5NiECO+2YKZZQMbmjTqRI3Qchu8Hig/Q9vgkHpI3alNjr7M+a2St5pw5w5F6NL5/Q== +"@csstools/postcss-trigonometric-functions@^4.0.6": + version "4.0.6" + resolved "https://registry.yarnpkg.com/@csstools/postcss-trigonometric-functions/-/postcss-trigonometric-functions-4.0.6.tgz#fc5c5f4c9bd0fd796b58b9a14d5d663be76d19fa" + integrity sha512-c4Y1D2Why/PeccaSouXnTt6WcNHJkoJRidV2VW9s5gJ97cNxnLgQ4Qj8qOqkIR9VmTQKJyNcbF4hy79ZQnWD7A== dependencies: - "@chevrotain/types" "11.0.3" - lodash-es "4.17.21" + "@csstools/css-calc" "^2.1.1" + "@csstools/css-parser-algorithms" "^3.0.4" + "@csstools/css-tokenizer" "^3.0.3" -"@chevrotain/regexp-to-ast@11.0.3": - version "11.0.3" - resolved "https://registry.yarnpkg.com/@chevrotain/regexp-to-ast/-/regexp-to-ast-11.0.3.tgz#11429a81c74a8e6a829271ce02fc66166d56dcdb" - integrity sha512-1fMHaBZxLFvWI067AVbGJav1eRY7N8DDvYCTwGBiE/ytKBgP8azTdgyrKyWZ9Mfh09eHWb5PgTSO8wi7U824RA== +"@csstools/postcss-unset-value@^4.0.0": + version "4.0.0" + resolved "https://registry.yarnpkg.com/@csstools/postcss-unset-value/-/postcss-unset-value-4.0.0.tgz#7caa981a34196d06a737754864baf77d64de4bba" + integrity sha512-cBz3tOCI5Fw6NIFEwU3RiwK6mn3nKegjpJuzCndoGq3BZPkUjnsq7uQmIeMNeMbMk7YD2MfKcgCpZwX5jyXqCA== -"@chevrotain/types@11.0.3": - version "11.0.3" - resolved "https://registry.yarnpkg.com/@chevrotain/types/-/types-11.0.3.tgz#f8a03914f7b937f594f56eb89312b3b8f1c91848" - integrity sha512-gsiM3G8b58kZC2HaWR50gu6Y1440cHiJ+i3JUvcp/35JchYejb2+5MVeJK0iKThYpAa/P2PYFV4hoi44HD+aHQ== +"@csstools/selector-resolve-nested@^3.0.0": + version "3.0.0" + resolved "https://registry.yarnpkg.com/@csstools/selector-resolve-nested/-/selector-resolve-nested-3.0.0.tgz#704a9b637975680e025e069a4c58b3beb3e2752a" + integrity sha512-ZoK24Yku6VJU1gS79a5PFmC8yn3wIapiKmPgun0hZgEI5AOqgH2kiPRsPz1qkGv4HL+wuDLH83yQyk6inMYrJQ== -"@chevrotain/utils@11.0.3": - version "11.0.3" - resolved "https://registry.yarnpkg.com/@chevrotain/utils/-/utils-11.0.3.tgz#e39999307b102cff3645ec4f5b3665f5297a2224" - integrity sha512-YslZMgtJUyuMbZ+aKvfF3x1f5liK4mWNxghFRv7jqRR9C3R3fAOGTTKvxXDa2Y1s9zSbcpuO0cAxDYsc9SrXoQ== +"@csstools/selector-specificity@^5.0.0": + version "5.0.0" + resolved "https://registry.yarnpkg.com/@csstools/selector-specificity/-/selector-specificity-5.0.0.tgz#037817b574262134cabd68fc4ec1a454f168407b" + integrity sha512-PCqQV3c4CoVm3kdPhyeZ07VmBRdH2EpMFA/pd9OASpOEC3aXNGoqPDAZ80D0cLpMBxnmk0+yNhGsEx31hq7Gtw== -"@colors/colors@1.5.0": - version "1.5.0" - resolved "https://registry.yarnpkg.com/@colors/colors/-/colors-1.5.0.tgz#bb504579c1cae923e6576a4f5da43d25f97bdbd9" - integrity sha512-ooWCrlZP11i8GImSjTHYHLkvFDP48nS4+204nGb1RiX/WXYHmJA2III9/e2DWVabCESdW7hBAEzHRqUn9OUVvQ== +"@csstools/utilities@^2.0.0": + version "2.0.0" + resolved "https://registry.yarnpkg.com/@csstools/utilities/-/utilities-2.0.0.tgz#f7ff0fee38c9ffb5646d47b6906e0bc8868bde60" + integrity sha512-5VdOr0Z71u+Yp3ozOx8T11N703wIFGVRgOWbOZMKgglPJsWA54MRIoMNVMa7shUToIhx5J8vX4sOZgD2XiihiQ== "@discoveryjs/json-ext@0.5.7": version "0.5.7" resolved "https://registry.yarnpkg.com/@discoveryjs/json-ext/-/json-ext-0.5.7.tgz#1d572bfbbe14b7704e0ba0f39b74815b84870d70" integrity sha512-dBVuXR082gk3jsFp7Rd/JI4kytwGHecnCoTtXFb7DB6CNHp4rg5k1bhg0nWdLGLnOV71lmDzGQaLMy8iPLY0pw== -"@docsearch/css@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docsearch/css/-/css-3.6.0.tgz#0e9f56f704b3a34d044d15fd9962ebc1536ba4fb" - integrity sha512-+sbxb71sWre+PwDK7X2T8+bhS6clcVMLwBPznX45Qu6opJcgRjAp7gYSDzVFp187J+feSj5dNBN1mJoi6ckkUQ== +"@docsearch/css@3.8.2": + version "3.8.2" + resolved "https://registry.yarnpkg.com/@docsearch/css/-/css-3.8.2.tgz#7973ceb6892c30f154ba254cd05c562257a44977" + integrity sha512-y05ayQFyUmCXze79+56v/4HpycYF3uFqB78pLPrSV5ZKAlDuIAAJNhaRi8tTdRNXh05yxX/TyNnzD6LwSM89vQ== -"@docsearch/react@^3.5.2": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docsearch/react/-/react-3.6.0.tgz#b4f25228ecb7fc473741aefac592121e86dd2958" - integrity sha512-HUFut4ztcVNmqy9gp/wxNbC7pTOHhgVVkHVGCACTuLhUKUhKAF9KYHJtMiLUJxEqiFLQiuri1fWF8zqwM/cu1w== +"@docsearch/react@^3.8.1": + version "3.8.2" + resolved "https://registry.yarnpkg.com/@docsearch/react/-/react-3.8.2.tgz#7b11d39b61c976c0aa9fbde66e6b73b30f3acd42" + integrity sha512-xCRrJQlTt8N9GU0DG4ptwHRkfnSnD/YpdeaXe02iKfqs97TkZJv60yE+1eq/tjPcVnTW8dP5qLP7itifFVV5eg== dependencies: - "@algolia/autocomplete-core" "1.9.3" - "@algolia/autocomplete-preset-algolia" "1.9.3" - "@docsearch/css" "3.6.0" - algoliasearch "^4.19.1" + "@algolia/autocomplete-core" "1.17.7" + "@algolia/autocomplete-preset-algolia" "1.17.7" + "@docsearch/css" "3.8.2" + algoliasearch "^5.14.2" -"@docusaurus/babel@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/babel/-/babel-3.6.0.tgz#735a003207925bd782dd08ffa5d8b3503c1f8d72" - integrity sha512-7CsoQFiadoq7AHSUIQNkI/lGfg9AQ2ZBzsf9BqfZGXkHwWDy6twuohEaG0PgQv1npSRSAB2dioVxhRSErnqKNA== +"@docusaurus/babel@3.7.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/babel/-/babel-3.7.0.tgz#770dd5da525a9d6a2fee7d3212ec62040327f776" + integrity sha512-0H5uoJLm14S/oKV3Keihxvh8RV+vrid+6Gv+2qhuzbqHanawga8tYnsdpjEyt36ucJjqlby2/Md2ObWjA02UXQ== dependencies: "@babel/core" "^7.25.9" "@babel/generator" "^7.25.9" @@ -2163,24 +1477,23 @@ "@babel/runtime" "^7.25.9" "@babel/runtime-corejs3" "^7.25.9" "@babel/traverse" "^7.25.9" - "@docusaurus/logger" "3.6.0" - "@docusaurus/utils" "3.6.0" + "@docusaurus/logger" "3.7.0" + "@docusaurus/utils" "3.7.0" babel-plugin-dynamic-import-node "^2.3.3" fs-extra "^11.1.1" tslib "^2.6.0" -"@docusaurus/bundler@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/bundler/-/bundler-3.6.0.tgz#bdd060ba4d009211348e4e973a3bf4861cf0996b" - integrity sha512-o5T9HXkPKH0OQAifTxEXaebcO8kaz3tU1+wlIShZ2DKJHlsyWX3N4rToWBHroWnV/ZCT2XN3kLRzXASqrnb9Tw== +"@docusaurus/bundler@3.7.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/bundler/-/bundler-3.7.0.tgz#d8e7867b3b2c43a1e320ed429f8dfe873c38506d" + integrity sha512-CUUT9VlSGukrCU5ctZucykvgCISivct+cby28wJwCC/fkQFgAHRp/GKv2tx38ZmXb7nacrKzFTcp++f9txUYGg== dependencies: "@babel/core" "^7.25.9" - "@docusaurus/babel" "3.6.0" - "@docusaurus/cssnano-preset" "3.6.0" - "@docusaurus/logger" "3.6.0" - "@docusaurus/types" "3.6.0" - "@docusaurus/utils" "3.6.0" - autoprefixer "^10.4.14" + "@docusaurus/babel" "3.7.0" + "@docusaurus/cssnano-preset" "3.7.0" + "@docusaurus/logger" "3.7.0" + "@docusaurus/types" "3.7.0" + "@docusaurus/utils" "3.7.0" babel-loader "^9.2.1" clean-css "^5.3.2" copy-webpack-plugin "^11.0.0" @@ -2193,6 +1506,7 @@ null-loader "^4.0.1" postcss "^8.4.26" postcss-loader "^7.3.3" + postcss-preset-env "^10.1.0" react-dev-utils "^12.0.1" terser-webpack-plugin "^5.3.9" tslib "^2.6.0" @@ -2200,18 +1514,18 @@ webpack "^5.95.0" webpackbar "^6.0.1" -"@docusaurus/core@3.6.0", "@docusaurus/core@^3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/core/-/core-3.6.0.tgz#b23fc7e253a49cc3e5ac9e091354f497cc0b101b" - integrity sha512-lvRgMoKJJSRDt9+HhAqFcICV4kp/mw1cJJrLxIw4Q2XZnFGM1XUuwcbuaqWmGog+NcOLZaPCcCtZbn60EMCtjQ== - dependencies: - "@docusaurus/babel" "3.6.0" - "@docusaurus/bundler" "3.6.0" - "@docusaurus/logger" "3.6.0" - "@docusaurus/mdx-loader" "3.6.0" - "@docusaurus/utils" "3.6.0" - "@docusaurus/utils-common" "3.6.0" - "@docusaurus/utils-validation" "3.6.0" +"@docusaurus/core@3.7.0", "@docusaurus/core@^3.6.3": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/core/-/core-3.7.0.tgz#e871586d099093723dfe6de81c1ce610aeb20292" + integrity sha512-b0fUmaL+JbzDIQaamzpAFpTviiaU4cX3Qz8cuo14+HGBCwa0evEK0UYCBFY3n4cLzL8Op1BueeroUD2LYAIHbQ== + dependencies: + "@docusaurus/babel" "3.7.0" + "@docusaurus/bundler" "3.7.0" + "@docusaurus/logger" "3.7.0" + "@docusaurus/mdx-loader" "3.7.0" + "@docusaurus/utils" "3.7.0" + "@docusaurus/utils-common" "3.7.0" + "@docusaurus/utils-validation" "3.7.0" boxen "^6.2.1" chalk "^4.1.2" chokidar "^3.5.3" @@ -2232,13 +1546,12 @@ p-map "^4.0.0" prompts "^2.4.2" react-dev-utils "^12.0.1" - react-helmet-async "^1.3.0" + react-helmet-async "npm:@slorber/react-helmet-async@1.3.0" react-loadable "npm:@docusaurus/react-loadable@6.0.0" react-loadable-ssr-addon-v5-slorber "^1.0.1" react-router "^5.3.4" react-router-config "^5.1.1" react-router-dom "^5.3.4" - rtl-detect "^1.0.4" semver "^7.5.4" serve-handler "^6.1.6" shelljs "^0.8.5" @@ -2249,32 +1562,32 @@ webpack-dev-server "^4.15.2" webpack-merge "^6.0.1" -"@docusaurus/cssnano-preset@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/cssnano-preset/-/cssnano-preset-3.6.0.tgz#02378e53e9568ed5fc8871d4fc158ea96fd7421c" - integrity sha512-h3jlOXqqzNSoU+C4CZLNpFtD+v2xr1UBf4idZpwMgqid9r6lb5GS7tWKnQnauio6OipacbHbDXEX3JyT1PlDkg== +"@docusaurus/cssnano-preset@3.7.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/cssnano-preset/-/cssnano-preset-3.7.0.tgz#8fe8f2c3acbd32384b69e14983b9a63c98cae34e" + integrity sha512-X9GYgruZBSOozg4w4dzv9uOz8oK/EpPVQXkp0MM6Tsgp/nRIU9hJzJ0Pxg1aRa3xCeEQTOimZHcocQFlLwYajQ== dependencies: cssnano-preset-advanced "^6.1.2" postcss "^8.4.38" postcss-sort-media-queries "^5.2.0" tslib "^2.6.0" -"@docusaurus/logger@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/logger/-/logger-3.6.0.tgz#c7349c2636087f55f573a60a3c7f69b87d59974d" - integrity sha512-BcQhoXilXW0607cH/kO6P5Gt5KxCGfoJ+QDKNf3yO2S09/RsITlW+0QljXPbI3DklTrHrhRDmgGk1yX4nUhWTA== +"@docusaurus/logger@3.7.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/logger/-/logger-3.7.0.tgz#07ecc2f460c4d2382df4991f9ce4e348e90af04c" + integrity sha512-z7g62X7bYxCYmeNNuO9jmzxLQG95q9QxINCwpboVcNff3SJiHJbGrarxxOVMVmAh1MsrSfxWkVGv4P41ktnFsA== dependencies: chalk "^4.1.2" tslib "^2.6.0" -"@docusaurus/mdx-loader@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/mdx-loader/-/mdx-loader-3.6.0.tgz#f8ba7af9d59473a7182f6a9307e0432f8dce905b" - integrity sha512-GhRzL1Af/AdSSrGesSPOU/iP/aXadTGmVKuysCxZDrQR2RtBtubQZ9aw+KvdFVV7R4K/CsbgD6J5oqrXlEPk3Q== +"@docusaurus/mdx-loader@3.7.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/mdx-loader/-/mdx-loader-3.7.0.tgz#5890c6e7a5b68cb1d066264ac5290cdcd59d4ecc" + integrity sha512-OFBG6oMjZzc78/U3WNPSHs2W9ZJ723ewAcvVJaqS0VgyeUfmzUV8f1sv+iUHA0DtwiR5T5FjOxj6nzEE8LY6VA== dependencies: - "@docusaurus/logger" "3.6.0" - "@docusaurus/utils" "3.6.0" - "@docusaurus/utils-validation" "3.6.0" + "@docusaurus/logger" "3.7.0" + "@docusaurus/utils" "3.7.0" + "@docusaurus/utils-validation" "3.7.0" "@mdx-js/mdx" "^3.0.0" "@slorber/remark-comment" "^1.0.0" escape-html "^1.0.3" @@ -2297,32 +1610,32 @@ vfile "^6.0.1" webpack "^5.88.1" -"@docusaurus/module-type-aliases@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/module-type-aliases/-/module-type-aliases-3.6.0.tgz#44083c34a53db1dde06364b4e7f2d144fa2d5394" - integrity sha512-szTrIN/6/fuk0xkf3XbRfdTFJzRQ8d1s3sQj5++58wltrT7v3yn1149oc9ryYjMpRcbsarGloQwMu7ofPe4XPg== +"@docusaurus/module-type-aliases@3.7.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/module-type-aliases/-/module-type-aliases-3.7.0.tgz#15c0745b829c6966c5b3b2c2527c72b54830b0e5" + integrity sha512-g7WdPqDNaqA60CmBrr0cORTrsOit77hbsTj7xE2l71YhBn79sxdm7WMK7wfhcaafkbpIh7jv5ef5TOpf1Xv9Lg== dependencies: - "@docusaurus/types" "3.6.0" + "@docusaurus/types" "3.7.0" "@types/history" "^4.7.11" "@types/react" "*" "@types/react-router-config" "*" "@types/react-router-dom" "*" - react-helmet-async "*" + react-helmet-async "npm:@slorber/react-helmet-async@*" react-loadable "npm:@docusaurus/react-loadable@6.0.0" -"@docusaurus/plugin-content-blog@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/plugin-content-blog/-/plugin-content-blog-3.6.0.tgz#9128175b4c3ce885d9090183d74c60813844ea8d" - integrity sha512-o4aT1/E0Ldpzs/hQff5uyoSriAhS/yqBhqSn+fvSw465AaqRsva6O7CZSYleuBq6x2bewyE3QJq2PcTiHhAd8g== - dependencies: - "@docusaurus/core" "3.6.0" - "@docusaurus/logger" "3.6.0" - "@docusaurus/mdx-loader" "3.6.0" - "@docusaurus/theme-common" "3.6.0" - "@docusaurus/types" "3.6.0" - "@docusaurus/utils" "3.6.0" - "@docusaurus/utils-common" "3.6.0" - "@docusaurus/utils-validation" "3.6.0" +"@docusaurus/plugin-content-blog@3.7.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/plugin-content-blog/-/plugin-content-blog-3.7.0.tgz#7bd69de87a1f3adb652e1473ef5b7ccc9468f47e" + integrity sha512-EFLgEz6tGHYWdPU0rK8tSscZwx+AsyuBW/r+tNig2kbccHYGUJmZtYN38GjAa3Fda4NU+6wqUO5kTXQSRBQD3g== + dependencies: + "@docusaurus/core" "3.7.0" + "@docusaurus/logger" "3.7.0" + "@docusaurus/mdx-loader" "3.7.0" + "@docusaurus/theme-common" "3.7.0" + "@docusaurus/types" "3.7.0" + "@docusaurus/utils" "3.7.0" + "@docusaurus/utils-common" "3.7.0" + "@docusaurus/utils-validation" "3.7.0" cheerio "1.0.0-rc.12" feed "^4.2.2" fs-extra "^11.1.1" @@ -2334,20 +1647,20 @@ utility-types "^3.10.0" webpack "^5.88.1" -"@docusaurus/plugin-content-docs@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/plugin-content-docs/-/plugin-content-docs-3.6.0.tgz#15cae4bf81da0b0ddce09d53b10b7209116ea9c2" - integrity sha512-c5gZOxocJKO/Zev2MEZInli+b+VNswDGuKHE6QtFgidhAJonwjh2kwj967RvWFaMMk62HlLJLZ+IGK2XsVy4Aw== - dependencies: - "@docusaurus/core" "3.6.0" - "@docusaurus/logger" "3.6.0" - "@docusaurus/mdx-loader" "3.6.0" - "@docusaurus/module-type-aliases" "3.6.0" - "@docusaurus/theme-common" "3.6.0" - "@docusaurus/types" "3.6.0" - "@docusaurus/utils" "3.6.0" - "@docusaurus/utils-common" "3.6.0" - "@docusaurus/utils-validation" "3.6.0" +"@docusaurus/plugin-content-docs@3.7.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/plugin-content-docs/-/plugin-content-docs-3.7.0.tgz#297a549e926ee2b1147b5242af6f21532c7b107c" + integrity sha512-GXg5V7kC9FZE4FkUZA8oo/NrlRb06UwuICzI6tcbzj0+TVgjq/mpUXXzSgKzMS82YByi4dY2Q808njcBCyy6tQ== + dependencies: + "@docusaurus/core" "3.7.0" + "@docusaurus/logger" "3.7.0" + "@docusaurus/mdx-loader" "3.7.0" + "@docusaurus/module-type-aliases" "3.7.0" + "@docusaurus/theme-common" "3.7.0" + "@docusaurus/types" "3.7.0" + "@docusaurus/utils" "3.7.0" + "@docusaurus/utils-common" "3.7.0" + "@docusaurus/utils-validation" "3.7.0" "@types/react-router-config" "^5.0.7" combine-promises "^1.1.0" fs-extra "^11.1.1" @@ -2357,115 +1670,130 @@ utility-types "^3.10.0" webpack "^5.88.1" -"@docusaurus/plugin-content-pages@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/plugin-content-pages/-/plugin-content-pages-3.6.0.tgz#5dd284bf063baaba1e0305c90b1dd0d5acc7e466" - integrity sha512-RKHhJrfkadHc7+tt1cP48NWifOrhkSRMPdXNYytzhoQrXlP6Ph+3tfQ4/n+nT0S3Y9+wwRxYqRqA380ZLt+QtQ== - dependencies: - "@docusaurus/core" "3.6.0" - "@docusaurus/mdx-loader" "3.6.0" - "@docusaurus/types" "3.6.0" - "@docusaurus/utils" "3.6.0" - "@docusaurus/utils-validation" "3.6.0" +"@docusaurus/plugin-content-pages@3.7.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/plugin-content-pages/-/plugin-content-pages-3.7.0.tgz#c4a8f7237872236aacb77665822c474c0a00e91a" + integrity sha512-YJSU3tjIJf032/Aeao8SZjFOrXJbz/FACMveSMjLyMH4itQyZ2XgUIzt4y+1ISvvk5zrW4DABVT2awTCqBkx0Q== + dependencies: + "@docusaurus/core" "3.7.0" + "@docusaurus/mdx-loader" "3.7.0" + "@docusaurus/types" "3.7.0" + "@docusaurus/utils" "3.7.0" + "@docusaurus/utils-validation" "3.7.0" fs-extra "^11.1.1" tslib "^2.6.0" webpack "^5.88.1" -"@docusaurus/plugin-debug@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/plugin-debug/-/plugin-debug-3.6.0.tgz#0a6da9ba31a0acb176ae2762b4d6b96b1906c826" - integrity sha512-o8T1Rl94COLdSlKvjYLQpRJQRU8WWZ8EX1B0yV0dQLNN8reyH7MQW+6z1ig4sQFfH3pnjPWVGHfuEjcib5m7Eg== +"@docusaurus/plugin-debug@3.7.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/plugin-debug/-/plugin-debug-3.7.0.tgz#a4fd45132e40cffe96bb51f48e89982a1cb8e194" + integrity sha512-Qgg+IjG/z4svtbCNyTocjIwvNTNEwgRjSXXSJkKVG0oWoH0eX/HAPiu+TS1HBwRPQV+tTYPWLrUypYFepfujZA== dependencies: - "@docusaurus/core" "3.6.0" - "@docusaurus/types" "3.6.0" - "@docusaurus/utils" "3.6.0" + "@docusaurus/core" "3.7.0" + "@docusaurus/types" "3.7.0" + "@docusaurus/utils" "3.7.0" fs-extra "^11.1.1" react-json-view-lite "^1.2.0" tslib "^2.6.0" -"@docusaurus/plugin-google-analytics@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/plugin-google-analytics/-/plugin-google-analytics-3.6.0.tgz#9e8245eef1bee95e44ef2af92ce3e844a8e93e64" - integrity sha512-kgRFbfpi6Hshj75YUztKyEMtI/kw0trPRwoTN4g+W1NK99R/vh8phTvhBTIMnDbetU79795LkwfG0rZ/ce6zWQ== +"@docusaurus/plugin-google-analytics@3.7.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/plugin-google-analytics/-/plugin-google-analytics-3.7.0.tgz#d20f665e810fb2295d1c1bbfe13398c5ff42eb24" + integrity sha512-otIqiRV/jka6Snjf+AqB360XCeSv7lQC+DKYW+EUZf6XbuE8utz5PeUQ8VuOcD8Bk5zvT1MC4JKcd5zPfDuMWA== dependencies: - "@docusaurus/core" "3.6.0" - "@docusaurus/types" "3.6.0" - "@docusaurus/utils-validation" "3.6.0" + "@docusaurus/core" "3.7.0" + "@docusaurus/types" "3.7.0" + "@docusaurus/utils-validation" "3.7.0" tslib "^2.6.0" -"@docusaurus/plugin-google-gtag@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/plugin-google-gtag/-/plugin-google-gtag-3.6.0.tgz#bed8381fe3ab357d56a565f657e38d8ea6272703" - integrity sha512-nqu4IfjaO4UX+dojHL2BxHRS+sKj31CIMWYo49huQ3wTET0Oc3u/WGTaKd3ShTPDhkgiRhTOSTPUwJWrU55nHg== +"@docusaurus/plugin-google-gtag@3.7.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/plugin-google-gtag/-/plugin-google-gtag-3.7.0.tgz#a48638dfd132858060458b875a440b6cbda6bf8f" + integrity sha512-M3vrMct1tY65ModbyeDaMoA+fNJTSPe5qmchhAbtqhDD/iALri0g9LrEpIOwNaoLmm6lO88sfBUADQrSRSGSWA== dependencies: - "@docusaurus/core" "3.6.0" - "@docusaurus/types" "3.6.0" - "@docusaurus/utils-validation" "3.6.0" + "@docusaurus/core" "3.7.0" + "@docusaurus/types" "3.7.0" + "@docusaurus/utils-validation" "3.7.0" "@types/gtag.js" "^0.0.12" tslib "^2.6.0" -"@docusaurus/plugin-google-tag-manager@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/plugin-google-tag-manager/-/plugin-google-tag-manager-3.6.0.tgz#326382de05888ea4317837be736eabd635adbc71" - integrity sha512-OU6c5xI0nOVbEc9eImGvvsgNWe4vGm97t/W3aLHjWsHyNk3uwFNBQMHRvBUwAi9k/K3kyC5E7DWnc67REhdLOw== +"@docusaurus/plugin-google-tag-manager@3.7.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/plugin-google-tag-manager/-/plugin-google-tag-manager-3.7.0.tgz#0a4390f4b0e760d073bdb1905436bfa7bd71356b" + integrity sha512-X8U78nb8eiMiPNg3jb9zDIVuuo/rE1LjGDGu+5m5CX4UBZzjMy+klOY2fNya6x8ACyE/L3K2erO1ErheP55W/w== dependencies: - "@docusaurus/core" "3.6.0" - "@docusaurus/types" "3.6.0" - "@docusaurus/utils-validation" "3.6.0" + "@docusaurus/core" "3.7.0" + "@docusaurus/types" "3.7.0" + "@docusaurus/utils-validation" "3.7.0" tslib "^2.6.0" -"@docusaurus/plugin-sitemap@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/plugin-sitemap/-/plugin-sitemap-3.6.0.tgz#c7c93f75f03391ca9071da48563fc4faa84966bc" - integrity sha512-YB5XMdf9FjLhgbHY/cDbYhVxsgcpPIjxY9769HUgFOB7GVzItTLOR71W035R1BiR2CA5QAn3XOSg36WLRxlhQQ== - dependencies: - "@docusaurus/core" "3.6.0" - "@docusaurus/logger" "3.6.0" - "@docusaurus/types" "3.6.0" - "@docusaurus/utils" "3.6.0" - "@docusaurus/utils-common" "3.6.0" - "@docusaurus/utils-validation" "3.6.0" +"@docusaurus/plugin-sitemap@3.7.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/plugin-sitemap/-/plugin-sitemap-3.7.0.tgz#2c1bf9de26aeda455df6f77748e5887ace39b2d7" + integrity sha512-bTRT9YLZ/8I/wYWKMQke18+PF9MV8Qub34Sku6aw/vlZ/U+kuEuRpQ8bTcNOjaTSfYsWkK4tTwDMHK2p5S86cA== + dependencies: + "@docusaurus/core" "3.7.0" + "@docusaurus/logger" "3.7.0" + "@docusaurus/types" "3.7.0" + "@docusaurus/utils" "3.7.0" + "@docusaurus/utils-common" "3.7.0" + "@docusaurus/utils-validation" "3.7.0" fs-extra "^11.1.1" sitemap "^7.1.1" tslib "^2.6.0" -"@docusaurus/preset-classic@^3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/preset-classic/-/preset-classic-3.6.0.tgz#71561f366a266be571022764eb8b9e5618f573eb" - integrity sha512-kpGNdQzr/Dpm7o3b1iaQrz4DMDx3WIeBbl4V4P4maa2zAQkTdlaP4CMgA5oKrRrpqPLnQFsUM/b+qf2glhl2Tw== - dependencies: - "@docusaurus/core" "3.6.0" - "@docusaurus/plugin-content-blog" "3.6.0" - "@docusaurus/plugin-content-docs" "3.6.0" - "@docusaurus/plugin-content-pages" "3.6.0" - "@docusaurus/plugin-debug" "3.6.0" - "@docusaurus/plugin-google-analytics" "3.6.0" - "@docusaurus/plugin-google-gtag" "3.6.0" - "@docusaurus/plugin-google-tag-manager" "3.6.0" - "@docusaurus/plugin-sitemap" "3.6.0" - "@docusaurus/theme-classic" "3.6.0" - "@docusaurus/theme-common" "3.6.0" - "@docusaurus/theme-search-algolia" "3.6.0" - "@docusaurus/types" "3.6.0" - -"@docusaurus/theme-classic@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/theme-classic/-/theme-classic-3.6.0.tgz#8f34b65c85f5082deb3633a893974d2eee309121" - integrity sha512-sAXNfwPL6uRD+BuHuKXZfAXud7SS7IK/JdrPuzyQxdO1gJKzI5GFfe1ED1QoJDNWJWJ01JHE5rSnwYLEADc2rQ== - dependencies: - "@docusaurus/core" "3.6.0" - "@docusaurus/logger" "3.6.0" - "@docusaurus/mdx-loader" "3.6.0" - "@docusaurus/module-type-aliases" "3.6.0" - "@docusaurus/plugin-content-blog" "3.6.0" - "@docusaurus/plugin-content-docs" "3.6.0" - "@docusaurus/plugin-content-pages" "3.6.0" - "@docusaurus/theme-common" "3.6.0" - "@docusaurus/theme-translations" "3.6.0" - "@docusaurus/types" "3.6.0" - "@docusaurus/utils" "3.6.0" - "@docusaurus/utils-common" "3.6.0" - "@docusaurus/utils-validation" "3.6.0" +"@docusaurus/plugin-svgr@3.7.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/plugin-svgr/-/plugin-svgr-3.7.0.tgz#018e89efd615d5fde77b891a8c2aadf203013f5d" + integrity sha512-HByXIZTbc4GV5VAUkZ2DXtXv1Qdlnpk3IpuImwSnEzCDBkUMYcec5282hPjn6skZqB25M1TYCmWS91UbhBGxQg== + dependencies: + "@docusaurus/core" "3.7.0" + "@docusaurus/types" "3.7.0" + "@docusaurus/utils" "3.7.0" + "@docusaurus/utils-validation" "3.7.0" + "@svgr/core" "8.1.0" + "@svgr/webpack" "^8.1.0" + tslib "^2.6.0" + webpack "^5.88.1" + +"@docusaurus/preset-classic@^3.6.3": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/preset-classic/-/preset-classic-3.7.0.tgz#f6656a04ae6a4877523dbd04f7c491632e4003b9" + integrity sha512-nPHj8AxDLAaQXs+O6+BwILFuhiWbjfQWrdw2tifOClQoNfuXDjfjogee6zfx6NGHWqshR23LrcN115DmkHC91Q== + dependencies: + "@docusaurus/core" "3.7.0" + "@docusaurus/plugin-content-blog" "3.7.0" + "@docusaurus/plugin-content-docs" "3.7.0" + "@docusaurus/plugin-content-pages" "3.7.0" + "@docusaurus/plugin-debug" "3.7.0" + "@docusaurus/plugin-google-analytics" "3.7.0" + "@docusaurus/plugin-google-gtag" "3.7.0" + "@docusaurus/plugin-google-tag-manager" "3.7.0" + "@docusaurus/plugin-sitemap" "3.7.0" + "@docusaurus/plugin-svgr" "3.7.0" + "@docusaurus/theme-classic" "3.7.0" + "@docusaurus/theme-common" "3.7.0" + "@docusaurus/theme-search-algolia" "3.7.0" + "@docusaurus/types" "3.7.0" + +"@docusaurus/theme-classic@3.7.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/theme-classic/-/theme-classic-3.7.0.tgz#b483bd8e2923b6994b5f47238884b9f8984222c5" + integrity sha512-MnLxG39WcvLCl4eUzHr0gNcpHQfWoGqzADCly54aqCofQX6UozOS9Th4RK3ARbM9m7zIRv3qbhggI53dQtx/hQ== + dependencies: + "@docusaurus/core" "3.7.0" + "@docusaurus/logger" "3.7.0" + "@docusaurus/mdx-loader" "3.7.0" + "@docusaurus/module-type-aliases" "3.7.0" + "@docusaurus/plugin-content-blog" "3.7.0" + "@docusaurus/plugin-content-docs" "3.7.0" + "@docusaurus/plugin-content-pages" "3.7.0" + "@docusaurus/theme-common" "3.7.0" + "@docusaurus/theme-translations" "3.7.0" + "@docusaurus/types" "3.7.0" + "@docusaurus/utils" "3.7.0" + "@docusaurus/utils-common" "3.7.0" + "@docusaurus/utils-validation" "3.7.0" "@mdx-js/react" "^3.0.0" clsx "^2.0.0" copy-text-to-clipboard "^3.2.0" @@ -2480,15 +1808,15 @@ tslib "^2.6.0" utility-types "^3.10.0" -"@docusaurus/theme-common@3.6.0", "@docusaurus/theme-common@^3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/theme-common/-/theme-common-3.6.0.tgz#9a061d278df76da0f70a9465cd0b7299c14d03d3" - integrity sha512-frjlYE5sRs+GuPs4XXlp9aMLI2O4H5FPpznDAXBrCm+8EpWRiIb443ePMxM3IyMCQ5bwFlki0PI9C+r4apstnw== +"@docusaurus/theme-common@3.7.0", "@docusaurus/theme-common@^3.6.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/theme-common/-/theme-common-3.7.0.tgz#18bf5c6b149a701f4bd865715ee8b595aa40b354" + integrity sha512-8eJ5X0y+gWDsURZnBfH0WabdNm8XMCXHv8ENy/3Z/oQKwaB/EHt5lP9VsTDTf36lKEp0V6DjzjFyFIB+CetL0A== dependencies: - "@docusaurus/mdx-loader" "3.6.0" - "@docusaurus/module-type-aliases" "3.6.0" - "@docusaurus/utils" "3.6.0" - "@docusaurus/utils-common" "3.6.0" + "@docusaurus/mdx-loader" "3.7.0" + "@docusaurus/module-type-aliases" "3.7.0" + "@docusaurus/utils" "3.7.0" + "@docusaurus/utils-common" "3.7.0" "@types/history" "^4.7.11" "@types/react" "*" "@types/react-router-config" "*" @@ -2499,33 +1827,33 @@ utility-types "^3.10.0" "@docusaurus/theme-mermaid@^3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/theme-mermaid/-/theme-mermaid-3.6.0.tgz#0a79b76950aee8e2856a3e39f1c1050eb237c1c9" - integrity sha512-5t7zzBnnJa4BBcGo9bEfTM48DxD/+CVbFkfiRnFXheWjMrMm5a+IP10igEQ4zyDC+QgatbzLAxkj4GRYpYTauA== - dependencies: - "@docusaurus/core" "3.6.0" - "@docusaurus/module-type-aliases" "3.6.0" - "@docusaurus/theme-common" "3.6.0" - "@docusaurus/types" "3.6.0" - "@docusaurus/utils-validation" "3.6.0" + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/theme-mermaid/-/theme-mermaid-3.7.0.tgz#1bc4307e09886186ed6e51607bf43c5089f35de5" + integrity sha512-7kNDvL7hm+tshjxSxIqYMtsLUPsEBYnkevej/ext6ru9xyLgCed+zkvTfGzTWNeq8rJIEe2YSS8/OV5gCVaPCw== + dependencies: + "@docusaurus/core" "3.7.0" + "@docusaurus/module-type-aliases" "3.7.0" + "@docusaurus/theme-common" "3.7.0" + "@docusaurus/types" "3.7.0" + "@docusaurus/utils-validation" "3.7.0" mermaid ">=10.4" tslib "^2.6.0" -"@docusaurus/theme-search-algolia@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/theme-search-algolia/-/theme-search-algolia-3.6.0.tgz#47dcfca68f50163abce411dd9b181855a9ec9c83" - integrity sha512-4IwRUkxjrisR8LXBHeE4d2btraWdMficbgiVL3UHvJURmyvgzMBZQP8KrK8rjdXeu8SuRxSmeV6NSVomRvdbEg== - dependencies: - "@docsearch/react" "^3.5.2" - "@docusaurus/core" "3.6.0" - "@docusaurus/logger" "3.6.0" - "@docusaurus/plugin-content-docs" "3.6.0" - "@docusaurus/theme-common" "3.6.0" - "@docusaurus/theme-translations" "3.6.0" - "@docusaurus/utils" "3.6.0" - "@docusaurus/utils-validation" "3.6.0" - algoliasearch "^4.18.0" - algoliasearch-helper "^3.13.3" +"@docusaurus/theme-search-algolia@3.7.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/theme-search-algolia/-/theme-search-algolia-3.7.0.tgz#2108ddf0b300b82de7c2b9ff9fcf62121b66ea37" + integrity sha512-Al/j5OdzwRU1m3falm+sYy9AaB93S1XF1Lgk9Yc6amp80dNxJVplQdQTR4cYdzkGtuQqbzUA8+kaoYYO0RbK6g== + dependencies: + "@docsearch/react" "^3.8.1" + "@docusaurus/core" "3.7.0" + "@docusaurus/logger" "3.7.0" + "@docusaurus/plugin-content-docs" "3.7.0" + "@docusaurus/theme-common" "3.7.0" + "@docusaurus/theme-translations" "3.7.0" + "@docusaurus/utils" "3.7.0" + "@docusaurus/utils-validation" "3.7.0" + algoliasearch "^5.17.1" + algoliasearch-helper "^3.22.6" clsx "^2.0.0" eta "^2.2.0" fs-extra "^11.1.1" @@ -2533,73 +1861,59 @@ tslib "^2.6.0" utility-types "^3.10.0" -"@docusaurus/theme-translations@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/theme-translations/-/theme-translations-3.6.0.tgz#93994e931f340c1712c81ac80dbab5750c24634f" - integrity sha512-L555X8lWE3fv8VaF0Bc1VnAgi10UvRKFcvADHiYR7Gj37ItaWP5i7xLHsSw7fi/SHTXe5wfIeCFNqUYHyCOHAQ== +"@docusaurus/theme-translations@3.7.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/theme-translations/-/theme-translations-3.7.0.tgz#0891aedc7c7040afcb3a1b34051d3a69096d0d25" + integrity sha512-Ewq3bEraWDmienM6eaNK7fx+/lHMtGDHQyd1O+4+3EsDxxUmrzPkV7Ct3nBWTuE0MsoZr3yNwQVKjllzCMuU3g== dependencies: fs-extra "^11.1.1" tslib "^2.6.0" -"@docusaurus/types@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/types/-/types-3.6.0.tgz#8fa82332a7c7b8093b5c55e1115f5854ce484978" - integrity sha512-jADLgoZGWhAzThr+mRiyuFD4OUzt6jHnb7NRArRKorgxckqUBaPyFOau9hhbcSTHtU6ceyeWjN7FDt7uG2Hplw== +"@docusaurus/types@3.7.0", "@docusaurus/types@^3.4.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/types/-/types-3.7.0.tgz#3f5a68a60f80ecdcb085666da1d68f019afda943" + integrity sha512-kOmZg5RRqJfH31m+6ZpnwVbkqMJrPOG5t0IOl4i/+3ruXyNfWzZ0lVtVrD0u4ONc/0NOsS9sWYaxxWNkH1LdLQ== dependencies: "@mdx-js/mdx" "^3.0.0" "@types/history" "^4.7.11" "@types/react" "*" commander "^5.1.0" joi "^17.9.2" - react-helmet-async "^1.3.0" + react-helmet-async "npm:@slorber/react-helmet-async@1.3.0" utility-types "^3.10.0" webpack "^5.95.0" webpack-merge "^5.9.0" -"@docusaurus/types@^3.4.0": - version "3.4.0" - resolved "https://registry.yarnpkg.com/@docusaurus/types/-/types-3.4.0.tgz#237c3f737e9db3f7c1a5935a3ef48d6eadde8292" - integrity sha512-4jcDO8kXi5Cf9TcyikB/yKmz14f2RZ2qTRerbHAsS+5InE9ZgSLBNLsewtFTcTOXSVcbU3FoGOzcNWAmU1TR0A== - dependencies: - "@mdx-js/mdx" "^3.0.0" - "@types/history" "^4.7.11" - "@types/react" "*" - commander "^5.1.0" - joi "^17.9.2" - react-helmet-async "^1.3.0" - utility-types "^3.10.0" - webpack "^5.88.1" - webpack-merge "^5.9.0" - -"@docusaurus/utils-common@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/utils-common/-/utils-common-3.6.0.tgz#11855ea503132bbcaba6ca4d351293ff10a75d34" - integrity sha512-diUDNfbw33GaZMmKwdTckT2IBfVouXLXRD+zphH9ywswuaEIKqixvuf5g41H7MBBrlMsxhna3uTMoB4B/OPDcA== +"@docusaurus/utils-common@3.7.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/utils-common/-/utils-common-3.7.0.tgz#1bef52837d321db5dd2361fc07f3416193b5d029" + integrity sha512-IZeyIfCfXy0Mevj6bWNg7DG7B8G+S6o6JVpddikZtWyxJguiQ7JYr0SIZ0qWd8pGNuMyVwriWmbWqMnK7Y5PwA== dependencies: + "@docusaurus/types" "3.7.0" tslib "^2.6.0" -"@docusaurus/utils-validation@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/utils-validation/-/utils-validation-3.6.0.tgz#5557ca14fa64ac29e6f70e61006be721395ecde5" - integrity sha512-CRHiKKJEKA0GFlfOf71JWHl7PtwOyX0+Zg9ep9NFEZv6Lcx3RJ9nhl7p8HRjPL6deyYceavM//BsfW4pCI4BtA== +"@docusaurus/utils-validation@3.7.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/utils-validation/-/utils-validation-3.7.0.tgz#dc0786fb633ae5cef8e93337bf21c2a826c7ecbd" + integrity sha512-w8eiKk8mRdN+bNfeZqC4nyFoxNyI1/VExMKAzD9tqpJfLLbsa46Wfn5wcKH761g9WkKh36RtFV49iL9lh1DYBA== dependencies: - "@docusaurus/logger" "3.6.0" - "@docusaurus/utils" "3.6.0" - "@docusaurus/utils-common" "3.6.0" + "@docusaurus/logger" "3.7.0" + "@docusaurus/utils" "3.7.0" + "@docusaurus/utils-common" "3.7.0" fs-extra "^11.2.0" joi "^17.9.2" js-yaml "^4.1.0" lodash "^4.17.21" tslib "^2.6.0" -"@docusaurus/utils@3.6.0": - version "3.6.0" - resolved "https://registry.yarnpkg.com/@docusaurus/utils/-/utils-3.6.0.tgz#192785da6fd62dfd83d6f1879c3aa45547f5df23" - integrity sha512-VKczAutI4mptiAw/WcYEu5WeVhQ6Q1zdIUl64SGw9K++9lziH+Kt10Ee8l2dMpRkiUk6zzK20kMNlX2WCUwXYQ== +"@docusaurus/utils@3.7.0": + version "3.7.0" + resolved "https://registry.yarnpkg.com/@docusaurus/utils/-/utils-3.7.0.tgz#dfdebd63524c52b498f36b2907a3b2261930b9bb" + integrity sha512-e7zcB6TPnVzyUaHMJyLSArKa2AG3h9+4CfvKXKKWNx6hRs+p0a+u7HHTJBgo6KW2m+vqDnuIHK4X+bhmoghAFA== dependencies: - "@docusaurus/logger" "3.6.0" - "@docusaurus/utils-common" "3.6.0" - "@svgr/webpack" "^8.1.0" + "@docusaurus/logger" "3.7.0" + "@docusaurus/types" "3.7.0" + "@docusaurus/utils-common" "3.7.0" escape-string-regexp "^4.0.0" file-loader "^6.2.0" fs-extra "^11.1.1" @@ -2618,16 +1932,16 @@ utility-types "^3.10.0" webpack "^5.88.1" -"@emotion/babel-plugin@^11.11.0": - version "11.11.0" - resolved "https://registry.yarnpkg.com/@emotion/babel-plugin/-/babel-plugin-11.11.0.tgz#c2d872b6a7767a9d176d007f5b31f7d504bb5d6c" - integrity sha512-m4HEDZleaaCH+XgDDsPF15Ht6wTLsgDTeR3WYj9Q/k76JtWhrJjcP4+/XlG8LGT/Rol9qUfOIztXeA84ATpqPQ== +"@emotion/babel-plugin@^11.13.5": + version "11.13.5" + resolved "https://registry.yarnpkg.com/@emotion/babel-plugin/-/babel-plugin-11.13.5.tgz#eab8d65dbded74e0ecfd28dc218e75607c4e7bc0" + integrity sha512-pxHCpT2ex+0q+HH91/zsdHkw/lXd468DIN2zvfvLtPKLLMo6gQj7oLObq8PhkrxOZb/gGCq03S3Z7PDhS8pduQ== dependencies: "@babel/helper-module-imports" "^7.16.7" "@babel/runtime" "^7.18.3" - "@emotion/hash" "^0.9.1" - "@emotion/memoize" "^0.8.1" - "@emotion/serialize" "^1.1.2" + "@emotion/hash" "^0.9.2" + "@emotion/memoize" "^0.9.0" + "@emotion/serialize" "^1.3.3" babel-plugin-macros "^3.1.0" convert-source-map "^1.5.0" escape-string-regexp "^4.0.0" @@ -2635,128 +1949,118 @@ source-map "^0.5.7" stylis "4.2.0" -"@emotion/cache@^11.11.0": - version "11.11.0" - resolved "https://registry.yarnpkg.com/@emotion/cache/-/cache-11.11.0.tgz#809b33ee6b1cb1a625fef7a45bc568ccd9b8f3ff" - integrity sha512-P34z9ssTCBi3e9EI1ZsWpNHcfY1r09ZO0rZbRO2ob3ZQMnFI35jB536qoXbkdesr5EUhYi22anuEJuyxifaqAQ== +"@emotion/cache@^11.13.5", "@emotion/cache@^11.14.0": + version "11.14.0" + resolved "https://registry.yarnpkg.com/@emotion/cache/-/cache-11.14.0.tgz#ee44b26986eeb93c8be82bb92f1f7a9b21b2ed76" + integrity sha512-L/B1lc/TViYk4DcpGxtAVbx0ZyiKM5ktoIyafGkH6zg/tj+mA+NE//aPYKG0k8kCHSHVJrpLpcAlOBEXQ3SavA== dependencies: - "@emotion/memoize" "^0.8.1" - "@emotion/sheet" "^1.2.2" - "@emotion/utils" "^1.2.1" - "@emotion/weak-memoize" "^0.3.1" + "@emotion/memoize" "^0.9.0" + "@emotion/sheet" "^1.4.0" + "@emotion/utils" "^1.4.2" + "@emotion/weak-memoize" "^0.4.0" stylis "4.2.0" -"@emotion/hash@^0.9.1": - version "0.9.1" - resolved "https://registry.yarnpkg.com/@emotion/hash/-/hash-0.9.1.tgz#4ffb0055f7ef676ebc3a5a91fb621393294e2f43" - integrity sha512-gJB6HLm5rYwSLI6PQa+X1t5CFGrv1J1TWG+sOyMCeKz2ojaj6Fnl/rZEspogG+cvqbt4AE/2eIyD2QfLKTBNlQ== +"@emotion/hash@^0.9.2": + version "0.9.2" + resolved "https://registry.yarnpkg.com/@emotion/hash/-/hash-0.9.2.tgz#ff9221b9f58b4dfe61e619a7788734bd63f6898b" + integrity sha512-MyqliTZGuOm3+5ZRSaaBGP3USLw6+EGykkwZns2EPC5g8jJ4z9OrdZY9apkl3+UP9+sdz76YYkwCKP5gh8iY3g== -"@emotion/is-prop-valid@1.2.2", "@emotion/is-prop-valid@^1.2.2": +"@emotion/is-prop-valid@1.2.2": version "1.2.2" resolved "https://registry.yarnpkg.com/@emotion/is-prop-valid/-/is-prop-valid-1.2.2.tgz#d4175076679c6a26faa92b03bb786f9e52612337" integrity sha512-uNsoYd37AFmaCdXlg6EYD1KaPOaRWRByMCYzbKUX4+hhMfrxdVSelShywL4JVaAeM/eHUOSprYBQls+/neX3pw== dependencies: "@emotion/memoize" "^0.8.1" +"@emotion/is-prop-valid@^1.3.0": + version "1.3.1" + resolved "https://registry.yarnpkg.com/@emotion/is-prop-valid/-/is-prop-valid-1.3.1.tgz#8d5cf1132f836d7adbe42cf0b49df7816fc88240" + integrity sha512-/ACwoqx7XQi9knQs/G0qKvv5teDMhD7bXYns9N/wM8ah8iNb8jZ2uNO0YOgiq2o2poIvVtJS2YALasQuMSQ7Kw== + dependencies: + "@emotion/memoize" "^0.9.0" + "@emotion/memoize@^0.8.1": version "0.8.1" resolved "https://registry.yarnpkg.com/@emotion/memoize/-/memoize-0.8.1.tgz#c1ddb040429c6d21d38cc945fe75c818cfb68e17" integrity sha512-W2P2c/VRW1/1tLox0mVUalvnWXxavmv/Oum2aPsRcoDJuob75FC3Y8FbpfLwUegRcxINtGUMPq0tFCvYNTBXNA== +"@emotion/memoize@^0.9.0": + version "0.9.0" + resolved "https://registry.yarnpkg.com/@emotion/memoize/-/memoize-0.9.0.tgz#745969d649977776b43fc7648c556aaa462b4102" + integrity sha512-30FAj7/EoJ5mwVPOWhAyCX+FPfMDrVecJAM+Iw9NRoSl4BBAQeqj4cApHHUXOVvIPgLVDsCFoz/hGD+5QQD1GQ== + "@emotion/react@^11.11.3": - version "11.11.4" - resolved "https://registry.yarnpkg.com/@emotion/react/-/react-11.11.4.tgz#3a829cac25c1f00e126408fab7f891f00ecc3c1d" - integrity sha512-t8AjMlF0gHpvvxk5mAtCqR4vmxiGHCeJBaQO6gncUSdklELOgtwjerNY2yuJNfwnc6vi16U/+uMF+afIawJ9iw== + version "11.14.0" + resolved "https://registry.yarnpkg.com/@emotion/react/-/react-11.14.0.tgz#cfaae35ebc67dd9ef4ea2e9acc6cd29e157dd05d" + integrity sha512-O000MLDBDdk/EohJPFUqvnp4qnHeYkVP5B0xEG0D/L7cOKP9kefu2DXn8dj74cQfsEzUqh+sr1RzFqiL1o+PpA== dependencies: "@babel/runtime" "^7.18.3" - "@emotion/babel-plugin" "^11.11.0" - "@emotion/cache" "^11.11.0" - "@emotion/serialize" "^1.1.3" - "@emotion/use-insertion-effect-with-fallbacks" "^1.0.1" - "@emotion/utils" "^1.2.1" - "@emotion/weak-memoize" "^0.3.1" + "@emotion/babel-plugin" "^11.13.5" + "@emotion/cache" "^11.14.0" + "@emotion/serialize" "^1.3.3" + "@emotion/use-insertion-effect-with-fallbacks" "^1.2.0" + "@emotion/utils" "^1.4.2" + "@emotion/weak-memoize" "^0.4.0" hoist-non-react-statics "^3.3.1" -"@emotion/serialize@^1.1.2", "@emotion/serialize@^1.1.3", "@emotion/serialize@^1.1.4": - version "1.1.4" - resolved "https://registry.yarnpkg.com/@emotion/serialize/-/serialize-1.1.4.tgz#fc8f6d80c492cfa08801d544a05331d1cc7cd451" - integrity sha512-RIN04MBT8g+FnDwgvIUi8czvr1LU1alUMI05LekWB5DGyTm8cCBMCRpq3GqaiyEDRptEXOyXnvZ58GZYu4kBxQ== +"@emotion/serialize@^1.3.3": + version "1.3.3" + resolved "https://registry.yarnpkg.com/@emotion/serialize/-/serialize-1.3.3.tgz#d291531005f17d704d0463a032fe679f376509e8" + integrity sha512-EISGqt7sSNWHGI76hC7x1CksiXPahbxEOrC5RjmFRJTqLyEK9/9hZvBbiYn70dw4wuwMKiEMCUlR6ZXTSWQqxA== dependencies: - "@emotion/hash" "^0.9.1" - "@emotion/memoize" "^0.8.1" - "@emotion/unitless" "^0.8.1" - "@emotion/utils" "^1.2.1" + "@emotion/hash" "^0.9.2" + "@emotion/memoize" "^0.9.0" + "@emotion/unitless" "^0.10.0" + "@emotion/utils" "^1.4.2" csstype "^3.0.2" -"@emotion/sheet@^1.2.2": - version "1.2.2" - resolved "https://registry.yarnpkg.com/@emotion/sheet/-/sheet-1.2.2.tgz#d58e788ee27267a14342303e1abb3d508b6d0fec" - integrity sha512-0QBtGvaqtWi+nx6doRwDdBIzhNdZrXUppvTM4dtZZWEGTXL/XE/yJxLMGlDT1Gt+UHH5IX1n+jkXyytE/av7OA== +"@emotion/sheet@^1.4.0": + version "1.4.0" + resolved "https://registry.yarnpkg.com/@emotion/sheet/-/sheet-1.4.0.tgz#c9299c34d248bc26e82563735f78953d2efca83c" + integrity sha512-fTBW9/8r2w3dXWYM4HCB1Rdp8NLibOw2+XELH5m5+AkWiL/KqYX6dc0kKYlaYyKjrQ6ds33MCdMPEwgs2z1rqg== "@emotion/styled@^11.11.0": - version "11.11.5" - resolved "https://registry.yarnpkg.com/@emotion/styled/-/styled-11.11.5.tgz#0c5c8febef9d86e8a926e663b2e5488705545dfb" - integrity sha512-/ZjjnaNKvuMPxcIiUkf/9SHoG4Q196DRl1w82hQ3WCsjo1IUR8uaGWrC6a87CrYAW0Kb/pK7hk8BnLgLRi9KoQ== + version "11.14.0" + resolved "https://registry.yarnpkg.com/@emotion/styled/-/styled-11.14.0.tgz#f47ca7219b1a295186d7661583376fcea95f0ff3" + integrity sha512-XxfOnXFffatap2IyCeJyNov3kiDQWoR08gPUQxvbL7fxKryGBKUZUkG6Hz48DZwVrJSVh9sJboyV1Ds4OW6SgA== dependencies: "@babel/runtime" "^7.18.3" - "@emotion/babel-plugin" "^11.11.0" - "@emotion/is-prop-valid" "^1.2.2" - "@emotion/serialize" "^1.1.4" - "@emotion/use-insertion-effect-with-fallbacks" "^1.0.1" - "@emotion/utils" "^1.2.1" + "@emotion/babel-plugin" "^11.13.5" + "@emotion/is-prop-valid" "^1.3.0" + "@emotion/serialize" "^1.3.3" + "@emotion/use-insertion-effect-with-fallbacks" "^1.2.0" + "@emotion/utils" "^1.4.2" -"@emotion/unitless@0.8.1", "@emotion/unitless@^0.8.1": +"@emotion/unitless@0.8.1": version "0.8.1" resolved "https://registry.yarnpkg.com/@emotion/unitless/-/unitless-0.8.1.tgz#182b5a4704ef8ad91bde93f7a860a88fd92c79a3" integrity sha512-KOEGMu6dmJZtpadb476IsZBclKvILjopjUii3V+7MnXIQCYh8W3NgNcgwo21n9LXZX6EDIKvqfjYxXebDwxKmQ== -"@emotion/use-insertion-effect-with-fallbacks@^1.0.1": - version "1.0.1" - resolved "https://registry.yarnpkg.com/@emotion/use-insertion-effect-with-fallbacks/-/use-insertion-effect-with-fallbacks-1.0.1.tgz#08de79f54eb3406f9daaf77c76e35313da963963" - integrity sha512-jT/qyKZ9rzLErtrjGgdkMBn2OP8wl0G3sQlBb3YPryvKHsjvINUhVaPFfP+fpBcOkmrVOVEEHQFJ7nbj2TH2gw== +"@emotion/unitless@^0.10.0": + version "0.10.0" + resolved "https://registry.yarnpkg.com/@emotion/unitless/-/unitless-0.10.0.tgz#2af2f7c7e5150f497bdabd848ce7b218a27cf745" + integrity sha512-dFoMUuQA20zvtVTuxZww6OHoJYgrzfKM1t52mVySDJnMSEa08ruEvdYQbhvyu6soU+NeLVd3yKfTfT0NeV6qGg== -"@emotion/utils@^1.2.1": - version "1.2.1" - resolved "https://registry.yarnpkg.com/@emotion/utils/-/utils-1.2.1.tgz#bbab58465738d31ae4cb3dbb6fc00a5991f755e4" - integrity sha512-Y2tGf3I+XVnajdItskUCn6LX+VUDmP6lTL4fcqsXAv43dnlbZiuW4MWQW38rW/BVWSE7Q/7+XQocmpnRYILUmg== +"@emotion/use-insertion-effect-with-fallbacks@^1.2.0": + version "1.2.0" + resolved "https://registry.yarnpkg.com/@emotion/use-insertion-effect-with-fallbacks/-/use-insertion-effect-with-fallbacks-1.2.0.tgz#8a8cb77b590e09affb960f4ff1e9a89e532738bf" + integrity sha512-yJMtVdH59sxi/aVJBpk9FQq+OR8ll5GT8oWd57UpeaKEVGab41JWaCFA7FRLoMLloOZF/c/wsPoe+bfGmRKgDg== -"@emotion/weak-memoize@^0.3.1": - version "0.3.1" - resolved "https://registry.yarnpkg.com/@emotion/weak-memoize/-/weak-memoize-0.3.1.tgz#d0fce5d07b0620caa282b5131c297bb60f9d87e6" - integrity sha512-EsBwpc7hBUJWAsNPBmJy4hxWx12v6bshQsldrVmjxJoc3isbxhOrF2IcCpaXxfvq03NwkI7sbsOLXbYuqF/8Ww== +"@emotion/utils@^1.4.2": + version "1.4.2" + resolved "https://registry.yarnpkg.com/@emotion/utils/-/utils-1.4.2.tgz#6df6c45881fcb1c412d6688a311a98b7f59c1b52" + integrity sha512-3vLclRofFziIa3J2wDh9jjbkUz9qk5Vi3IZ/FSTKViB0k+ef0fPV7dYrUIugbgupYDx7v9ud/SjrtEP8Y4xLoA== + +"@emotion/weak-memoize@^0.4.0": + version "0.4.0" + resolved "https://registry.yarnpkg.com/@emotion/weak-memoize/-/weak-memoize-0.4.0.tgz#5e13fac887f08c44f76b0ccaf3370eb00fec9bb6" + integrity sha512-snKqtPW01tN0ui7yu9rGv69aJXr/a/Ywvl11sUjNtEcRc+ng/mQriFL0wLXMef74iHa/EkftbDzU9F8iFbH+zg== "@exodus/schemasafe@^1.0.0-rc.2": version "1.3.0" resolved "https://registry.yarnpkg.com/@exodus/schemasafe/-/schemasafe-1.3.0.tgz#731656abe21e8e769a7f70a4d833e6312fe59b7f" integrity sha512-5Aap/GaRupgNx/feGBwLLTVv8OQFfv3pq2lPRzPg9R+IOBnDgghTGW7l7EuVXOvg5cc/xSAlRW8rBrjIC3Nvqw== -"@floating-ui/core@^1.6.0": - version "1.6.4" - resolved "https://registry.yarnpkg.com/@floating-ui/core/-/core-1.6.4.tgz#0140cf5091c8dee602bff9da5ab330840ff91df6" - integrity sha512-a4IowK4QkXl4SCWTGUR0INAfEOX3wtsYw3rKK5InQEHMGObkR8Xk44qYQD9P4r6HHw0iIfK6GUKECmY8sTkqRA== - dependencies: - "@floating-ui/utils" "^0.2.4" - -"@floating-ui/dom@^1.0.0": - version "1.6.7" - resolved "https://registry.yarnpkg.com/@floating-ui/dom/-/dom-1.6.7.tgz#85d22f731fcc5b209db504478fb1df5116a83015" - integrity sha512-wmVfPG5o2xnKDU4jx/m4w5qva9FWHcnZ8BvzEe90D/RpwsJaTAVYPEPdQ8sbr/N8zZTAHlZUTQdqg8ZUbzHmng== - dependencies: - "@floating-ui/core" "^1.6.0" - "@floating-ui/utils" "^0.2.4" - -"@floating-ui/react-dom@^2.0.8": - version "2.1.1" - resolved "https://registry.yarnpkg.com/@floating-ui/react-dom/-/react-dom-2.1.1.tgz#cca58b6b04fc92b4c39288252e285e0422291fb0" - integrity sha512-4h84MJt3CHrtG18mGsXuLCHMrug49d7DFkU0RMIyshRveBeyV2hmV/pDaF2Uxtu8kgq5r46llp5E5FQiR0K2Yg== - dependencies: - "@floating-ui/dom" "^1.0.0" - -"@floating-ui/utils@^0.2.4": - version "0.2.4" - resolved "https://registry.yarnpkg.com/@floating-ui/utils/-/utils-0.2.4.tgz#1d459cee5031893a08a0e064c406ad2130cced7c" - integrity sha512-dWO2pw8hhi+WrXq1YJy2yCuWoL20PddgGaqTgVe4cOS9Q6qklXCiA1tJEqX6BEwRNSCP84/afac9hd4MS+zEUA== - "@hapi/hoek@^9.0.0", "@hapi/hoek@^9.3.0": version "9.3.0" resolved "https://registry.yarnpkg.com/@hapi/hoek/-/hoek-9.3.0.tgz#8368869dcb735be2e7f5cb7647de78e167a251fb" @@ -2775,17 +2079,18 @@ integrity sha512-+wluvCrRhXrhyOmRDJ3q8mux9JkKy5SJ/v8ol2tu4FVjyYvtEzkc/3pK15ET6RKg4b4w4BmTk1+gsCUhf21Ykg== "@iconify/utils@^2.1.32": - version "2.1.33" - resolved "https://registry.yarnpkg.com/@iconify/utils/-/utils-2.1.33.tgz#cbf7242a52fd0ec58c42d37d28e4406b5327e8c0" - integrity sha512-jP9h6v/g0BIZx0p7XGJJVtkVnydtbgTgt9mVNcGDYwaa7UhdHdI9dvoq+gKj9sijMSJKxUPEG2JyjsgXjxL7Kw== + version "2.2.1" + resolved "https://registry.yarnpkg.com/@iconify/utils/-/utils-2.2.1.tgz#635b9bd8fd3e5e53742471bc0b5291f1570dda41" + integrity sha512-0/7J7hk4PqXmxo5PDBDxmnecw5PxklZJfNjIVG9FM0mEfVrvfudS22rYWsqVk6gR3UJ/mSYS90X4R3znXnqfNA== dependencies: - "@antfu/install-pkg" "^0.4.0" + "@antfu/install-pkg" "^0.4.1" "@antfu/utils" "^0.7.10" "@iconify/types" "^2.0.0" - debug "^4.3.6" + debug "^4.4.0" + globals "^15.13.0" kolorist "^1.8.0" - local-pkg "^0.5.0" - mlly "^1.7.1" + local-pkg "^0.5.1" + mlly "^1.7.3" "@jest/schemas@^29.6.3": version "29.6.3" @@ -2807,9 +2112,9 @@ chalk "^4.0.0" "@jridgewell/gen-mapping@^0.3.5": - version "0.3.5" - resolved "https://registry.yarnpkg.com/@jridgewell/gen-mapping/-/gen-mapping-0.3.5.tgz#dcce6aff74bdf6dad1a95802b69b04a2fcb1fb36" - integrity sha512-IzL8ZoEDIBRWEzlCcRhOaCupYyN5gdIK+Q6fbFdPDg6HqX6jpkItn7DFIpW9LQzXG6Df9sA7+OKnq0qlz/GaQg== + version "0.3.8" + resolved "https://registry.yarnpkg.com/@jridgewell/gen-mapping/-/gen-mapping-0.3.8.tgz#4f0e06362e01362f823d348f1872b08f666d8142" + integrity sha512-imAbBGkb+ebQyxKgzv5Hu2nmROxoDOXHh80evxdoXNOrvAnVx7zimzc1Oo5h9RlfV4vPXaE2iM5pOFbvOCClWA== dependencies: "@jridgewell/set-array" "^1.2.1" "@jridgewell/sourcemap-codec" "^1.4.10" @@ -2838,7 +2143,7 @@ resolved "https://registry.yarnpkg.com/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.0.tgz#3188bcb273a414b0d215fd22a58540b989b9409a" integrity sha512-gv3ZRaISU3fjPAgNsriBRqGWQL6quFx04YMPW/zD8XMLsU32mhCCbfbO6KZFLjvYpCZ8zyDEgqsgf+PwPaM7GQ== -"@jridgewell/trace-mapping@^0.3.18", "@jridgewell/trace-mapping@^0.3.20", "@jridgewell/trace-mapping@^0.3.24", "@jridgewell/trace-mapping@^0.3.25": +"@jridgewell/trace-mapping@^0.3.18", "@jridgewell/trace-mapping@^0.3.24", "@jridgewell/trace-mapping@^0.3.25": version "0.3.25" resolved "https://registry.yarnpkg.com/@jridgewell/trace-mapping/-/trace-mapping-0.3.25.tgz#15f190e98895f3fc23276ee14bc76b675c2e50f0" integrity sha512-vNk6aEwybGtawWmy/PzwnGDOjCkLWSD2wqvjGGAgOAwCGWySYXfYoxt00IJkTF+8Lb57DwOb3Aa0o9CApepiYQ== @@ -2852,9 +2157,9 @@ integrity sha512-Vo+PSpZG2/fmgmiNzYK9qWRh8h/CHrwD0mo1h1DzL4yzHNSfWYujGTYsWGreD000gcgmZ7K4Ys6Tx9TxtsKdDw== "@mdx-js/mdx@^3.0.0": - version "3.0.1" - resolved "https://registry.yarnpkg.com/@mdx-js/mdx/-/mdx-3.0.1.tgz#617bd2629ae561fdca1bb88e3badd947f5a82191" - integrity sha512-eIQ4QTrOWyL3LWEe/bu6Taqzq2HQvHcyTMaOrI95P2/LmJE7AsfPfgJGuFLPVqBUE1BC1rik3VIhU+s9u72arA== + version "3.1.0" + resolved "https://registry.yarnpkg.com/@mdx-js/mdx/-/mdx-3.1.0.tgz#10235cab8ad7d356c262e8c21c68df5850a97dc3" + integrity sha512-/QxEhPAvGwbQmy1Px8F899L5Uc2KZ6JtXwlCgJmjSTBedwOZkByYcBG4GceIGPXRDsmfxhHazuS+hlOShRLeDw== dependencies: "@types/estree" "^1.0.0" "@types/estree-jsx" "^1.0.0" @@ -2862,14 +2167,15 @@ "@types/mdx" "^2.0.0" collapse-white-space "^2.0.0" devlop "^1.0.0" - estree-util-build-jsx "^3.0.0" estree-util-is-identifier-name "^3.0.0" - estree-util-to-js "^2.0.0" + estree-util-scope "^1.0.0" estree-walker "^3.0.0" - hast-util-to-estree "^3.0.0" hast-util-to-jsx-runtime "^2.0.0" markdown-extensions "^2.0.0" - periscopic "^3.0.0" + recma-build-jsx "^1.0.0" + recma-jsx "^1.0.0" + recma-stringify "^1.0.0" + rehype-recma "^1.0.0" remark-mdx "^3.0.0" remark-parse "^11.0.0" remark-rehype "^11.0.0" @@ -2881,9 +2187,9 @@ vfile "^6.0.0" "@mdx-js/react@^3.0.0": - version "3.0.1" - resolved "https://registry.yarnpkg.com/@mdx-js/react/-/react-3.0.1.tgz#997a19b3a5b783d936c75ae7c47cfe62f967f746" - integrity sha512-9ZrPIU4MGf6et1m1ov3zKf+q9+deetI51zprKB1D/z3NOb+rUxxtEl3mCjW5wTGh6VhRdwPueh1oRzi6ezkA8A== + version "3.1.0" + resolved "https://registry.yarnpkg.com/@mdx-js/react/-/react-3.1.0.tgz#c4522e335b3897b9a845db1dbdd2f966ae8fb0ed" + integrity sha512-QjHtSaoameoalGnKDT3FoIl4+9RwyTmo9ZJGBdLOks/YOiWHoRDI3PUwEzOE7kEmGcV3AFcp9K6dYu9rEuKLAQ== dependencies: "@types/mdx" "^2.0.0" @@ -2894,129 +2200,130 @@ dependencies: langium "3.0.0" -"@mui/base@5.0.0-beta.40": - version "5.0.0-beta.40" - resolved "https://registry.yarnpkg.com/@mui/base/-/base-5.0.0-beta.40.tgz#1f8a782f1fbf3f84a961e954c8176b187de3dae2" - integrity sha512-I/lGHztkCzvwlXpjD2+SNmvNQvB4227xBXhISPjEaJUXGImOQ9f3D2Yj/T3KasSI/h0MLWy74X0J6clhPmsRbQ== +"@mui/core-downloads-tracker@^6.4.0": + version "6.4.0" + resolved "https://registry.yarnpkg.com/@mui/core-downloads-tracker/-/core-downloads-tracker-6.4.0.tgz#b83f3f390d4e692a4f86f413c32f3131da38d492" + integrity sha512-6u74wi+9zeNlukrCtYYET8Ed/n9AS27DiaXCZKAD3TRGFaqiyYSsQgN2disW83pI/cM1Q2lJY1JX4YfwvNtlNw== + +"@mui/icons-material@^6.3.0": + version "6.4.0" + resolved "https://registry.yarnpkg.com/@mui/icons-material/-/icons-material-6.4.0.tgz#4e1b74578b6c4987c341c9739f5f40987c44ccd1" + integrity sha512-zF0Vqt8a+Zp2Oz8P+WvJflba6lLe3PhxIz1NNqn+n4A+wKLPbkeqY8ShmKjPyiCTg0RMbPrp993oUDl9xGsDlQ== dependencies: - "@babel/runtime" "^7.23.9" - "@floating-ui/react-dom" "^2.0.8" - "@mui/types" "^7.2.14" - "@mui/utils" "^5.15.14" - "@popperjs/core" "^2.11.8" - clsx "^2.1.0" - prop-types "^15.8.1" + "@babel/runtime" "^7.26.0" -"@mui/core-downloads-tracker@^5.16.0": - version "5.16.0" - resolved "https://registry.yarnpkg.com/@mui/core-downloads-tracker/-/core-downloads-tracker-5.16.0.tgz#50153c698e321793c83a0283d8d7a9dc5d43858a" - integrity sha512-8SLffXYPRVpcZx5QzxNE8fytTqzp+IuU3deZbQWg/vSaTlDpR5YVrQ4qQtXTi5cRdhOufV5INylmwlKK+//nPw== - -"@mui/icons-material@^5.15.3": - version "5.16.0" - resolved "https://registry.yarnpkg.com/@mui/icons-material/-/icons-material-5.16.0.tgz#5269fda922fe5e6db3577ec497e8b987195606ef" - integrity sha512-6ISoOhkp9w5gD0PEW9JklrcbyARDkFWNTBdwXZ1Oy5IGlyu9B0zG0hnUIe4H17IaF1Vgj6C8VI+v4tkSdK0veg== - dependencies: - "@babel/runtime" "^7.23.9" - -"@mui/material@^5.15.3": - version "5.16.0" - resolved "https://registry.yarnpkg.com/@mui/material/-/material-5.16.0.tgz#2ef4f52ae773574fc0a681f25705f376f5cd13f7" - integrity sha512-DbR1NckTLpjt9Zut9EGQ70th86HfN0BYQgyYro6aXQrNfjzSwe3BJS1AyBQ5mJ7TdL6YVRqohfukxj9JlqZZUg== - dependencies: - "@babel/runtime" "^7.23.9" - "@mui/base" "5.0.0-beta.40" - "@mui/core-downloads-tracker" "^5.16.0" - "@mui/system" "^5.16.0" - "@mui/types" "^7.2.14" - "@mui/utils" "^5.16.0" - "@types/react-transition-group" "^4.4.10" - clsx "^2.1.0" +"@mui/material@^6.3.0": + version "6.4.0" + resolved "https://registry.yarnpkg.com/@mui/material/-/material-6.4.0.tgz#5f2f09ac66fc9422716056f9b36dd52c9f7cc473" + integrity sha512-hNIgwdM9U3DNmowZ8mU59oFmWoDKjc92FqQnQva3Pxh6xRKWtD2Ej7POUHMX8Dwr1OpcSUlT2+tEMeLb7WYsIg== + dependencies: + "@babel/runtime" "^7.26.0" + "@mui/core-downloads-tracker" "^6.4.0" + "@mui/system" "^6.4.0" + "@mui/types" "^7.2.21" + "@mui/utils" "^6.4.0" + "@popperjs/core" "^2.11.8" + "@types/react-transition-group" "^4.4.12" + clsx "^2.1.1" csstype "^3.1.3" prop-types "^15.8.1" - react-is "^18.2.0" + react-is "^19.0.0" react-transition-group "^4.4.5" -"@mui/private-theming@^5.16.0": - version "5.16.0" - resolved "https://registry.yarnpkg.com/@mui/private-theming/-/private-theming-5.16.0.tgz#c1abfd3e0d9c95459048240ef4209dc7f25dc949" - integrity sha512-sYpubkO1MZOnxNyVOClrPNOTs0MfuRVVnAvCeMaOaXt6GimgQbnUcshYv2pSr6PFj+Mqzdff/FYOBceK8u5QgA== +"@mui/private-theming@^6.4.0": + version "6.4.0" + resolved "https://registry.yarnpkg.com/@mui/private-theming/-/private-theming-6.4.0.tgz#d17e4bc63462d7b54e71eeb8aa660dab8aa4097c" + integrity sha512-rNHci8MP6NOdEWAfZ/RBMO5Rhtp1T6fUDMSmingg9F1T6wiUeodIQ+NuTHh2/pMoUSeP9GdHdgMhMmfsXxOMuw== dependencies: - "@babel/runtime" "^7.23.9" - "@mui/utils" "^5.16.0" + "@babel/runtime" "^7.26.0" + "@mui/utils" "^6.4.0" prop-types "^15.8.1" -"@mui/styled-engine@^5.15.14": - version "5.15.14" - resolved "https://registry.yarnpkg.com/@mui/styled-engine/-/styled-engine-5.15.14.tgz#168b154c4327fa4ccc1933a498331d53f61c0de2" - integrity sha512-RILkuVD8gY6PvjZjqnWhz8fu68dVkqhM5+jYWfB5yhlSQKg+2rHkmEwm75XIeAqI3qwOndK6zELK5H6Zxn4NHw== +"@mui/styled-engine@^6.4.0": + version "6.4.0" + resolved "https://registry.yarnpkg.com/@mui/styled-engine/-/styled-engine-6.4.0.tgz#1f01a5218964f0e3bd8eb13170e12b5f55c4f159" + integrity sha512-ek/ZrDujrger12P6o4luQIfRd2IziH7jQod2WMbLqGE03Iy0zUwYmckRTVhRQTLPNccpD8KXGcALJF+uaUQlbg== dependencies: - "@babel/runtime" "^7.23.9" - "@emotion/cache" "^11.11.0" + "@babel/runtime" "^7.26.0" + "@emotion/cache" "^11.13.5" + "@emotion/serialize" "^1.3.3" + "@emotion/sheet" "^1.4.0" csstype "^3.1.3" prop-types "^15.8.1" -"@mui/system@^5.16.0": - version "5.16.0" - resolved "https://registry.yarnpkg.com/@mui/system/-/system-5.16.0.tgz#e5b4cfbdfbc0ee9859f6b168e8b07d750303b7a0" - integrity sha512-9YbkC2m3+pNumAvubYv+ijLtog6puJ0fJ6rYfzfLCM47pWrw3m+30nXNM8zMgDaKL6vpfWJcCXm+LPaWBpy7sw== - dependencies: - "@babel/runtime" "^7.23.9" - "@mui/private-theming" "^5.16.0" - "@mui/styled-engine" "^5.15.14" - "@mui/types" "^7.2.14" - "@mui/utils" "^5.16.0" - clsx "^2.1.0" +"@mui/system@^6.4.0": + version "6.4.0" + resolved "https://registry.yarnpkg.com/@mui/system/-/system-6.4.0.tgz#6501ff41bf7bc3e85cd8227fdd249eaa079bc22e" + integrity sha512-wTDyfRlaZCo2sW2IuOsrjeE5dl0Usrs6J7DxE3GwNCVFqS5wMplM2YeNiV3DO7s53RfCqbho+gJY6xaB9KThUA== + dependencies: + "@babel/runtime" "^7.26.0" + "@mui/private-theming" "^6.4.0" + "@mui/styled-engine" "^6.4.0" + "@mui/types" "^7.2.21" + "@mui/utils" "^6.4.0" + clsx "^2.1.1" csstype "^3.1.3" prop-types "^15.8.1" -"@mui/types@^7.2.14": - version "7.2.14" - resolved "https://registry.yarnpkg.com/@mui/types/-/types-7.2.14.tgz#8a02ac129b70f3d82f2f9b76ded2c8d48e3fc8c9" - integrity sha512-MZsBZ4q4HfzBsywtXgM1Ksj6HDThtiwmOKUXH1pKYISI9gAVXCNHNpo7TlGoGrBaYWZTdNoirIN7JsQcQUjmQQ== +"@mui/types@^7.2.21": + version "7.2.21" + resolved "https://registry.yarnpkg.com/@mui/types/-/types-7.2.21.tgz#63f50874eda8e4a021a69aaa8ba9597369befda2" + integrity sha512-6HstngiUxNqLU+/DPqlUJDIPbzUBxIVHb1MmXP0eTWDIROiCR2viugXpEif0PPe2mLqqakPzzRClWAnK+8UJww== -"@mui/utils@^5.13.7", "@mui/utils@^5.14.16", "@mui/utils@^5.15.14", "@mui/utils@^5.16.0": - version "5.16.0" - resolved "https://registry.yarnpkg.com/@mui/utils/-/utils-5.16.0.tgz#3963127d9a619c251e5be1aef9adab0e89d3e7df" - integrity sha512-kLLi5J1xY+mwtUlMb8Ubdxf4qFAA1+U7WPBvjM/qQ4CIwLCohNb0sHo1oYPufjSIH/Z9+dhVxD7dJlfGjd1AVA== +"@mui/utils@^5.16.6 || ^6.0.0", "@mui/utils@^6.4.0": + version "6.4.0" + resolved "https://registry.yarnpkg.com/@mui/utils/-/utils-6.4.0.tgz#817d8135794b8741ad0267b90dc656361f1c0030" + integrity sha512-woOTATWNsTNR3YBh2Ixkj3l5RaxSiGoC9G8gOpYoFw1mZM77LWJeuMHFax7iIW4ahK0Cr35TF9DKtrafJmOmNQ== dependencies: - "@babel/runtime" "^7.23.9" - "@types/prop-types" "^15.7.11" + "@babel/runtime" "^7.26.0" + "@mui/types" "^7.2.21" + "@types/prop-types" "^15.7.14" + clsx "^2.1.1" prop-types "^15.8.1" - react-is "^18.2.0" + react-is "^19.0.0" + +"@mui/x-data-grid-pro@^7.23.5": + version "7.24.0" + resolved "https://registry.yarnpkg.com/@mui/x-data-grid-pro/-/x-data-grid-pro-7.24.0.tgz#c0766a64e902ede4ed87f7e222b4085e0881b44c" + integrity sha512-DTjXbxmTL0hxEUH031wpLJWwX8STZ920jXsO03+kzZ2EF/HPffPlmyvbNPUMObXO2jOUzEjyob80jSlZ4EsBhQ== + dependencies: + "@babel/runtime" "^7.25.7" + "@mui/utils" "^5.16.6 || ^6.0.0" + "@mui/x-data-grid" "7.24.0" + "@mui/x-internals" "7.24.0" + "@mui/x-license" "7.24.0" + "@types/format-util" "^1.0.4" + clsx "^2.1.1" + prop-types "^15.8.1" + reselect "^5.1.1" -"@mui/x-data-grid-pro@^6.18.6": - version "6.20.3" - resolved "https://registry.yarnpkg.com/@mui/x-data-grid-pro/-/x-data-grid-pro-6.20.3.tgz#e16e704969f79e289e60f9c542d69169e0839023" - integrity sha512-UblinLg4BZkHkjSy5r4B5Ip+kBcZ/6PzNUJNB0I1nep/gi/vqJd5zCsPZ9IZqtTbh0wyDfupvqQxnneMsiLl2w== +"@mui/x-data-grid@7.24.0", "@mui/x-data-grid@^7.23.5": + version "7.24.0" + resolved "https://registry.yarnpkg.com/@mui/x-data-grid/-/x-data-grid-7.24.0.tgz#8940dbfe4f39e2a22ddb5bad0565ccfe913a7e63" + integrity sha512-goYTKDp+e+dXw7E+WndWUhWXTjX3aTqN8W2dCKhXnmE9Gu8dFwG6Azl7GK9l2m5YHGuqYmpWqcSG9etLdwYaVg== dependencies: - "@babel/runtime" "^7.23.2" - "@mui/utils" "^5.14.16" - "@mui/x-data-grid" "6.20.3" - "@mui/x-license-pro" "6.10.2" - "@types/format-util" "^1.0.3" - clsx "^2.0.0" + "@babel/runtime" "^7.25.7" + "@mui/utils" "^5.16.6 || ^6.0.0" + "@mui/x-internals" "7.24.0" + clsx "^2.1.1" prop-types "^15.8.1" - reselect "^4.1.8" + reselect "^5.1.1" -"@mui/x-data-grid@6.20.3", "@mui/x-data-grid@^6.18.6": - version "6.20.3" - resolved "https://registry.yarnpkg.com/@mui/x-data-grid/-/x-data-grid-6.20.3.tgz#8fe6f8b04360c75f58d6034dfac11e31538bd719" - integrity sha512-VVggwKiEgMdkVqpORZEBgSqcpuBoVKMwYZnO+Q8vns2+otpiFE4yr52TZjKkF+ugDPgZ4rcq8mlj4VsK83XiMQ== +"@mui/x-internals@7.24.0": + version "7.24.0" + resolved "https://registry.yarnpkg.com/@mui/x-internals/-/x-internals-7.24.0.tgz#5d09d3d5d113e2be6ec2af49192024859951d348" + integrity sha512-lYa/XLltxNMY8YAFDopIHrXda2EAoqMCilyGMuPMz+WTG+b+StlUKqtj8cgFPQ/sa5dQ2fR7R3KJdjLREKUrlQ== dependencies: - "@babel/runtime" "^7.23.2" - "@mui/utils" "^5.14.16" - clsx "^2.0.0" - prop-types "^15.8.1" - reselect "^4.1.8" + "@babel/runtime" "^7.25.7" + "@mui/utils" "^5.16.6 || ^6.0.0" -"@mui/x-license-pro@6.10.2": - version "6.10.2" - resolved "https://registry.yarnpkg.com/@mui/x-license-pro/-/x-license-pro-6.10.2.tgz#68b069214efb085f7f8c34b73d450743857e0aea" - integrity sha512-Baw3shilU+eHgU+QYKNPFUKvfS5rSyNJ98pQx02E0gKA22hWp/XAt88K1qUfUMPlkPpvg/uci6gviQSSLZkuKw== +"@mui/x-license@7.24.0": + version "7.24.0" + resolved "https://registry.yarnpkg.com/@mui/x-license/-/x-license-7.24.0.tgz#e333cdf83606b3dc508bc7cd7149c3e93bf45d20" + integrity sha512-x4zKWeTZaQcgSqEKWGWS3qjid1h1vGkFzsdnBBre7my6Zw0V7uDh4i7Jyl0WEiDLUMqoLME8yhT0sI4E+sUJ1w== dependencies: - "@babel/runtime" "^7.22.6" - "@mui/utils" "^5.13.7" + "@babel/runtime" "^7.25.7" + "@mui/utils" "^5.16.6 || ^6.0.0" "@nodelib/fs.scandir@2.1.5": version "2.1.5" @@ -3052,38 +2359,57 @@ graceful-fs "4.2.10" "@pnpm/npm-conf@^2.1.0": - version "2.2.2" - resolved "https://registry.yarnpkg.com/@pnpm/npm-conf/-/npm-conf-2.2.2.tgz#0058baf1c26cbb63a828f0193795401684ac86f0" - integrity sha512-UA91GwWPhFExt3IizW6bOeY/pQ0BkuNwKjk9iQW9KqxluGCrg4VenZ0/L+2Y0+ZOtme72EVvg6v0zo3AMQRCeA== + version "2.3.1" + resolved "https://registry.yarnpkg.com/@pnpm/npm-conf/-/npm-conf-2.3.1.tgz#bb375a571a0bd63ab0a23bece33033c683e9b6b0" + integrity sha512-c83qWb22rNRuB0UaVCI0uRPNRr8Z0FWnEIvT47jiHAmOIUHbBOg5XvV7pM5x+rKn9HRpjxquDbXYSXr3fAKFcw== dependencies: "@pnpm/config.env-replace" "^1.1.0" "@pnpm/network.ca-file" "^1.0.1" config-chain "^1.1.11" "@polka/url@^1.0.0-next.24": - version "1.0.0-next.25" - resolved "https://registry.yarnpkg.com/@polka/url/-/url-1.0.0-next.25.tgz#f077fdc0b5d0078d30893396ff4827a13f99e817" - integrity sha512-j7P6Rgr3mmtdkeDGTe0E/aYyWEWVtc5yFXtHCRHs28/jptDEWfaVOc5T7cblqy1XKPPfCxJc/8DwQ5YgLOZOVQ== + version "1.0.0-next.28" + resolved "https://registry.yarnpkg.com/@polka/url/-/url-1.0.0-next.28.tgz#d45e01c4a56f143ee69c54dd6b12eade9e270a73" + integrity sha512-8LduaNlMZGwdZ6qWrKlfa+2M4gahzFkprZiAt2TF8uS0qQgBizKXpXURqvTJ4WtmupWxaLqjRb2UCTe72mu+Aw== "@popperjs/core@^2.11.8": version "2.11.8" resolved "https://registry.yarnpkg.com/@popperjs/core/-/core-2.11.8.tgz#6b79032e760a0899cd4204710beede972a3a185f" integrity sha512-P1st0aksCrn9sGZhp8GMYwBnQsbvAWsZAX44oXNNvLHGqAOcoVxmjZiohstwQ7SqKnbR47akdNi+uleWD8+g6A== -"@redocly/ajv@^8.11.0": - version "8.11.0" - resolved "https://registry.yarnpkg.com/@redocly/ajv/-/ajv-8.11.0.tgz#2fad322888dc0113af026e08fceb3e71aae495ae" - integrity sha512-9GWx27t7xWhDIR02PA18nzBdLcKQRgc46xNQvjFkrYk4UOmvKhJ/dawwiX0cCOeetN5LcaaiqQbVOWYK62SGHw== +"@puppeteer/browsers@2.3.0": + version "2.3.0" + resolved "https://registry.yarnpkg.com/@puppeteer/browsers/-/browsers-2.3.0.tgz#791ea7d80450fea24eb19fb1d70c367ad4e08cae" + integrity sha512-ioXoq9gPxkss4MYhD+SFaU9p1IHFUX0ILAWFPyjGaBdjLsYAlZw6j1iLA0N/m12uVHLFDfSYNF7EQccjinIMDA== + dependencies: + debug "^4.3.5" + extract-zip "^2.0.1" + progress "^2.0.3" + proxy-agent "^6.4.0" + semver "^7.6.3" + tar-fs "^3.0.6" + unbzip2-stream "^1.4.3" + yargs "^17.7.2" + +"@redocly/ajv@^8.11.0", "@redocly/ajv@^8.11.2": + version "8.11.2" + resolved "https://registry.yarnpkg.com/@redocly/ajv/-/ajv-8.11.2.tgz#46e1bf321ec0ac1e0fd31dea41a3d1fcbdcda0b5" + integrity sha512-io1JpnwtIcvojV7QKDUSIuMN/ikdOUd1ReEnUnMKGfDVridQZ31J0MmIuqwuRjWDZfmvr+Q0MqCcfHM2gTivOg== dependencies: fast-deep-equal "^3.1.1" json-schema-traverse "^1.0.0" require-from-string "^2.0.2" - uri-js "^4.2.2" + uri-js-replace "^1.0.1" -"@redocly/config@^0.6.0", "@redocly/config@^0.6.2": - version "0.6.2" - resolved "https://registry.yarnpkg.com/@redocly/config/-/config-0.6.2.tgz#b5180ccb407673ee048b818c3be9a4f9d0636a64" - integrity sha512-c3K5u64eMnr2ootPcpEI0ioIRLE8QP8ptvLxG9MwAmb2sU8HMRfVwXDU3AZiMVY2w4Ts0mDc+Xv4HTIk8DRqFw== +"@redocly/config@^0.20.1": + version "0.20.1" + resolved "https://registry.yarnpkg.com/@redocly/config/-/config-0.20.1.tgz#867e187d8113d0646eab7859c7835ed0656d8315" + integrity sha512-TYiTDtuItiv95YMsrRxyCs1HKLrDPtTvpaD3+kDKXBnFDeJuYKZ+eHXpCr6YeN4inxfVBs7DLhHsQcs9srddyQ== + +"@redocly/config@^0.6.0": + version "0.6.3" + resolved "https://registry.yarnpkg.com/@redocly/config/-/config-0.6.3.tgz#0dab6278721abd5aae6b375deee97665005b0472" + integrity sha512-hGWJgCsXRw0Ow4rplqRlUQifZvoSwZipkYnt11e3SeH1Eb23VUIDBcRuaQOUqy1wn0eevXkU2GzzQ8fbKdQ7Mg== "@redocly/openapi-core@1.16.0": version "1.16.0" @@ -3103,17 +2429,16 @@ yaml-ast-parser "0.0.43" "@redocly/openapi-core@^1.4.0": - version "1.17.1" - resolved "https://registry.yarnpkg.com/@redocly/openapi-core/-/openapi-core-1.17.1.tgz#d18c5223e5b578d64d789c4101b96cbb589162dc" - integrity sha512-PQxDLLNk5cBatJBBxvfk49HFw/nVozw1XZ6Dw/GX0Tviq+WxeEjEuLAKfnLVvb5L0wgs4TNmVG4Y+JyofSPu1A== + version "1.27.2" + resolved "https://registry.yarnpkg.com/@redocly/openapi-core/-/openapi-core-1.27.2.tgz#109163901fd8a2853e805877fe234b65e3c5753a" + integrity sha512-qVrDc27DHpeO2NRCMeRdb4299nijKQE3BY0wrA+WUHlOLScorIi/y7JzammLk22IaTvjR9Mv9aTAdjE1aUwJnA== dependencies: - "@redocly/ajv" "^8.11.0" - "@redocly/config" "^0.6.2" + "@redocly/ajv" "^8.11.2" + "@redocly/config" "^0.20.1" colorette "^1.2.0" https-proxy-agent "^7.0.4" js-levenshtein "^1.1.6" js-yaml "^4.1.0" - lodash.isequal "^4.5.0" minimatch "^5.0.1" node-fetch "^2.6.1" pluralize "^8.0.0" @@ -3273,6 +2598,11 @@ dependencies: defer-to-connect "^2.0.1" +"@tootallnate/quickjs-emscripten@^0.23.0": + version "0.23.0" + resolved "https://registry.yarnpkg.com/@tootallnate/quickjs-emscripten/-/quickjs-emscripten-0.23.0.tgz#db4ecfd499a9765ab24002c3b696d02e6d32a12c" + integrity sha512-C5Mc6rdnsaJDjO3UpGW/CQTHtCKaYlScZTly4JIu97Jxo/odCiH0ITnDXSJPTOrEKk/ycSZ0AOgTmkDtkOsvIA== + "@trysound/sax@0.2.0": version "0.2.0" resolved "https://registry.yarnpkg.com/@trysound/sax/-/sax-0.2.0.tgz#cccaab758af56761eb7bf37af6f03f326dd798ad" @@ -3435,12 +2765,12 @@ resolved "https://registry.yarnpkg.com/@types/d3-random/-/d3-random-3.0.3.tgz#ed995c71ecb15e0cd31e22d9d5d23942e3300cfb" integrity sha512-Imagg1vJ3y76Y2ea0871wpabqp613+8/r0mCLEBfdtqC7xMSfj9idOnmBYyMoULfHePJyxMAw3nWhJxzc+LFwQ== -"@types/d3-scale-chromatic@*", "@types/d3-scale-chromatic@^3.0.0": - version "3.0.3" - resolved "https://registry.yarnpkg.com/@types/d3-scale-chromatic/-/d3-scale-chromatic-3.0.3.tgz#fc0db9c10e789c351f4c42d96f31f2e4df8f5644" - integrity sha512-laXM4+1o5ImZv3RpFAsTRn3TEkzqkytiOY0Dz0sq5cnd1dtNlk6sHLon4OvqaiJb28T0S/TdsBI3Sjsy+keJrw== +"@types/d3-scale-chromatic@*": + version "3.1.0" + resolved "https://registry.yarnpkg.com/@types/d3-scale-chromatic/-/d3-scale-chromatic-3.1.0.tgz#dc6d4f9a98376f18ea50bad6c39537f1b5463c39" + integrity sha512-iWMJgwkK7yTRmWqRB5plb1kadXyQ5Sj8V/zYlFGMUBbIPKQScw+Dku9cAAMgJG+z5GYDoMjWGLVOvjghDEFnKQ== -"@types/d3-scale@*", "@types/d3-scale@^4.0.3": +"@types/d3-scale@*": version "4.0.8" resolved "https://registry.yarnpkg.com/@types/d3-scale/-/d3-scale-4.0.8.tgz#d409b5f9dcf63074464bf8ddfb8ee5a1f95945bb" integrity sha512-gkK1VVTr5iNiYJ7vWDI+yUFFlszhNMtVeneJ6lUTKPjprsvLLI9/tgEGiXJOnlINJA8FyA88gfnQsHbybVZrYQ== @@ -3453,9 +2783,9 @@ integrity sha512-bhAXu23DJWsrI45xafYpkQ4NtcKMwWnAC/vKrd2l+nxMFuvOT3XMYTIj2opv8vq8AO5Yh7Qac/nSeP/3zjTK0w== "@types/d3-shape@*": - version "3.1.6" - resolved "https://registry.yarnpkg.com/@types/d3-shape/-/d3-shape-3.1.6.tgz#65d40d5a548f0a023821773e39012805e6e31a72" - integrity sha512-5KKk5aKGu2I+O6SONMYSNflgiP0WfZIQvVUMan50wHsLG1G94JlxEVnCpQARfTtzytuY0p/9PXXZb3I7giofIA== + version "3.1.7" + resolved "https://registry.yarnpkg.com/@types/d3-shape/-/d3-shape-3.1.7.tgz#2b7b423dc2dfe69c8c93596e673e37443348c555" + integrity sha512-VLvUQ33C+3J+8p+Daf+nYSOsjB4GXp19/S/aGo60m9h1v6XaxjiT82lKVWJCfzhtuZ3yD7i/TPeC/fuKLLOSmg== dependencies: "@types/d3-path" "*" @@ -3465,9 +2795,9 @@ integrity sha512-5xg9rC+wWL8kdDj153qZcsJ0FWiFt0J5RB6LYUNZjwSnesfblqrI/bJ1wBdJ8OQfncgbJG5+2F+qfqnqyzYxyg== "@types/d3-time@*": - version "3.0.3" - resolved "https://registry.yarnpkg.com/@types/d3-time/-/d3-time-3.0.3.tgz#3c186bbd9d12b9d84253b6be6487ca56b54f88be" - integrity sha512-2p6olUZ4w3s+07q3Tm2dbiMZy5pCDfYwtLXXHUnVzXgQlZ/OyPtUz6OL382BkOuGlLXqfT+wqv8Fw2v8/0geBw== + version "3.0.4" + resolved "https://registry.yarnpkg.com/@types/d3-time/-/d3-time-3.0.4.tgz#8472feecd639691450dd8000eb33edd444e1323f" + integrity sha512-yuzZug1nkAAaBlBBikKZTgzCeA+k1uy4ZFwWANOfKw5z5LRhV0gNA7gNkKm7HoK+HRN0wX3EkxGk0fpbWhmB7g== "@types/d3-timer@*": version "3.0.2" @@ -3532,13 +2862,6 @@ dependencies: "@types/ms" "*" -"@types/dompurify@^3.0.5": - version "3.0.5" - resolved "https://registry.yarnpkg.com/@types/dompurify/-/dompurify-3.0.5.tgz#02069a2fcb89a163bacf1a788f73cb415dd75cb7" - integrity sha512-1Wg0g3BtQF7sSb27fJQAKck1HECM6zV1EB66j8JH9i3LCjYabJa0FSdiSgsD5K/RbrsR0SiraKacLB+T8ZVYAg== - dependencies: - "@types/trusted-types" "*" - "@types/eslint-scope@^3.7.7": version "3.7.7" resolved "https://registry.yarnpkg.com/@types/eslint-scope/-/eslint-scope-3.7.7.tgz#3108bd5f18b0cdb277c867b3dd449c9ed7079ac5" @@ -3562,27 +2885,42 @@ dependencies: "@types/estree" "*" -"@types/estree@*", "@types/estree@^1.0.0", "@types/estree@^1.0.5": - version "1.0.5" - resolved "https://registry.yarnpkg.com/@types/estree/-/estree-1.0.5.tgz#a6ce3e556e00fd9895dd872dd172ad0d4bd687f4" - integrity sha512-/kYRxGDLWzHOB7q+wtSUQlFrtcdUccpfy+X+9iMBpHK8QLLhx2wIPYuS5DYtR9Wa/YlZAbIovy7qVdB1Aq6Lyw== - -"@types/estree@^1.0.6": +"@types/estree@*", "@types/estree@^1.0.0", "@types/estree@^1.0.6": version "1.0.6" resolved "https://registry.yarnpkg.com/@types/estree/-/estree-1.0.6.tgz#628effeeae2064a1b4e79f78e81d87b7e5fc7b50" integrity sha512-AYnb1nQyY49te+VRAVgmzfcgjYS91mY5P0TKUDCLEM+gNnA+3T6rWITXRLYCpahpqSQbN5cE+gHpnPyXjHWxcw== -"@types/express-serve-static-core@*", "@types/express-serve-static-core@^4.17.33": - version "4.19.5" - resolved "https://registry.yarnpkg.com/@types/express-serve-static-core/-/express-serve-static-core-4.19.5.tgz#218064e321126fcf9048d1ca25dd2465da55d9c6" - integrity sha512-y6W03tvrACO72aijJ5uF02FRq5cgDR9lUxddQ8vyF+GvmjJQqbzDcJngEjURc+ZsG31VI3hODNZJ2URj86pzmg== +"@types/express-serve-static-core@*", "@types/express-serve-static-core@^5.0.0": + version "5.0.5" + resolved "https://registry.yarnpkg.com/@types/express-serve-static-core/-/express-serve-static-core-5.0.5.tgz#f6a851c7fd512e5da087f6f20d29f44b162a6a95" + integrity sha512-GLZPrd9ckqEBFMcVM/qRFAP0Hg3qiVEojgEFsx/N/zKXsBzbGF6z5FBDpZ0+Xhp1xr+qRZYjfGr1cWHB9oFHSA== + dependencies: + "@types/node" "*" + "@types/qs" "*" + "@types/range-parser" "*" + "@types/send" "*" + +"@types/express-serve-static-core@^4.17.33": + version "4.19.6" + resolved "https://registry.yarnpkg.com/@types/express-serve-static-core/-/express-serve-static-core-4.19.6.tgz#e01324c2a024ff367d92c66f48553ced0ab50267" + integrity sha512-N4LZ2xG7DatVqhCZzOGb1Yi5lMbXSZcmdLDe9EzSndPV2HpWYWzRbaerl2n27irrm94EPpprqa8KpskPT085+A== dependencies: "@types/node" "*" "@types/qs" "*" "@types/range-parser" "*" "@types/send" "*" -"@types/express@*", "@types/express@^4.17.13": +"@types/express@*": + version "5.0.0" + resolved "https://registry.yarnpkg.com/@types/express/-/express-5.0.0.tgz#13a7d1f75295e90d19ed6e74cab3678488eaa96c" + integrity sha512-DvZriSMehGHL1ZNLzi6MidnsDhUZM/x2pRdDIKdwbUNqqwHxMlRdkxtn6/EPKyqKpHqTl/4nRZsRNLpZxZRpPQ== + dependencies: + "@types/body-parser" "*" + "@types/express-serve-static-core" "^5.0.0" + "@types/qs" "*" + "@types/serve-static" "*" + +"@types/express@^4.17.13": version "4.17.21" resolved "https://registry.yarnpkg.com/@types/express/-/express-4.17.21.tgz#c26d4a151e60efe0084b23dc3369ebc631ed192d" integrity sha512-ejlPM315qwLpaQlQDTjPdsUFSc6ZsP4AN6AlWnogPjQ7CVi7PYF3YVz+CY3jE2pwYf7E/7HlDAN0rV2GxTG0HQ== @@ -3592,15 +2930,15 @@ "@types/qs" "*" "@types/serve-static" "*" -"@types/format-util@^1.0.3": +"@types/format-util@^1.0.4": version "1.0.4" resolved "https://registry.yarnpkg.com/@types/format-util/-/format-util-1.0.4.tgz#c4e3b556735149fdf047898a5b9c04650491509b" integrity sha512-xrCYOdHh5zA3LUrn6CvspYwlzSWxPso11Lx32WnAG6KvLCRecKZ/Rh21PLXUkzUFsQmrGcx/traJAFjR6dVS5Q== "@types/geojson@*": - version "7946.0.14" - resolved "https://registry.yarnpkg.com/@types/geojson/-/geojson-7946.0.14.tgz#319b63ad6df705ee2a65a73ef042c8271e696613" - integrity sha512-WCfD5Ht3ZesJUsONdhvm84dmzWOiOzOAqOncN0++w0lBw1o8OuDNJF2McvvCef/yBqb/HYRahp1BYtODFQ8bRg== + version "7946.0.15" + resolved "https://registry.yarnpkg.com/@types/geojson/-/geojson-7946.0.15.tgz#f9d55fd5a0aa2de9dc80b1b04e437538b7298868" + integrity sha512-9oSxFzDCT2Rj6DfcHF8G++jxBKS7mBqXl5xrRW+Kbvjry6Uduya2iiwqHPhVXpasAVMBYKkEPGgKhd3+/HZ6xA== "@types/gtag.js@^0.0.12": version "0.0.12" @@ -3642,9 +2980,9 @@ integrity sha512-D0CFMMtydbJAegzOyHjtiKPLlvnm3iTZyZRSZoLq2mRhDdmLfIWOCYPfQJ4cu2erKghU++QvjcUjp/5h7hESpA== "@types/http-proxy@^1.17.8": - version "1.17.14" - resolved "https://registry.yarnpkg.com/@types/http-proxy/-/http-proxy-1.17.14.tgz#57f8ccaa1c1c3780644f8a94f9c6b5000b5e2eec" - integrity sha512-SSrD0c1OQzlFX7pGu1eXxSEjemej64aaNPRhhVYUGqXh0BtldAAx37MG8btcumvpgKyZp1F5Gn3JkktdxiFv6w== + version "1.17.15" + resolved "https://registry.yarnpkg.com/@types/http-proxy/-/http-proxy-1.17.15.tgz#12118141ce9775a6499ecb4c01d02f90fc839d36" + integrity sha512-25g5atgiVNTIv0LBDTg1H74Hvayx0ajtJPLLcYE3whFv75J0pWNtOBzaXJQgDTmrX1bx5U9YC2w/n65BN1HwRQ== dependencies: "@types/node" "*" @@ -3697,9 +3035,9 @@ integrity sha512-/pyBZWSLD2n0dcHE3hq8s8ZvcETHtEuF+3E7XVt0Ig2nvsVQXdghHVcEkIWjy9A0wKfTn97a/PSDYohKIlnP/w== "@types/ms@*": - version "0.7.34" - resolved "https://registry.yarnpkg.com/@types/ms/-/ms-0.7.34.tgz#10964ba0dee6ac4cd462e2795b6bebd407303433" - integrity sha512-nG96G3Wp6acyAgJqGasjODb+acrI7KltPiRxzHPXnP3NgI28bpQDRv53olbqGXbfcgF5aiiHmO3xpwEpS5Ld9g== + version "2.1.0" + resolved "https://registry.yarnpkg.com/@types/ms/-/ms-2.1.0.tgz#052aa67a48eccc4309d7f0191b7e41434b90bb78" + integrity sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA== "@types/node-forge@^1.3.0": version "1.3.11" @@ -3709,11 +3047,11 @@ "@types/node" "*" "@types/node@*": - version "20.14.10" - resolved "https://registry.yarnpkg.com/@types/node/-/node-20.14.10.tgz#a1a218290f1b6428682e3af044785e5874db469a" - integrity sha512-MdiXf+nDuMvY0gJKxyfZ7/6UFsETO7mGKF54MVD/ekJS6HdFtpZFBgrh6Pseu64XTb2MLyFPlbW6hj8HYRQNOQ== + version "22.10.7" + resolved "https://registry.yarnpkg.com/@types/node/-/node-22.10.7.tgz#14a1ca33fd0ebdd9d63593ed8d3fbc882a6d28d7" + integrity sha512-V09KvXxFiutGp6B7XkpaDXlNadZxrzajcY50EuoLIpQ6WWYCSvf19lVIazzfIzQvhUN2HjX12spLojTnhuKlGg== dependencies: - undici-types "~5.26.4" + undici-types "~6.20.0" "@types/node@^17.0.5": version "17.0.45" @@ -3726,19 +3064,19 @@ integrity sha512-dISoDXWWQwUquiKsyZ4Ng+HX2KsPL7LyHKHQwgGFEA3IaKac4Obd+h2a/a6waisAoepJlBcx9paWqjA8/HVjCw== "@types/prismjs@^1.26.0": - version "1.26.4" - resolved "https://registry.yarnpkg.com/@types/prismjs/-/prismjs-1.26.4.tgz#1a9e1074619ce1d7322669e5b46fbe823925103a" - integrity sha512-rlAnzkW2sZOjbqZ743IHUhFcvzaGbqijwOu8QZnZCjfQzBqFE3s4lOTJEsxikImav9uzz/42I+O7YUs1mWgMlg== + version "1.26.5" + resolved "https://registry.yarnpkg.com/@types/prismjs/-/prismjs-1.26.5.tgz#72499abbb4c4ec9982446509d2f14fb8483869d6" + integrity sha512-AUZTa7hQ2KY5L7AmtSiqxlhWxb4ina0yd8hNbl4TWuqnv/pFP0nDMb3YrfSBf4hJVGLh2YEIBfKaBW/9UEl6IQ== -"@types/prop-types@*", "@types/prop-types@^15.7.11": - version "15.7.12" - resolved "https://registry.yarnpkg.com/@types/prop-types/-/prop-types-15.7.12.tgz#12bb1e2be27293c1406acb6af1c3f3a1481d98c6" - integrity sha512-5zvhXYtRNRluoE/jAp4GVsSduVUzNWKkOZrCDBWYtE7biZywwdC2AcEzg+cSMLFRfVgeAFqpfNabiPjxFddV1Q== +"@types/prop-types@^15.7.14": + version "15.7.14" + resolved "https://registry.yarnpkg.com/@types/prop-types/-/prop-types-15.7.14.tgz#1433419d73b2a7ebfc6918dcefd2ec0d5cd698f2" + integrity sha512-gNMvNH49DJ7OJYv+KAKn0Xp45p8PLl6zo2YnvDIbTd4J6MER2BmWN49TG7n9LvkyihINxeKW8+3bfS2yDC9dzQ== "@types/qs@*": - version "6.9.15" - resolved "https://registry.yarnpkg.com/@types/qs/-/qs-6.9.15.tgz#adde8a060ec9c305a82de1babc1056e73bd64dce" - integrity sha512-uXHQKES6DQKKCLh441Xv/dwxOq1TVS3JPUMlEqoEglvlhR6Mxnlew/Xq/LRVHpLyk7iK3zODe1qYHIMltO7XGg== + version "6.9.18" + resolved "https://registry.yarnpkg.com/@types/qs/-/qs-6.9.18.tgz#877292caa91f7c1b213032b34626505b746624c2" + integrity sha512-kK7dgTYDyGqS+e2Q4aK9X3D7q234CIZ1Bv0q/7Z5IwRDoADNU81xXJK/YVyLbLTZCoIwUoDoffFeF+p/eIklAA== "@types/range-parser@*": version "1.2.7" @@ -3771,19 +3109,16 @@ "@types/history" "^4.7.11" "@types/react" "*" -"@types/react-transition-group@^4.4.10": - version "4.4.10" - resolved "https://registry.yarnpkg.com/@types/react-transition-group/-/react-transition-group-4.4.10.tgz#6ee71127bdab1f18f11ad8fb3322c6da27c327ac" - integrity sha512-hT/+s0VQs2ojCX823m60m5f0sL5idt9SO6Tj6Dg+rdphGPIeJbJ6CxvBYkgkGKrYeDjvIpKTR38UzmtHJOGW3Q== - dependencies: - "@types/react" "*" +"@types/react-transition-group@^4.4.12": + version "4.4.12" + resolved "https://registry.yarnpkg.com/@types/react-transition-group/-/react-transition-group-4.4.12.tgz#b5d76568485b02a307238270bfe96cb51ee2a044" + integrity sha512-8TV6R3h2j7a91c+1DXdJi3Syo69zzIZbz7Lg5tORM5LEJG7X/E6a1V3drRyBRZq7/utz7A+c4OgYLiLcYGHG6w== "@types/react@*": - version "18.3.3" - resolved "https://registry.yarnpkg.com/@types/react/-/react-18.3.3.tgz#9679020895318b0915d7a3ab004d92d33375c45f" - integrity sha512-hti/R0pS0q1/xx+TsI73XIqk26eBsISZ2R0wUijXIngRK9R/e7Xw/cXVxQK7R5JjW+SV4zGcn5hXjudkN/pLIw== + version "19.0.7" + resolved "https://registry.yarnpkg.com/@types/react/-/react-19.0.7.tgz#c451968b999d1cb2d9207dc5ff56496164cf511d" + integrity sha512-MoFsEJKkAtZCrC1r6CM8U22GzhG7u2Wir8ons/aCKH6MBdD1ibV24zOSSkdZVUKqN5i396zG5VKLYZ3yaUZdLA== dependencies: - "@types/prop-types" "*" csstype "^3.0.2" "@types/retry@0.12.0": @@ -3834,25 +3169,30 @@ resolved "https://registry.yarnpkg.com/@types/stylis/-/stylis-4.2.5.tgz#1daa6456f40959d06157698a653a9ab0a70281df" integrity sha512-1Xve+NMN7FWjY14vLoY5tL3BVEQ/n42YLwaqJIPYhotZ9uBHt87VceMwWQpzmdEt2TNXIorIFG+YeCUUW7RInw== -"@types/trusted-types@*": +"@types/trusted-types@^2.0.7": version "2.0.7" resolved "https://registry.yarnpkg.com/@types/trusted-types/-/trusted-types-2.0.7.tgz#baccb07a970b91707df3a3e8ba6896c57ead2d11" integrity sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw== "@types/unist@*", "@types/unist@^3.0.0": - version "3.0.2" - resolved "https://registry.yarnpkg.com/@types/unist/-/unist-3.0.2.tgz#6dd61e43ef60b34086287f83683a5c1b2dc53d20" - integrity sha512-dqId9J8K/vGi5Zr7oo212BGii5m3q5Hxlkwy3WpYuKPklmBEvsbMYYyLxAQpSffdLl/gdW0XUpKWFvYmyoWCoQ== + version "3.0.3" + resolved "https://registry.yarnpkg.com/@types/unist/-/unist-3.0.3.tgz#acaab0f919ce69cce629c2d4ed2eb4adc1b6c20c" + integrity sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q== -"@types/unist@^2", "@types/unist@^2.0.0": +"@types/unist@^2": version "2.0.10" resolved "https://registry.yarnpkg.com/@types/unist/-/unist-2.0.10.tgz#04ffa7f406ab628f7f7e97ca23e290cd8ab15efc" integrity sha512-IfYcSBWE3hLpBg8+X2SEa8LVkJdJEkT2Ese2aaLs3ptGdVtABxndrMaxuFlQ1qdFf9Q5rDvDpxI3WwgvKFAsQA== +"@types/unist@^2.0.0": + version "2.0.11" + resolved "https://registry.yarnpkg.com/@types/unist/-/unist-2.0.11.tgz#11af57b127e32487774841f7a4e54eab166d03c4" + integrity sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA== + "@types/ws@^8.5.5": - version "8.5.10" - resolved "https://registry.yarnpkg.com/@types/ws/-/ws-8.5.10.tgz#4acfb517970853fa6574a3a6886791d04a396787" - integrity sha512-vmQSUcfalpIq0R9q7uTo2lXs6eGIpt9wtnLdMv9LVpIjCA/+ufZRozlVoVelIYixx1ugCBKDhn89vnsEGOCx9A== + version "8.5.13" + resolved "https://registry.yarnpkg.com/@types/ws/-/ws-8.5.13.tgz#6414c280875e2691d0d1e080b05addbf5cb91e20" + integrity sha512-osM/gWBTPKgHV8XkTunnegTRIsvF6owmf5w+JtAfOw472dptdm0dlGv4xCt6GwQRcC2XVOvvRE/0bAoQcL2QkA== dependencies: "@types/node" "*" @@ -3862,9 +3202,9 @@ integrity sha512-I4q9QU9MQv4oEOz4tAHJtNz1cwuLxn2F3xcc2iV5WdqLPpUnj30aUuxt1mAxYTG+oe8CZMV/+6rU4S4gRDzqtQ== "@types/yargs@^17.0.8": - version "17.0.32" - resolved "https://registry.yarnpkg.com/@types/yargs/-/yargs-17.0.32.tgz#030774723a2f7faafebf645f4e5a48371dca6229" - integrity sha512-xQ67Yc/laOG5uMfX/093MRlGGCIBzZMarVa+gfNKJxWAIgykYpVGkBdbqEzGDDfCrVUj6Hiff4mTZ5BA6TmAog== + version "17.0.33" + resolved "https://registry.yarnpkg.com/@types/yargs/-/yargs-17.0.33.tgz#8c32303da83eec050a84b3c7ae7b9f922d13e32d" + integrity sha512-WpxBCKWPLr4xSsHgz511rFJAM+wS28w2zEO1QDNY5zM/S8ok70NNfztH0xwhqKyaK0OHCbN98LDAZuy1ctxDkA== dependencies: "@types/yargs-parser" "*" @@ -3876,129 +3216,129 @@ "@types/node" "*" "@ungap/structured-clone@^1.0.0": - version "1.2.0" - resolved "https://registry.yarnpkg.com/@ungap/structured-clone/-/structured-clone-1.2.0.tgz#756641adb587851b5ccb3e095daf27ae581c8406" - integrity sha512-zuVdFrMJiuCDQUMCzQaD6KL28MjnqqN8XnAqiEq9PNm/hCPTSGfrXCOfwj1ow4LFb/tNymJPwsNbVePc1xFqrQ== - -"@webassemblyjs/ast@1.12.1", "@webassemblyjs/ast@^1.12.1": - version "1.12.1" - resolved "https://registry.yarnpkg.com/@webassemblyjs/ast/-/ast-1.12.1.tgz#bb16a0e8b1914f979f45864c23819cc3e3f0d4bb" - integrity sha512-EKfMUOPRRUTy5UII4qJDGPpqfwjOmZ5jeGFwid9mnoqIFK+e0vqoi1qH56JpmZSzEL53jKnNzScdmftJyG5xWg== - dependencies: - "@webassemblyjs/helper-numbers" "1.11.6" - "@webassemblyjs/helper-wasm-bytecode" "1.11.6" - -"@webassemblyjs/floating-point-hex-parser@1.11.6": - version "1.11.6" - resolved "https://registry.yarnpkg.com/@webassemblyjs/floating-point-hex-parser/-/floating-point-hex-parser-1.11.6.tgz#dacbcb95aff135c8260f77fa3b4c5fea600a6431" - integrity sha512-ejAj9hfRJ2XMsNHk/v6Fu2dGS+i4UaXBXGemOfQ/JfQ6mdQg/WXtwleQRLLS4OvfDhv8rYnVwH27YJLMyYsxhw== - -"@webassemblyjs/helper-api-error@1.11.6": - version "1.11.6" - resolved "https://registry.yarnpkg.com/@webassemblyjs/helper-api-error/-/helper-api-error-1.11.6.tgz#6132f68c4acd59dcd141c44b18cbebbd9f2fa768" - integrity sha512-o0YkoP4pVu4rN8aTJgAyj9hC2Sv5UlkzCHhxqWj8butaLvnpdc2jOwh4ewE6CX0txSfLn/UYaV/pheS2Txg//Q== - -"@webassemblyjs/helper-buffer@1.12.1": - version "1.12.1" - resolved "https://registry.yarnpkg.com/@webassemblyjs/helper-buffer/-/helper-buffer-1.12.1.tgz#6df20d272ea5439bf20ab3492b7fb70e9bfcb3f6" - integrity sha512-nzJwQw99DNDKr9BVCOZcLuJJUlqkJh+kVzVl6Fmq/tI5ZtEyWT1KZMyOXltXLZJmDtvLCDgwsyrkohEtopTXCw== - -"@webassemblyjs/helper-numbers@1.11.6": - version "1.11.6" - resolved "https://registry.yarnpkg.com/@webassemblyjs/helper-numbers/-/helper-numbers-1.11.6.tgz#cbce5e7e0c1bd32cf4905ae444ef64cea919f1b5" - integrity sha512-vUIhZ8LZoIWHBohiEObxVm6hwP034jwmc9kuq5GdHZH0wiLVLIPcMCdpJzG4C11cHoQ25TFIQj9kaVADVX7N3g== - dependencies: - "@webassemblyjs/floating-point-hex-parser" "1.11.6" - "@webassemblyjs/helper-api-error" "1.11.6" + version "1.2.1" + resolved "https://registry.yarnpkg.com/@ungap/structured-clone/-/structured-clone-1.2.1.tgz#28fa185f67daaf7b7a1a8c1d445132c5d979f8bd" + integrity sha512-fEzPV3hSkSMltkw152tJKNARhOupqbH96MZWyRjNaYZOMIzbrTeQDG+MTc6Mr2pgzFQzFxAfmhGDNP5QK++2ZA== + +"@webassemblyjs/ast@1.14.1", "@webassemblyjs/ast@^1.14.1": + version "1.14.1" + resolved "https://registry.yarnpkg.com/@webassemblyjs/ast/-/ast-1.14.1.tgz#a9f6a07f2b03c95c8d38c4536a1fdfb521ff55b6" + integrity sha512-nuBEDgQfm1ccRp/8bCQrx1frohyufl4JlbMMZ4P1wpeOfDhF6FQkxZJ1b/e+PLwr6X1Nhw6OLme5usuBWYBvuQ== + dependencies: + "@webassemblyjs/helper-numbers" "1.13.2" + "@webassemblyjs/helper-wasm-bytecode" "1.13.2" + +"@webassemblyjs/floating-point-hex-parser@1.13.2": + version "1.13.2" + resolved "https://registry.yarnpkg.com/@webassemblyjs/floating-point-hex-parser/-/floating-point-hex-parser-1.13.2.tgz#fcca1eeddb1cc4e7b6eed4fc7956d6813b21b9fb" + integrity sha512-6oXyTOzbKxGH4steLbLNOu71Oj+C8Lg34n6CqRvqfS2O71BxY6ByfMDRhBytzknj9yGUPVJ1qIKhRlAwO1AovA== + +"@webassemblyjs/helper-api-error@1.13.2": + version "1.13.2" + resolved "https://registry.yarnpkg.com/@webassemblyjs/helper-api-error/-/helper-api-error-1.13.2.tgz#e0a16152248bc38daee76dd7e21f15c5ef3ab1e7" + integrity sha512-U56GMYxy4ZQCbDZd6JuvvNV/WFildOjsaWD3Tzzvmw/mas3cXzRJPMjP83JqEsgSbyrmaGjBfDtV7KDXV9UzFQ== + +"@webassemblyjs/helper-buffer@1.14.1": + version "1.14.1" + resolved "https://registry.yarnpkg.com/@webassemblyjs/helper-buffer/-/helper-buffer-1.14.1.tgz#822a9bc603166531f7d5df84e67b5bf99b72b96b" + integrity sha512-jyH7wtcHiKssDtFPRB+iQdxlDf96m0E39yb0k5uJVhFGleZFoNw1c4aeIcVUPPbXUVJ94wwnMOAqUHyzoEPVMA== + +"@webassemblyjs/helper-numbers@1.13.2": + version "1.13.2" + resolved "https://registry.yarnpkg.com/@webassemblyjs/helper-numbers/-/helper-numbers-1.13.2.tgz#dbd932548e7119f4b8a7877fd5a8d20e63490b2d" + integrity sha512-FE8aCmS5Q6eQYcV3gI35O4J789wlQA+7JrqTTpJqn5emA4U2hvwJmvFRC0HODS+3Ye6WioDklgd6scJ3+PLnEA== + dependencies: + "@webassemblyjs/floating-point-hex-parser" "1.13.2" + "@webassemblyjs/helper-api-error" "1.13.2" "@xtuc/long" "4.2.2" -"@webassemblyjs/helper-wasm-bytecode@1.11.6": - version "1.11.6" - resolved "https://registry.yarnpkg.com/@webassemblyjs/helper-wasm-bytecode/-/helper-wasm-bytecode-1.11.6.tgz#bb2ebdb3b83aa26d9baad4c46d4315283acd51e9" - integrity sha512-sFFHKwcmBprO9e7Icf0+gddyWYDViL8bpPjJJl0WHxCdETktXdmtWLGVzoHbqUcY4Be1LkNfwTmXOJUFZYSJdA== +"@webassemblyjs/helper-wasm-bytecode@1.13.2": + version "1.13.2" + resolved "https://registry.yarnpkg.com/@webassemblyjs/helper-wasm-bytecode/-/helper-wasm-bytecode-1.13.2.tgz#e556108758f448aae84c850e593ce18a0eb31e0b" + integrity sha512-3QbLKy93F0EAIXLh0ogEVR6rOubA9AoZ+WRYhNbFyuB70j3dRdwH9g+qXhLAO0kiYGlg3TxDV+I4rQTr/YNXkA== -"@webassemblyjs/helper-wasm-section@1.12.1": - version "1.12.1" - resolved "https://registry.yarnpkg.com/@webassemblyjs/helper-wasm-section/-/helper-wasm-section-1.12.1.tgz#3da623233ae1a60409b509a52ade9bc22a37f7bf" - integrity sha512-Jif4vfB6FJlUlSbgEMHUyk1j234GTNG9dBJ4XJdOySoj518Xj0oGsNi59cUQF4RRMS9ouBUxDDdyBVfPTypa5g== +"@webassemblyjs/helper-wasm-section@1.14.1": + version "1.14.1" + resolved "https://registry.yarnpkg.com/@webassemblyjs/helper-wasm-section/-/helper-wasm-section-1.14.1.tgz#9629dda9c4430eab54b591053d6dc6f3ba050348" + integrity sha512-ds5mXEqTJ6oxRoqjhWDU83OgzAYjwsCV8Lo/N+oRsNDmx/ZDpqalmrtgOMkHwxsG0iI//3BwWAErYRHtgn0dZw== dependencies: - "@webassemblyjs/ast" "1.12.1" - "@webassemblyjs/helper-buffer" "1.12.1" - "@webassemblyjs/helper-wasm-bytecode" "1.11.6" - "@webassemblyjs/wasm-gen" "1.12.1" + "@webassemblyjs/ast" "1.14.1" + "@webassemblyjs/helper-buffer" "1.14.1" + "@webassemblyjs/helper-wasm-bytecode" "1.13.2" + "@webassemblyjs/wasm-gen" "1.14.1" -"@webassemblyjs/ieee754@1.11.6": - version "1.11.6" - resolved "https://registry.yarnpkg.com/@webassemblyjs/ieee754/-/ieee754-1.11.6.tgz#bb665c91d0b14fffceb0e38298c329af043c6e3a" - integrity sha512-LM4p2csPNvbij6U1f19v6WR56QZ8JcHg3QIJTlSwzFcmx6WSORicYj6I63f9yU1kEUtrpG+kjkiIAkevHpDXrg== +"@webassemblyjs/ieee754@1.13.2": + version "1.13.2" + resolved "https://registry.yarnpkg.com/@webassemblyjs/ieee754/-/ieee754-1.13.2.tgz#1c5eaace1d606ada2c7fd7045ea9356c59ee0dba" + integrity sha512-4LtOzh58S/5lX4ITKxnAK2USuNEvpdVV9AlgGQb8rJDHaLeHciwG4zlGr0j/SNWlr7x3vO1lDEsuePvtcDNCkw== dependencies: "@xtuc/ieee754" "^1.2.0" -"@webassemblyjs/leb128@1.11.6": - version "1.11.6" - resolved "https://registry.yarnpkg.com/@webassemblyjs/leb128/-/leb128-1.11.6.tgz#70e60e5e82f9ac81118bc25381a0b283893240d7" - integrity sha512-m7a0FhE67DQXgouf1tbN5XQcdWoNgaAuoULHIfGFIEVKA6tu/edls6XnIlkmS6FrXAquJRPni3ZZKjw6FSPjPQ== +"@webassemblyjs/leb128@1.13.2": + version "1.13.2" + resolved "https://registry.yarnpkg.com/@webassemblyjs/leb128/-/leb128-1.13.2.tgz#57c5c3deb0105d02ce25fa3fd74f4ebc9fd0bbb0" + integrity sha512-Lde1oNoIdzVzdkNEAWZ1dZ5orIbff80YPdHx20mrHwHrVNNTjNr8E3xz9BdpcGqRQbAEa+fkrCb+fRFTl/6sQw== dependencies: "@xtuc/long" "4.2.2" -"@webassemblyjs/utf8@1.11.6": - version "1.11.6" - resolved "https://registry.yarnpkg.com/@webassemblyjs/utf8/-/utf8-1.11.6.tgz#90f8bc34c561595fe156603be7253cdbcd0fab5a" - integrity sha512-vtXf2wTQ3+up9Zsg8sa2yWiQpzSsMyXj0qViVP6xKGCUT8p8YJ6HqI7l5eCnWx1T/FYdsv07HQs2wTFbbof/RA== - -"@webassemblyjs/wasm-edit@^1.12.1": - version "1.12.1" - resolved "https://registry.yarnpkg.com/@webassemblyjs/wasm-edit/-/wasm-edit-1.12.1.tgz#9f9f3ff52a14c980939be0ef9d5df9ebc678ae3b" - integrity sha512-1DuwbVvADvS5mGnXbE+c9NfA8QRcZ6iKquqjjmR10k6o+zzsRVesil54DKexiowcFCPdr/Q0qaMgB01+SQ1u6g== - dependencies: - "@webassemblyjs/ast" "1.12.1" - "@webassemblyjs/helper-buffer" "1.12.1" - "@webassemblyjs/helper-wasm-bytecode" "1.11.6" - "@webassemblyjs/helper-wasm-section" "1.12.1" - "@webassemblyjs/wasm-gen" "1.12.1" - "@webassemblyjs/wasm-opt" "1.12.1" - "@webassemblyjs/wasm-parser" "1.12.1" - "@webassemblyjs/wast-printer" "1.12.1" - -"@webassemblyjs/wasm-gen@1.12.1": - version "1.12.1" - resolved "https://registry.yarnpkg.com/@webassemblyjs/wasm-gen/-/wasm-gen-1.12.1.tgz#a6520601da1b5700448273666a71ad0a45d78547" - integrity sha512-TDq4Ojh9fcohAw6OIMXqiIcTq5KUXTGRkVxbSo1hQnSy6lAM5GSdfwWeSxpAo0YzgsgF182E/U0mDNhuA0tW7w== - dependencies: - "@webassemblyjs/ast" "1.12.1" - "@webassemblyjs/helper-wasm-bytecode" "1.11.6" - "@webassemblyjs/ieee754" "1.11.6" - "@webassemblyjs/leb128" "1.11.6" - "@webassemblyjs/utf8" "1.11.6" - -"@webassemblyjs/wasm-opt@1.12.1": - version "1.12.1" - resolved "https://registry.yarnpkg.com/@webassemblyjs/wasm-opt/-/wasm-opt-1.12.1.tgz#9e6e81475dfcfb62dab574ac2dda38226c232bc5" - integrity sha512-Jg99j/2gG2iaz3hijw857AVYekZe2SAskcqlWIZXjji5WStnOpVoat3gQfT/Q5tb2djnCjBtMocY/Su1GfxPBg== - dependencies: - "@webassemblyjs/ast" "1.12.1" - "@webassemblyjs/helper-buffer" "1.12.1" - "@webassemblyjs/wasm-gen" "1.12.1" - "@webassemblyjs/wasm-parser" "1.12.1" - -"@webassemblyjs/wasm-parser@1.12.1", "@webassemblyjs/wasm-parser@^1.12.1": - version "1.12.1" - resolved "https://registry.yarnpkg.com/@webassemblyjs/wasm-parser/-/wasm-parser-1.12.1.tgz#c47acb90e6f083391e3fa61d113650eea1e95937" - integrity sha512-xikIi7c2FHXysxXe3COrVUPSheuBtpcfhbpFj4gmu7KRLYOzANztwUU0IbsqvMqzuNK2+glRGWCEqZo1WCLyAQ== - dependencies: - "@webassemblyjs/ast" "1.12.1" - "@webassemblyjs/helper-api-error" "1.11.6" - "@webassemblyjs/helper-wasm-bytecode" "1.11.6" - "@webassemblyjs/ieee754" "1.11.6" - "@webassemblyjs/leb128" "1.11.6" - "@webassemblyjs/utf8" "1.11.6" - -"@webassemblyjs/wast-printer@1.12.1": - version "1.12.1" - resolved "https://registry.yarnpkg.com/@webassemblyjs/wast-printer/-/wast-printer-1.12.1.tgz#bcecf661d7d1abdaf989d8341a4833e33e2b31ac" - integrity sha512-+X4WAlOisVWQMikjbcvY2e0rwPsKQ9F688lksZhBcPycBBuii3O7m8FACbDMWDojpAqvjIncrG8J0XHKyQfVeA== - dependencies: - "@webassemblyjs/ast" "1.12.1" +"@webassemblyjs/utf8@1.13.2": + version "1.13.2" + resolved "https://registry.yarnpkg.com/@webassemblyjs/utf8/-/utf8-1.13.2.tgz#917a20e93f71ad5602966c2d685ae0c6c21f60f1" + integrity sha512-3NQWGjKTASY1xV5m7Hr0iPeXD9+RDobLll3T9d2AO+g3my8xy5peVyjSag4I50mR1bBSN/Ct12lo+R9tJk0NZQ== + +"@webassemblyjs/wasm-edit@^1.14.1": + version "1.14.1" + resolved "https://registry.yarnpkg.com/@webassemblyjs/wasm-edit/-/wasm-edit-1.14.1.tgz#ac6689f502219b59198ddec42dcd496b1004d597" + integrity sha512-RNJUIQH/J8iA/1NzlE4N7KtyZNHi3w7at7hDjvRNm5rcUXa00z1vRz3glZoULfJ5mpvYhLybmVcwcjGrC1pRrQ== + dependencies: + "@webassemblyjs/ast" "1.14.1" + "@webassemblyjs/helper-buffer" "1.14.1" + "@webassemblyjs/helper-wasm-bytecode" "1.13.2" + "@webassemblyjs/helper-wasm-section" "1.14.1" + "@webassemblyjs/wasm-gen" "1.14.1" + "@webassemblyjs/wasm-opt" "1.14.1" + "@webassemblyjs/wasm-parser" "1.14.1" + "@webassemblyjs/wast-printer" "1.14.1" + +"@webassemblyjs/wasm-gen@1.14.1": + version "1.14.1" + resolved "https://registry.yarnpkg.com/@webassemblyjs/wasm-gen/-/wasm-gen-1.14.1.tgz#991e7f0c090cb0bb62bbac882076e3d219da9570" + integrity sha512-AmomSIjP8ZbfGQhumkNvgC33AY7qtMCXnN6bL2u2Js4gVCg8fp735aEiMSBbDR7UQIj90n4wKAFUSEd0QN2Ukg== + dependencies: + "@webassemblyjs/ast" "1.14.1" + "@webassemblyjs/helper-wasm-bytecode" "1.13.2" + "@webassemblyjs/ieee754" "1.13.2" + "@webassemblyjs/leb128" "1.13.2" + "@webassemblyjs/utf8" "1.13.2" + +"@webassemblyjs/wasm-opt@1.14.1": + version "1.14.1" + resolved "https://registry.yarnpkg.com/@webassemblyjs/wasm-opt/-/wasm-opt-1.14.1.tgz#e6f71ed7ccae46781c206017d3c14c50efa8106b" + integrity sha512-PTcKLUNvBqnY2U6E5bdOQcSM+oVP/PmrDY9NzowJjislEjwP/C4an2303MCVS2Mg9d3AJpIGdUFIQQWbPds0Sw== + dependencies: + "@webassemblyjs/ast" "1.14.1" + "@webassemblyjs/helper-buffer" "1.14.1" + "@webassemblyjs/wasm-gen" "1.14.1" + "@webassemblyjs/wasm-parser" "1.14.1" + +"@webassemblyjs/wasm-parser@1.14.1", "@webassemblyjs/wasm-parser@^1.14.1": + version "1.14.1" + resolved "https://registry.yarnpkg.com/@webassemblyjs/wasm-parser/-/wasm-parser-1.14.1.tgz#b3e13f1893605ca78b52c68e54cf6a865f90b9fb" + integrity sha512-JLBl+KZ0R5qB7mCnud/yyX08jWFw5MsoalJ1pQ4EdFlgj9VdXKGuENGsiCIjegI1W7p91rUlcB/LB5yRJKNTcQ== + dependencies: + "@webassemblyjs/ast" "1.14.1" + "@webassemblyjs/helper-api-error" "1.13.2" + "@webassemblyjs/helper-wasm-bytecode" "1.13.2" + "@webassemblyjs/ieee754" "1.13.2" + "@webassemblyjs/leb128" "1.13.2" + "@webassemblyjs/utf8" "1.13.2" + +"@webassemblyjs/wast-printer@1.14.1": + version "1.14.1" + resolved "https://registry.yarnpkg.com/@webassemblyjs/wast-printer/-/wast-printer-1.14.1.tgz#3bb3e9638a8ae5fdaf9610e7a06b4d9f9aa6fe07" + integrity sha512-kPSSXE6De1XOR820C90RIo2ogvZG+c3KiHzqUoO/F34Y2shGzesfqv7o57xrxovZJH/MetF5UjroJ/R/3isoiw== + dependencies: + "@webassemblyjs/ast" "1.14.1" "@xtuc/long" "4.2.2" "@xtuc/ieee754@^1.2.0": @@ -4011,7 +3351,7 @@ resolved "https://registry.yarnpkg.com/@xtuc/long/-/long-4.2.2.tgz#d291c6a4e97989b5c61d9acf396ae4fe133a718d" integrity sha512-NuHqBY1PB/D8xU6s/thBgOAiAP7HOYDQ32+BFZILJ8ivkUkAHQnWfn6WhL79Owj1qmUnoN/YPhktdIoucipkAQ== -accepts@~1.3.4, accepts@~1.3.5, accepts@~1.3.8: +accepts@~1.3.4, accepts@~1.3.8: version "1.3.8" resolved "https://registry.yarnpkg.com/accepts/-/accepts-1.3.8.tgz#0bf0be125b67014adcb0b0921e62db7bffe16b2e" integrity sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw== @@ -4019,29 +3359,19 @@ accepts@~1.3.4, accepts@~1.3.5, accepts@~1.3.8: mime-types "~2.1.34" negotiator "0.6.3" -acorn-import-attributes@^1.9.5: - version "1.9.5" - resolved "https://registry.yarnpkg.com/acorn-import-attributes/-/acorn-import-attributes-1.9.5.tgz#7eb1557b1ba05ef18b5ed0ec67591bfab04688ef" - integrity sha512-n02Vykv5uA3eHGM/Z2dQrcD56kL8TyDb2p1+0P83PClMnC/nc+anbQRhIOWnSq4Ke/KvDPrY3C9hDtC/A3eHnQ== - acorn-jsx@^5.0.0: version "5.3.2" resolved "https://registry.yarnpkg.com/acorn-jsx/-/acorn-jsx-5.3.2.tgz#7ed5bb55908b3b2f1bc55c6af1653bada7f07937" integrity sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ== acorn-walk@^8.0.0: - version "8.3.3" - resolved "https://registry.yarnpkg.com/acorn-walk/-/acorn-walk-8.3.3.tgz#9caeac29eefaa0c41e3d4c65137de4d6f34df43e" - integrity sha512-MxXdReSRhGO7VlFe1bRG/oI7/mdLV9B9JJT0N8vZOhF7gFRR5l3M8W9G8JxmKV+JC5mGqJ0QvqfSOLsCPa4nUw== + version "8.3.4" + resolved "https://registry.yarnpkg.com/acorn-walk/-/acorn-walk-8.3.4.tgz#794dd169c3977edf4ba4ea47583587c5866236b7" + integrity sha512-ueEepnujpqee2o5aIYnvHU6C0A42MNdsIDeqy5BydrkuC5R1ZuUFnm27EeFJGoEHJQgn3uleRvmTXaJgfXbt4g== dependencies: acorn "^8.11.0" -acorn@^8.0.0, acorn@^8.0.4, acorn@^8.11.0, acorn@^8.7.1, acorn@^8.8.2: - version "8.12.1" - resolved "https://registry.yarnpkg.com/acorn/-/acorn-8.12.1.tgz#71616bdccbe25e27a54439e0046e89ca76df2248" - integrity sha512-tcpGyI9zbizT9JbV6oYE477V6mTlXvvi0T0G3SNIYE2apm/G5huBa1+K89VGeovbg+jycCrfhl3ADxErOuO6Jg== - -acorn@^8.12.1, acorn@^8.14.0: +acorn@^8.0.0, acorn@^8.0.4, acorn@^8.11.0, acorn@^8.14.0, acorn@^8.8.2: version "8.14.0" resolved "https://registry.yarnpkg.com/acorn/-/acorn-8.14.0.tgz#063e2c70cac5fb4f6467f0b11152e04c682795b0" integrity sha512-cl669nCJTZBsL97OF4kUQm5g5hC2uihk0NxY3WENAC0TYdILVkAyHymAntgxGkl7K+t0cXIrH5siy5S4XkFycA== @@ -4051,19 +3381,10 @@ address@^1.0.1, address@^1.1.2: resolved "https://registry.yarnpkg.com/address/-/address-1.2.2.tgz#2b5248dac5485a6390532c6a517fda2e3faac89e" integrity sha512-4B/qKCfeE/ODUaAUpSwfzazo5x29WD4r3vXiWsB7I2mSDAihwEqKO+g8GELZUQSSAo5e1XTYh3ZVfLyxBc12nA== -agent-base@6: - version "6.0.2" - resolved "https://registry.yarnpkg.com/agent-base/-/agent-base-6.0.2.tgz#49fff58577cfee3f37176feab4c22e00f86d7f77" - integrity sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ== - dependencies: - debug "4" - -agent-base@^7.0.2: - version "7.1.1" - resolved "https://registry.yarnpkg.com/agent-base/-/agent-base-7.1.1.tgz#bdbded7dfb096b751a2a087eeeb9664725b2e317" - integrity sha512-H0TSyFNDMomMNJQBn8wFV5YC/2eJ+VXECwOadZJT554xP6cODZHPX3H9QMQECxvrgiSOP1pHjy1sMWQVYJOUOA== - dependencies: - debug "^4.3.4" +agent-base@^7.1.0, agent-base@^7.1.2: + version "7.1.3" + resolved "https://registry.yarnpkg.com/agent-base/-/agent-base-7.1.3.tgz#29435eb821bc4194633a5b89e5bc4703bafc25a1" + integrity sha512-jRR5wdylq8CkOe6hei19GGZnxM6rBGwFl3Bg0YItGDimvjGtAvdZk4Pu6Cl4u4Igsws4a1fd1Vq3ezrhn4KmFw== aggregate-error@^3.0.0: version "3.1.0" @@ -4103,42 +3424,40 @@ ajv@^6.12.2, ajv@^6.12.5: uri-js "^4.2.2" ajv@^8.0.0, ajv@^8.9.0: - version "8.16.0" - resolved "https://registry.yarnpkg.com/ajv/-/ajv-8.16.0.tgz#22e2a92b94f005f7e0f9c9d39652ef0b8f6f0cb4" - integrity sha512-F0twR8U1ZU67JIEtekUcLkXkoO5mMMmgGD8sK/xUFzJ805jxHQl92hImFAqqXMyMYjSPOyUPAwHYhB72g5sTXw== + version "8.17.1" + resolved "https://registry.yarnpkg.com/ajv/-/ajv-8.17.1.tgz#37d9a5c776af6bc92d7f4f9510eba4c0a60d11a6" + integrity sha512-B/gBuNg5SiMTrPkC+A2+cW0RszwxYmn6VYxB/inlBStS5nx6xHIt/ehKRhIMhqusl7a8LjQoZnjCs5vhwxOQ1g== dependencies: fast-deep-equal "^3.1.3" + fast-uri "^3.0.1" json-schema-traverse "^1.0.0" require-from-string "^2.0.2" - uri-js "^4.4.1" -algoliasearch-helper@^3.13.3: - version "3.22.2" - resolved "https://registry.yarnpkg.com/algoliasearch-helper/-/algoliasearch-helper-3.22.2.tgz#e351833f3bbace34751e239d5a82b5696e561ae8" - integrity sha512-3YQ6eo7uYOCHeQ2ZpD+OoT3aJJwMNKEnwtu8WMzm81XmBOSCwRjQditH9CeSOQ38qhHkuGw23pbq+kULkIJLcw== +algoliasearch-helper@^3.22.6: + version "3.23.0" + resolved "https://registry.yarnpkg.com/algoliasearch-helper/-/algoliasearch-helper-3.23.0.tgz#638e766bf6be2308b8dcda3282e47aff66438712" + integrity sha512-8CK4Gb/ju4OesAYcS+mjBpNiVA7ILWpg7D2vhBZohh0YkG8QT1KZ9LG+8+EntQBUGoKtPy06OFhiwP4f5zzAQg== dependencies: "@algolia/events" "^4.0.1" -algoliasearch@^4.18.0, algoliasearch@^4.19.1: - version "4.24.0" - resolved "https://registry.yarnpkg.com/algoliasearch/-/algoliasearch-4.24.0.tgz#b953b3e2309ef8f25da9de311b95b994ac918275" - integrity sha512-bf0QV/9jVejssFBmz2HQLxUadxk574t4iwjCKp5E7NBzwKkrDEhKPISIIjAU/p6K5qDx3qoeh4+26zWN1jmw3g== - dependencies: - "@algolia/cache-browser-local-storage" "4.24.0" - "@algolia/cache-common" "4.24.0" - "@algolia/cache-in-memory" "4.24.0" - "@algolia/client-account" "4.24.0" - "@algolia/client-analytics" "4.24.0" - "@algolia/client-common" "4.24.0" - "@algolia/client-personalization" "4.24.0" - "@algolia/client-search" "4.24.0" - "@algolia/logger-common" "4.24.0" - "@algolia/logger-console" "4.24.0" - "@algolia/recommend" "4.24.0" - "@algolia/requester-browser-xhr" "4.24.0" - "@algolia/requester-common" "4.24.0" - "@algolia/requester-node-http" "4.24.0" - "@algolia/transporter" "4.24.0" +algoliasearch@^5.14.2, algoliasearch@^5.17.1: + version "5.19.0" + resolved "https://registry.yarnpkg.com/algoliasearch/-/algoliasearch-5.19.0.tgz#2a1490bb46a937515797fac30b2d1503fb028536" + integrity sha512-zrLtGhC63z3sVLDDKGW+SlCRN9eJHFTgdEmoAOpsVh6wgGL1GgTTDou7tpCBjevzgIvi3AIyDAQO3Xjbg5eqZg== + dependencies: + "@algolia/client-abtesting" "5.19.0" + "@algolia/client-analytics" "5.19.0" + "@algolia/client-common" "5.19.0" + "@algolia/client-insights" "5.19.0" + "@algolia/client-personalization" "5.19.0" + "@algolia/client-query-suggestions" "5.19.0" + "@algolia/client-search" "5.19.0" + "@algolia/ingestion" "1.19.0" + "@algolia/monitoring" "1.19.0" + "@algolia/recommend" "5.19.0" + "@algolia/requester-browser-xhr" "5.19.0" + "@algolia/requester-fetch" "5.19.0" + "@algolia/requester-node-http" "5.19.0" ansi-align@^3.0.1: version "3.0.1" @@ -4165,16 +3484,9 @@ ansi-regex@^5.0.1: integrity sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ== ansi-regex@^6.0.1: - version "6.0.1" - resolved "https://registry.yarnpkg.com/ansi-regex/-/ansi-regex-6.0.1.tgz#3183e38fae9a65d7cb5e53945cd5897d0260a06a" - integrity sha512-n5M855fKb2SsfMIiFFoVrABHJC8QtHwVx+mHWP3QcEqBHYienj5dHSgjbxtC0WEZXYt4wcD6zrQElDPhFuZgfA== - -ansi-styles@^3.2.1: - version "3.2.1" - resolved "https://registry.yarnpkg.com/ansi-styles/-/ansi-styles-3.2.1.tgz#41fbb20243e50b12be0f04b8dedbf07520ce841d" - integrity sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA== - dependencies: - color-convert "^1.9.0" + version "6.1.0" + resolved "https://registry.yarnpkg.com/ansi-regex/-/ansi-regex-6.1.0.tgz#95ec409c69619d6cb1b8b34f14b660ef28ebd654" + integrity sha512-7HSX4QQb4CspciLpVFwyRe79O3xsIZDDLER21kERQ71oaPodF8jL725AgJMFAYbooIqolJoRLuM81SpeUkpkvA== ansi-styles@^4.0.0, ansi-styles@^4.1.0: version "4.3.0" @@ -4213,14 +3525,6 @@ argparse@^2.0.1: resolved "https://registry.yarnpkg.com/argparse/-/argparse-2.0.1.tgz#246f50f3ca78a3240f6c997e8a9bd1eac49e4b38" integrity sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q== -array-buffer-byte-length@^1.0.1: - version "1.0.1" - resolved "https://registry.yarnpkg.com/array-buffer-byte-length/-/array-buffer-byte-length-1.0.1.tgz#1e5583ec16763540a27ae52eed99ff899223568f" - integrity sha512-ahC5W1xgou+KTXix4sAO8Ki12Q+jf4i0+tmk3sC+zgcynshkHxzpXdImBehiUYKKKDwvfFiJl1tZt6ewscS1Mg== - dependencies: - call-bind "^1.0.5" - is-array-buffer "^3.0.4" - array-flatten@1.1.1: version "1.1.1" resolved "https://registry.yarnpkg.com/array-flatten/-/array-flatten-1.1.1.tgz#9a5f699051b1e7073328f2a008968b64ea2955d2" @@ -4231,48 +3535,39 @@ array-union@^2.1.0: resolved "https://registry.yarnpkg.com/array-union/-/array-union-2.1.0.tgz#b798420adbeb1de828d84acd8a2e23d3efe85e8d" integrity sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw== -arraybuffer.prototype.slice@^1.0.3: - version "1.0.3" - resolved "https://registry.yarnpkg.com/arraybuffer.prototype.slice/-/arraybuffer.prototype.slice-1.0.3.tgz#097972f4255e41bc3425e37dc3f6421cf9aefde6" - integrity sha512-bMxMKAjg13EBSVscxTaYA4mRc5t1UAXa2kXiGTNfZ079HIWXEkKmkgFrh/nJqamaLSrXO5H4WFFkPEaLJWbs3A== +ast-types@^0.13.4: + version "0.13.4" + resolved "https://registry.yarnpkg.com/ast-types/-/ast-types-0.13.4.tgz#ee0d77b343263965ecc3fb62da16e7222b2b6782" + integrity sha512-x1FCFnFifvYDDzTaLII71vG5uvDwgtmDTEVWAxrgeiR8VjMONcCXJx7E+USjDtHlwFmt9MysbqgF9b9Vjr6w+w== dependencies: - array-buffer-byte-length "^1.0.1" - call-bind "^1.0.5" - define-properties "^1.2.1" - es-abstract "^1.22.3" - es-errors "^1.2.1" - get-intrinsic "^1.2.3" - is-array-buffer "^3.0.4" - is-shared-array-buffer "^1.0.2" + tslib "^2.0.1" astring@^1.8.0: - version "1.8.6" - resolved "https://registry.yarnpkg.com/astring/-/astring-1.8.6.tgz#2c9c157cf1739d67561c56ba896e6948f6b93731" - integrity sha512-ISvCdHdlTDlH5IpxQJIex7BWBywFWgjJSVdwst+/iQCoEYnyOaQ95+X1JGshuBjGp6nxKUy1jMgE3zPqN7fQdg== + version "1.9.0" + resolved "https://registry.yarnpkg.com/astring/-/astring-1.9.0.tgz#cc73e6062a7eb03e7d19c22d8b0b3451fd9bfeef" + integrity sha512-LElXdjswlqjWrPpJFg1Fx4wpkOCxj1TDHlSV4PlaRxHGWko024xICaa97ZkMfs6DRKlCguiAI+rbXv5GWwXIkg== at-least-node@^1.0.0: version "1.0.0" resolved "https://registry.yarnpkg.com/at-least-node/-/at-least-node-1.0.0.tgz#602cd4b46e844ad4effc92a8011a3c46e0238dc2" integrity sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg== -autoprefixer@^10.4.14, autoprefixer@^10.4.19: - version "10.4.19" - resolved "https://registry.yarnpkg.com/autoprefixer/-/autoprefixer-10.4.19.tgz#ad25a856e82ee9d7898c59583c1afeb3fa65f89f" - integrity sha512-BaENR2+zBZ8xXhM4pUaKUxlVdxZ0EZhjvbopwnXmxRUfqDmwSpC2lAi/QXvx7NRdPCo1WKEcEF6mV64si1z4Ew== +autoprefixer@^10.4.19: + version "10.4.20" + resolved "https://registry.yarnpkg.com/autoprefixer/-/autoprefixer-10.4.20.tgz#5caec14d43976ef42e32dcb4bd62878e96be5b3b" + integrity sha512-XY25y5xSv/wEoqzDyXXME4AFfkZI0P23z6Fs3YgymDnKJkCGOnkL0iTxCa85UTqaSgfcqyf3UA6+c7wUvx/16g== dependencies: - browserslist "^4.23.0" - caniuse-lite "^1.0.30001599" + browserslist "^4.23.3" + caniuse-lite "^1.0.30001646" fraction.js "^4.3.7" normalize-range "^0.1.2" - picocolors "^1.0.0" + picocolors "^1.0.1" postcss-value-parser "^4.2.0" -available-typed-arrays@^1.0.7: - version "1.0.7" - resolved "https://registry.yarnpkg.com/available-typed-arrays/-/available-typed-arrays-1.0.7.tgz#a5cc375d6a03c2efc87a553f3e0b1522def14846" - integrity sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ== - dependencies: - possible-typed-array-names "^1.0.0" +b4a@^1.6.4: + version "1.6.7" + resolved "https://registry.yarnpkg.com/b4a/-/b4a-1.6.7.tgz#a99587d4ebbfbd5a6e3b21bdb5d5fa385767abe4" + integrity sha512-OnAYlL5b7LEkALw87fUVafQw5rVR9RjwGd4KUwNQ6DrrNmaVaUCgLipfVlzrPQ4tWOR9P0IXGNOx50jYCCdSJg== babel-loader@^9.2.1: version "9.2.1" @@ -4299,22 +3594,14 @@ babel-plugin-macros@^3.1.0: resolve "^1.19.0" babel-plugin-polyfill-corejs2@^0.4.10: - version "0.4.11" - resolved "https://registry.yarnpkg.com/babel-plugin-polyfill-corejs2/-/babel-plugin-polyfill-corejs2-0.4.11.tgz#30320dfe3ffe1a336c15afdcdafd6fd615b25e33" - integrity sha512-sMEJ27L0gRHShOh5G54uAAPaiCOygY/5ratXuiyb2G46FmlSpc9eFCzYVyDiPxfNbwzA7mYahmjQc5q+CZQ09Q== + version "0.4.12" + resolved "https://registry.yarnpkg.com/babel-plugin-polyfill-corejs2/-/babel-plugin-polyfill-corejs2-0.4.12.tgz#ca55bbec8ab0edeeef3d7b8ffd75322e210879a9" + integrity sha512-CPWT6BwvhrTO2d8QVorhTCQw9Y43zOu7G9HigcfxvepOU6b8o3tcWad6oVgZIsZCTt42FFv97aA7ZJsbM4+8og== dependencies: "@babel/compat-data" "^7.22.6" - "@babel/helper-define-polyfill-provider" "^0.6.2" + "@babel/helper-define-polyfill-provider" "^0.6.3" semver "^6.3.1" -babel-plugin-polyfill-corejs3@^0.10.4: - version "0.10.4" - resolved "https://registry.yarnpkg.com/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.10.4.tgz#789ac82405ad664c20476d0233b485281deb9c77" - integrity sha512-25J6I8NGfa5YkCDogHRID3fVCadIR8/pGl1/spvCkzb6lVn6SR3ojpx9nOn9iEBcUsjY24AmdKm5khcfKdylcg== - dependencies: - "@babel/helper-define-polyfill-provider" "^0.6.1" - core-js-compat "^3.36.1" - babel-plugin-polyfill-corejs3@^0.10.6: version "0.10.6" resolved "https://registry.yarnpkg.com/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.10.6.tgz#2deda57caef50f59c525aeb4964d3b2f867710c7" @@ -4324,11 +3611,11 @@ babel-plugin-polyfill-corejs3@^0.10.6: core-js-compat "^3.38.0" babel-plugin-polyfill-regenerator@^0.6.1: - version "0.6.2" - resolved "https://registry.yarnpkg.com/babel-plugin-polyfill-regenerator/-/babel-plugin-polyfill-regenerator-0.6.2.tgz#addc47e240edd1da1058ebda03021f382bba785e" - integrity sha512-2R25rQZWP63nGwaAswvDazbPXfrM3HwVoBXK6HcqeKrSrL/JqcC/rDcf95l4r7LXLyxDXc8uQDa064GubtCABg== + version "0.6.3" + resolved "https://registry.yarnpkg.com/babel-plugin-polyfill-regenerator/-/babel-plugin-polyfill-regenerator-0.6.3.tgz#abeb1f3f1c762eace37587f42548b08b57789bc8" + integrity sha512-LiWSbl4CRSIa5x/JAU6jZiG9eit9w6mz+yVMFwDE83LAWvt0AfGBoZ7HS/mkhrKuh2ZlzfVZYKoLjXdqw6Yt7Q== dependencies: - "@babel/helper-define-polyfill-provider" "^0.6.2" + "@babel/helper-define-polyfill-provider" "^0.6.3" bail@^2.0.0: version "2.0.2" @@ -4340,11 +3627,49 @@ balanced-match@^1.0.0: resolved "https://registry.yarnpkg.com/balanced-match/-/balanced-match-1.0.2.tgz#e83e3a7e3f300b34cb9d87f615fa0cbf357690ee" integrity sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw== +bare-events@^2.0.0, bare-events@^2.2.0: + version "2.5.4" + resolved "https://registry.yarnpkg.com/bare-events/-/bare-events-2.5.4.tgz#16143d435e1ed9eafd1ab85f12b89b3357a41745" + integrity sha512-+gFfDkR8pj4/TrWCGUGWmJIkBwuxPS5F+a5yWjOHQt2hHvNZd5YLzadjmDUtFmMM4y429bnKLa8bYBMHcYdnQA== + +bare-fs@^4.0.1: + version "4.0.1" + resolved "https://registry.yarnpkg.com/bare-fs/-/bare-fs-4.0.1.tgz#85844f34da819c76754d545323a8b23ed3617c76" + integrity sha512-ilQs4fm/l9eMfWY2dY0WCIUplSUp7U0CT1vrqMg1MUdeZl4fypu5UP0XcDBK5WBQPJAKP1b7XEodISmekH/CEg== + dependencies: + bare-events "^2.0.0" + bare-path "^3.0.0" + bare-stream "^2.0.0" + +bare-os@^3.0.1: + version "3.4.0" + resolved "https://registry.yarnpkg.com/bare-os/-/bare-os-3.4.0.tgz#97be31503f3095beb232a6871f0118859832eb0c" + integrity sha512-9Ous7UlnKbe3fMi7Y+qh0DwAup6A1JkYgPnjvMDNOlmnxNRQvQ/7Nst+OnUQKzk0iAT0m9BisbDVp9gCv8+ETA== + +bare-path@^3.0.0: + version "3.0.0" + resolved "https://registry.yarnpkg.com/bare-path/-/bare-path-3.0.0.tgz#b59d18130ba52a6af9276db3e96a2e3d3ea52178" + integrity sha512-tyfW2cQcB5NN8Saijrhqn0Zh7AnFNsnczRcuWODH0eYAXBsJ5gVxAUuNr7tsHSC6IZ77cA0SitzT+s47kot8Mw== + dependencies: + bare-os "^3.0.1" + +bare-stream@^2.0.0: + version "2.6.4" + resolved "https://registry.yarnpkg.com/bare-stream/-/bare-stream-2.6.4.tgz#4226bc8ec7b3ff2c17087385326909978747b149" + integrity sha512-G6i3A74FjNq4nVrrSTUz5h3vgXzBJnjmWAVlBWaZETkgu+LgKd7AiyOml3EDJY1AHlIbBHKDXE+TUT53Ff8OaA== + dependencies: + streamx "^2.21.0" + base64-js@^1.3.1: version "1.5.1" resolved "https://registry.yarnpkg.com/base64-js/-/base64-js-1.5.1.tgz#1b1b440160a5bf7ad40b650f095963481903930a" integrity sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA== +basic-ftp@^5.0.2: + version "5.0.5" + resolved "https://registry.yarnpkg.com/basic-ftp/-/basic-ftp-5.0.5.tgz#14a474f5fffecca1f4f406f1c26b18f800225ac0" + integrity sha512-4Bcg1P8xhUuqcii/S0Z9wiHIrQVPMermM1any+MX5GeGD7faD3/msQUDGLol9wOcz4/jbg/WJnGqoJF6LiBdtg== + batch@0.6.1: version "0.6.1" resolved "https://registry.yarnpkg.com/batch/-/batch-0.6.1.tgz#dc34314f4e679318093fc760272525f94bf25c16" @@ -4360,15 +3685,6 @@ binary-extensions@^2.0.0: resolved "https://registry.yarnpkg.com/binary-extensions/-/binary-extensions-2.3.0.tgz#f6e14a97858d327252200242d4ccfe522c445522" integrity sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw== -bl@^4.0.3: - version "4.1.0" - resolved "https://registry.yarnpkg.com/bl/-/bl-4.1.0.tgz#451535264182bec2fbbc83a62ab98cf11d9f7b3a" - integrity sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w== - dependencies: - buffer "^5.5.0" - inherits "^2.0.4" - readable-stream "^3.4.0" - body-parser@1.20.3: version "1.20.3" resolved "https://registry.yarnpkg.com/body-parser/-/body-parser-1.20.3.tgz#1953431221c6fb5cd63c4b36d53fab0928e548c6" @@ -4388,9 +3704,9 @@ body-parser@1.20.3: unpipe "1.0.0" bonjour-service@^1.0.11: - version "1.2.1" - resolved "https://registry.yarnpkg.com/bonjour-service/-/bonjour-service-1.2.1.tgz#eb41b3085183df3321da1264719fbada12478d02" - integrity sha512-oSzCS2zV14bh2kji6vNe7vrpJYCHGvcZnlffFQ1MEoX/WOeQ/teD8SYWKR942OI3INjq8OMNJlbPK5LLLUxFDw== + version "1.3.0" + resolved "https://registry.yarnpkg.com/bonjour-service/-/bonjour-service-1.3.0.tgz#80d867430b5a0da64e82a8047fc1e355bdb71722" + integrity sha512-3YuAUiSkWykd+2Azjgyxei8OWf8thdn8AITIog2M4UICzoqfjlqr64WIjEXZllf/W6vK1goqleSR6brGomxQqA== dependencies: fast-deep-equal "^3.1.3" multicast-dns "^7.2.5" @@ -4450,24 +3766,14 @@ braces@^3.0.3, braces@~3.0.2: dependencies: fill-range "^7.1.1" -browserslist@^4.0.0, browserslist@^4.18.1, browserslist@^4.21.10, browserslist@^4.22.2, browserslist@^4.23.0: - version "4.23.2" - resolved "https://registry.yarnpkg.com/browserslist/-/browserslist-4.23.2.tgz#244fe803641f1c19c28c48c4b6ec9736eb3d32ed" - integrity sha512-qkqSyistMYdxAcw+CzbZwlBy8AGmS/eEWs+sEV5TnLRGDOL+C5M2EnH6tlZyg0YoAxGJAFKh61En9BR941GnHA== - dependencies: - caniuse-lite "^1.0.30001640" - electron-to-chromium "^1.4.820" - node-releases "^2.0.14" - update-browserslist-db "^1.1.0" - -browserslist@^4.24.0, browserslist@^4.24.2: - version "4.24.2" - resolved "https://registry.yarnpkg.com/browserslist/-/browserslist-4.24.2.tgz#f5845bc91069dbd55ee89faf9822e1d885d16580" - integrity sha512-ZIc+Q62revdMcqC6aChtW4jz3My3klmCO1fEmINZY/8J3EpBg5/A/D0AKmBveUh6pgoeycoMkVMko84tuYS+Gg== +browserslist@^4.0.0, browserslist@^4.18.1, browserslist@^4.23.0, browserslist@^4.23.1, browserslist@^4.23.3, browserslist@^4.24.0, browserslist@^4.24.3: + version "4.24.4" + resolved "https://registry.yarnpkg.com/browserslist/-/browserslist-4.24.4.tgz#c6b2865a3f08bcb860a0e827389003b9fe686e4b" + integrity sha512-KDi1Ny1gSePi1vm0q4oxSF8b4DR44GF4BbmS2YdhPLOEqd8pDviZOGH/GsmRwoWJ2+5Lr085X7naowMwKHDG1A== dependencies: - caniuse-lite "^1.0.30001669" - electron-to-chromium "^1.5.41" - node-releases "^2.0.18" + caniuse-lite "^1.0.30001688" + electron-to-chromium "^1.5.73" + node-releases "^2.0.19" update-browserslist-db "^1.1.1" buffer-crc32@~0.2.3: @@ -4480,7 +3786,7 @@ buffer-from@^1.0.0: resolved "https://registry.yarnpkg.com/buffer-from/-/buffer-from-1.1.2.tgz#2b146a6fd72e80b4f55d255f35ed59a3a9a41bd5" integrity sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ== -buffer@^5.2.1, buffer@^5.5.0: +buffer@^5.2.1: version "5.7.1" resolved "https://registry.yarnpkg.com/buffer/-/buffer-5.7.1.tgz#ba62e7c13133053582197160851a8f648e99eed0" integrity sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ== @@ -4516,16 +3822,31 @@ cacheable-request@^10.2.8: normalize-url "^8.0.0" responselike "^3.0.0" -call-bind@^1.0.2, call-bind@^1.0.5, call-bind@^1.0.6, call-bind@^1.0.7: - version "1.0.7" - resolved "https://registry.yarnpkg.com/call-bind/-/call-bind-1.0.7.tgz#06016599c40c56498c18769d2730be242b6fa3b9" - integrity sha512-GHTSNSYICQ7scH7sZ+M2rFopRoLh8t2bLSW6BbgrtLsahOIB5iyAVJf9GjWK3cYTDaMj4XdBpM1cA6pIS0Kv2w== +call-bind-apply-helpers@^1.0.0, call-bind-apply-helpers@^1.0.1: + version "1.0.1" + resolved "https://registry.yarnpkg.com/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.1.tgz#32e5892e6361b29b0b545ba6f7763378daca2840" + integrity sha512-BhYE+WDaywFg2TBWYNXAE+8B1ATnThNBqXHP5nQu0jWJdVvY2hvkpyB3qOmtmDePiS5/BDQ8wASEWGMWRG148g== dependencies: - es-define-property "^1.0.0" es-errors "^1.3.0" function-bind "^1.1.2" + +call-bind@^1.0.7, call-bind@^1.0.8: + version "1.0.8" + resolved "https://registry.yarnpkg.com/call-bind/-/call-bind-1.0.8.tgz#0736a9660f537e3388826f440d5ec45f744eaa4c" + integrity sha512-oKlSFMcMwpUg2ednkhQ454wfWiU/ul3CkJe/PEHcTKuiX6RpbehUiFMXu13HalGZxfUwCQzZG747YXBn1im9ww== + dependencies: + call-bind-apply-helpers "^1.0.0" + es-define-property "^1.0.0" get-intrinsic "^1.2.4" - set-function-length "^1.2.1" + set-function-length "^1.2.2" + +call-bound@^1.0.2, call-bound@^1.0.3: + version "1.0.3" + resolved "https://registry.yarnpkg.com/call-bound/-/call-bound-1.0.3.tgz#41cfd032b593e39176a71533ab4f384aa04fd681" + integrity sha512-YTd+6wGlNlPxSuri7Y6X8tY2dmm12UMH66RpKMhiX6rsk5wXXnYgbUcOt8kiS31/AjfoTOvCsE+w8nZQLQnzHA== + dependencies: + call-bind-apply-helpers "^1.0.1" + get-intrinsic "^1.2.6" call-me-maybe@^1.0.1: version "1.0.2" @@ -4570,30 +3891,16 @@ caniuse-api@^3.0.0: lodash.memoize "^4.1.2" lodash.uniq "^4.5.0" -caniuse-lite@^1.0.0, caniuse-lite@^1.0.30001599, caniuse-lite@^1.0.30001640: - version "1.0.30001641" - resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001641.tgz#3572862cd18befae3f637f2a1101cc033c6782ac" - integrity sha512-Phv5thgl67bHYo1TtMY/MurjkHhV4EDaCosezRXgZ8jzA/Ub+wjxAvbGvjoFENStinwi5kCyOYV3mi5tOGykwA== - -caniuse-lite@^1.0.30001669: - version "1.0.30001677" - resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001677.tgz#27c2e2c637e007cfa864a16f7dfe7cde66b38b5f" - integrity sha512-fmfjsOlJUpMWu+mAAtZZZHz7UEwsUxIIvu1TJfO1HqFQvB/B+ii0xr9B5HpbZY/mC4XZ8SvjHJqtAY6pDPQEog== +caniuse-lite@^1.0.0, caniuse-lite@^1.0.30001646, caniuse-lite@^1.0.30001688: + version "1.0.30001695" + resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001695.tgz#39dfedd8f94851132795fdf9b79d29659ad9c4d4" + integrity sha512-vHyLade6wTgI2u1ec3WQBxv+2BrTERV28UXQu9LO6lZ9pYeMk34vjXFLOxo1A4UBA8XTL4njRQZdno/yYaSmWw== ccount@^2.0.0: version "2.0.1" resolved "https://registry.yarnpkg.com/ccount/-/ccount-2.0.1.tgz#17a3bf82302e0870d6da43a01311a8bc02a3ecf5" integrity sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg== -chalk@^2.4.2: - version "2.4.2" - resolved "https://registry.yarnpkg.com/chalk/-/chalk-2.4.2.tgz#cd42541677a54333cf541a49108c1432b44c9424" - integrity sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ== - dependencies: - ansi-styles "^3.2.1" - escape-string-regexp "^1.0.5" - supports-color "^5.3.0" - chalk@^4.0.0, chalk@^4.1.0, chalk@^4.1.2: version "4.1.2" resolved "https://registry.yarnpkg.com/chalk/-/chalk-4.1.2.tgz#aac4e2b7734a740867aeb16bf02aad556a1e7a01" @@ -4603,9 +3910,9 @@ chalk@^4.0.0, chalk@^4.1.0, chalk@^4.1.2: supports-color "^7.1.0" chalk@^5.0.1, chalk@^5.2.0: - version "5.3.0" - resolved "https://registry.yarnpkg.com/chalk/-/chalk-5.3.0.tgz#67c20a7ebef70e7f3970a01f90fa210cb6860385" - integrity sha512-dLitG79d+GV1Nb/VYcCDFivJeK1hiukt9QjRNVOsUtTy1rR1YJsmpGGTZ3qJos+uw7WmWF4wUwBd9jxjocFC2w== + version "5.4.1" + resolved "https://registry.yarnpkg.com/chalk/-/chalk-5.4.1.tgz#1b48bf0963ec158dce2aacf69c093ae2dd2092d8" + integrity sha512-zgVZuo2WcZgfUEmsn6eO3kINexW8RAE4maiQ8QNs8CtpPCSyMiYsULR3HQYkm3w8FIA3SberyMJMSldGsW+U3w== char-regex@^1.0.2: version "1.0.2" @@ -4691,16 +3998,20 @@ chokidar@^3.4.2, chokidar@^3.5.3: optionalDependencies: fsevents "~2.3.2" -chownr@^1.1.1: - version "1.1.4" - resolved "https://registry.yarnpkg.com/chownr/-/chownr-1.1.4.tgz#6fc9d7b42d32a583596337666e7d08084da2cc6b" - integrity sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg== - chrome-trace-event@^1.0.2: version "1.0.4" resolved "https://registry.yarnpkg.com/chrome-trace-event/-/chrome-trace-event-1.0.4.tgz#05bffd7ff928465093314708c93bdfa9bd1f0f5b" integrity sha512-rNjApaLzuwaOTjCiT8lSDdGN1APCiqkChLMJxJPWLunPAt5fy8xgU9/jNOchV84wfIxrA0lRQB7oCT8jrn/wrQ== +chromium-bidi@0.6.3: + version "0.6.3" + resolved "https://registry.yarnpkg.com/chromium-bidi/-/chromium-bidi-0.6.3.tgz#363fe1ca6b9c6122b9f1b2a47f9449ecf712f755" + integrity sha512-qXlsCmpCZJAnoTYI83Iu6EdYQpMYdVkCfq08KDh2pmlVqK5t5IA9mGs4/LwCwp4fqisSOMXZxP3HIh8w8aRn0A== + dependencies: + mitt "3.0.1" + urlpattern-polyfill "10.0.0" + zod "3.23.8" + ci-info@^3.2.0: version "3.9.0" resolved "https://registry.yarnpkg.com/ci-info/-/ci-info-3.9.0.tgz#4279a62028a7b1f262f3473fc9605f5e218c59b4" @@ -4760,7 +4071,7 @@ clsx@^1.2.1: resolved "https://registry.yarnpkg.com/clsx/-/clsx-1.2.1.tgz#0ddc4a20a549b59c93a4116bb26f5294ca17dc12" integrity sha512-EcR6r5a8bj6pu3ycsa/E/cKVGuTgZJZdsyUYHOksG/UHIiKfjxzRxYJpyVBwYaQeOvghal9fcc4PidlgzugAQg== -clsx@^2.0.0, clsx@^2.1.0: +clsx@^2.0.0, clsx@^2.1.0, clsx@^2.1.1: version "2.1.1" resolved "https://registry.yarnpkg.com/clsx/-/clsx-2.1.1.tgz#eed397c9fd8bd882bfb18deab7102049a2f32999" integrity sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA== @@ -4770,13 +4081,6 @@ collapse-white-space@^2.0.0: resolved "https://registry.yarnpkg.com/collapse-white-space/-/collapse-white-space-2.1.0.tgz#640257174f9f42c740b40f3b55ee752924feefca" integrity sha512-loKTxY1zCOuG4j9f6EPnuyyYkf58RnhhWTvRoZEokgB+WbdXehfjFviyOVYkqzEWz1Q5kRiZdBYS5SwxbQYwzw== -color-convert@^1.9.0: - version "1.9.3" - resolved "https://registry.yarnpkg.com/color-convert/-/color-convert-1.9.3.tgz#bb71850690e1f136567de629d2d5471deda4c1e8" - integrity sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg== - dependencies: - color-name "1.1.3" - color-convert@^2.0.1: version "2.0.1" resolved "https://registry.yarnpkg.com/color-convert/-/color-convert-2.0.1.tgz#72d3a68d598c9bdb3af2ad1e84f21d896abd4de3" @@ -4784,11 +4088,6 @@ color-convert@^2.0.1: dependencies: color-name "~1.1.4" -color-name@1.1.3: - version "1.1.3" - resolved "https://registry.yarnpkg.com/color-name/-/color-name-1.1.3.tgz#a7d0558bd89c42f795dd42328f740831ca53bc25" - integrity sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw== - color-name@~1.1.4: version "1.1.4" resolved "https://registry.yarnpkg.com/color-name/-/color-name-1.1.4.tgz#c2a09a87acbde69543de6f63fa3995c826c536a2" @@ -4849,7 +4148,7 @@ common-path-prefix@^3.0.0: resolved "https://registry.yarnpkg.com/common-path-prefix/-/common-path-prefix-3.0.0.tgz#7d007a7e07c58c4b4d5f433131a19141b29f11e0" integrity sha512-QE33hToZseCH3jS0qN96O/bSh3kaw/h+Tq7ngyY9eWDUnTlTNUyqfqvCXioLe5Na5jFsL78ra/wuBU4iuEgd4w== -compressible@~2.0.16: +compressible@~2.0.18: version "2.0.18" resolved "https://registry.yarnpkg.com/compressible/-/compressible-2.0.18.tgz#af53cca6b070d4c3c0750fbd77286a6d7cc46fba" integrity sha512-AF3r7P5dWxL8MxyITRMlORQNaOA2IkAFaTr4k7BUumjPtRpGDTZpl0Pb1XCO6JeDCBdp126Cgs9sMxqSjgYyRg== @@ -4857,16 +4156,16 @@ compressible@~2.0.16: mime-db ">= 1.43.0 < 2" compression@^1.7.4: - version "1.7.4" - resolved "https://registry.yarnpkg.com/compression/-/compression-1.7.4.tgz#95523eff170ca57c29a0ca41e6fe131f41e5bb8f" - integrity sha512-jaSIDzP9pZVS4ZfQ+TzvtiWhdpFhE2RDHz8QJkpX9SIpLq88VueF5jJw6t+6CUQcAoA6t+x89MLrWAqpfDE8iQ== + version "1.7.5" + resolved "https://registry.yarnpkg.com/compression/-/compression-1.7.5.tgz#fdd256c0a642e39e314c478f6c2cd654edd74c93" + integrity sha512-bQJ0YRck5ak3LgtnpKkiabX5pNF7tMUh1BSy2ZBOTh0Dim0BUu6aPPwByIns6/A5Prh8PufSPerMDUklpzes2Q== dependencies: - accepts "~1.3.5" - bytes "3.0.0" - compressible "~2.0.16" + bytes "3.1.2" + compressible "~2.0.18" debug "2.6.9" + negotiator "~0.6.4" on-headers "~1.0.2" - safe-buffer "5.1.2" + safe-buffer "5.2.1" vary "~1.1.2" concat-map@0.0.1: @@ -4904,9 +4203,9 @@ connect-history-api-fallback@^2.0.0: integrity sha512-U73+6lQFmfiNPrYbXqr6kZ1i1wiRqXnp2nhMsINseWXO8lDau0LGEffJ8kQi4EjLZympVgRdvqjAgiZ1tgzDDA== consola@^3.2.3: - version "3.2.3" - resolved "https://registry.yarnpkg.com/consola/-/consola-3.2.3.tgz#0741857aa88cfa0d6fd53f1cff0375136e98502f" - integrity sha512-I5qxpzLv+sJhTVEoLYNcTW+bThDCPsit0vLNKShZx6rLtpilNpmmeTPaeqJb9ZE9dV3DGaeby6Vuhrw38WjeyQ== + version "3.4.0" + resolved "https://registry.yarnpkg.com/consola/-/consola-3.4.0.tgz#4cfc9348fd85ed16a17940b3032765e31061ab88" + integrity sha512-EiPU8G6dQG0GFHNR8ljnZFki/8a+cQwEQ+7wpxdChl02Q8HXlwEZWD5lqAF8vC2sEC3Tehr8hy7vErz88LHyUA== content-disposition@0.5.2: version "0.5.2" @@ -4940,10 +4239,10 @@ cookie-signature@1.0.6: resolved "https://registry.yarnpkg.com/cookie-signature/-/cookie-signature-1.0.6.tgz#e303a882b342cc3ee8ca513a79999734dab3ae2c" integrity sha512-QADzlaHc8icV8I7vbaJXJwod9HWYp8uCqf1xa4OfNu1T7JVxQIrUgOWtHdNDtPiywmFbiS12VjotIXLrKM3orQ== -cookie@0.6.0: - version "0.6.0" - resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.6.0.tgz#2798b04b071b0ecbff0dbb62a505a8efa4e19051" - integrity sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw== +cookie@0.7.1: + version "0.7.1" + resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.7.1.tgz#2f73c42142d5d5cf71310a74fc4ae61670e5dbc9" + integrity sha512-6DnInpx7SJ2AK3+CTUE/ZM0vWTUboZCegxhC2xiIydHR9jNuTAASBrfEpHhiGOZw/nX51bHt6YQl8jsGo4y/0w== copy-text-to-clipboard@^3.2.0: version "3.2.0" @@ -4962,29 +4261,22 @@ copy-webpack-plugin@^11.0.0: schema-utils "^4.0.0" serialize-javascript "^6.0.0" -core-js-compat@^3.31.0, core-js-compat@^3.36.1: - version "3.37.1" - resolved "https://registry.yarnpkg.com/core-js-compat/-/core-js-compat-3.37.1.tgz#c844310c7852f4bdf49b8d339730b97e17ff09ee" - integrity sha512-9TNiImhKvQqSUkOvk/mMRZzOANTiEVC7WaBNhHcKM7x+/5E1l5NvsysR19zuDQScE8k+kfQXWRN3AtS/eOSHpg== - dependencies: - browserslist "^4.23.0" - core-js-compat@^3.38.0, core-js-compat@^3.38.1: - version "3.39.0" - resolved "https://registry.yarnpkg.com/core-js-compat/-/core-js-compat-3.39.0.tgz#b12dccb495f2601dc860bdbe7b4e3ffa8ba63f61" - integrity sha512-VgEUx3VwlExr5no0tXlBt+silBvhTryPwCXRI2Id1PN8WTKu7MreethvddqOubrYxkFdv/RnYrqlv1sFNAUelw== + version "3.40.0" + resolved "https://registry.yarnpkg.com/core-js-compat/-/core-js-compat-3.40.0.tgz#7485912a5a4a4315c2fdb2cbdc623e6881c88b38" + integrity sha512-0XEDpr5y5mijvw8Lbc6E5AkjrHfp7eEoPlu36SWeAbcL8fn1G1ANe8DBlo2XoNN89oVpxWwOjYIPVzR4ZvsKCQ== dependencies: - browserslist "^4.24.2" + browserslist "^4.24.3" core-js-pure@^3.30.2: - version "3.37.1" - resolved "https://registry.yarnpkg.com/core-js-pure/-/core-js-pure-3.37.1.tgz#2b4b34281f54db06c9a9a5bd60105046900553bd" - integrity sha512-J/r5JTHSmzTxbiYYrzXg9w1VpqrYt+gexenBE9pugeyhwPZTAEJddyiReJWsLO6uNQ8xJZFbod6XC7KKwatCiA== + version "3.40.0" + resolved "https://registry.yarnpkg.com/core-js-pure/-/core-js-pure-3.40.0.tgz#d9a019e9160f9b042eeb6abb92242680089d486e" + integrity sha512-AtDzVIgRrmRKQai62yuSIN5vNiQjcJakJb4fbhVw3ehxx7Lohphvw9SGNWKhLFqSxC4ilD0g/L1huAYFQU3Q6A== core-js@^3.31.1: - version "3.37.1" - resolved "https://registry.yarnpkg.com/core-js/-/core-js-3.37.1.tgz#d21751ddb756518ac5a00e4d66499df981a62db9" - integrity sha512-Xn6qmxrQZyB0FFY8E3bgRXei3lWDJHhvI+u0q9TKIYM49G8pAr0FgnnrFRAmsbptZL1yxRADVXn+x5AGsbBfyw== + version "3.40.0" + resolved "https://registry.yarnpkg.com/core-js/-/core-js-3.40.0.tgz#2773f6b06877d8eda102fc42f828176437062476" + integrity sha512-7vsMc/Lty6AGnn7uFpYT56QesI5D2Y/UkgKounk87OP9Z2H9Z8kj6jzcSGAxFmUtDOS0ntK6lbQz+Nsa0Jj6mQ== core-util-is@~1.0.0: version "1.0.3" @@ -5037,17 +4329,20 @@ cosmiconfig@^8.1.3, cosmiconfig@^8.3.5: parse-json "^5.2.0" path-type "^4.0.0" -cross-fetch@3.1.5: - version "3.1.5" - resolved "https://registry.yarnpkg.com/cross-fetch/-/cross-fetch-3.1.5.tgz#e1389f44d9e7ba767907f7af8454787952ab534f" - integrity sha512-lvb1SBsI0Z7GDwmuid+mU3kWVBwTVUbe7S0H52yaaAdQOXq2YktTCZdlAcNKFzE6QtRz0snpw9bNiPeOIkkQvw== +cosmiconfig@^9.0.0: + version "9.0.0" + resolved "https://registry.yarnpkg.com/cosmiconfig/-/cosmiconfig-9.0.0.tgz#34c3fc58287b915f3ae905ab6dc3de258b55ad9d" + integrity sha512-itvL5h8RETACmOTFc4UfIyB2RfEHi71Ax6E/PivVxq9NseKbOWpeyHEOIbmAw1rs8Ak0VursQNww7lf7YtUwzg== dependencies: - node-fetch "2.6.7" + env-paths "^2.2.1" + import-fresh "^3.3.0" + js-yaml "^4.1.0" + parse-json "^5.2.0" cross-spawn@^7.0.3: - version "7.0.3" - resolved "https://registry.yarnpkg.com/cross-spawn/-/cross-spawn-7.0.3.tgz#f73a85b9d5d41d045551c177e2882d4ac85728a6" - integrity sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w== + version "7.0.6" + resolved "https://registry.yarnpkg.com/cross-spawn/-/cross-spawn-7.0.6.tgz#8a58fe78f00dcd70c370451759dfbfaf03e8ee9f" + integrity sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA== dependencies: path-key "^3.1.0" shebang-command "^2.0.0" @@ -5060,6 +4355,13 @@ crypto-random-string@^4.0.0: dependencies: type-fest "^1.0.1" +css-blank-pseudo@^7.0.1: + version "7.0.1" + resolved "https://registry.yarnpkg.com/css-blank-pseudo/-/css-blank-pseudo-7.0.1.tgz#32020bff20a209a53ad71b8675852b49e8d57e46" + integrity sha512-jf+twWGDf6LDoXDUode+nc7ZlrqfaNphrBIBrcmeP3D8yw1uPaix1gCC8LUQUGQ6CycuK2opkbFFWFuq/a94ag== + dependencies: + postcss-selector-parser "^7.0.0" + css-color-keywords@^1.0.0: version "1.0.0" resolved "https://registry.yarnpkg.com/css-color-keywords/-/css-color-keywords-1.0.0.tgz#fea2616dc676b2962686b3af8dbdbe180b244e05" @@ -5070,6 +4372,15 @@ css-declaration-sorter@^7.2.0: resolved "https://registry.yarnpkg.com/css-declaration-sorter/-/css-declaration-sorter-7.2.0.tgz#6dec1c9523bc4a643e088aab8f09e67a54961024" integrity sha512-h70rUM+3PNFuaBDTLe8wF/cdWu+dOZmb7pJt8Z2sedYbAcQVQV/tEchueg3GWxwqS0cxtbxmaHEdkNACqcvsow== +css-has-pseudo@^7.0.2: + version "7.0.2" + resolved "https://registry.yarnpkg.com/css-has-pseudo/-/css-has-pseudo-7.0.2.tgz#fb42e8de7371f2896961e1f6308f13c2c7019b72" + integrity sha512-nzol/h+E0bId46Kn2dQH5VElaknX2Sr0hFuB/1EomdC7j+OISt2ZzK7EHX9DZDY53WbIVAR7FYKSO2XnSf07MQ== + dependencies: + "@csstools/selector-specificity" "^5.0.0" + postcss-selector-parser "^7.0.0" + postcss-value-parser "^4.2.0" + css-loader@^6.8.1: version "6.11.0" resolved "https://registry.yarnpkg.com/css-loader/-/css-loader-6.11.0.tgz#33bae3bf6363d0a7c2cf9031c96c744ff54d85ba" @@ -5096,6 +4407,11 @@ css-minimizer-webpack-plugin@^5.0.1: schema-utils "^4.0.1" serialize-javascript "^6.0.1" +css-prefers-color-scheme@^10.0.0: + version "10.0.0" + resolved "https://registry.yarnpkg.com/css-prefers-color-scheme/-/css-prefers-color-scheme-10.0.0.tgz#ba001b99b8105b8896ca26fc38309ddb2278bd3c" + integrity sha512-VCtXZAWivRglTZditUfB4StnsWr6YVZ2PRtuxQLKTNRdtAf8tpzaVPE9zXIF3VaSc7O70iK/j1+NXxyQCqdPjQ== + css-select@^4.1.3: version "4.3.0" resolved "https://registry.yarnpkg.com/css-select/-/css-select-4.3.0.tgz#db7129b2846662fd8628cfc496abb2b59e41529b" @@ -5148,6 +4464,11 @@ css-what@^6.0.1, css-what@^6.1.0: resolved "https://registry.yarnpkg.com/css-what/-/css-what-6.1.0.tgz#fb5effcf76f1ddea2c81bdfaa4de44e79bac70f4" integrity sha512-HTUrgRJ7r4dsZKU6GjmpfRK1O76h97Z8MfS1G0FozR+oF2kG6Vfe8JE6zwrkbxigziPHinCJ+gCPjA9EaBDtRw== +cssdb@^8.2.3: + version "8.2.3" + resolved "https://registry.yarnpkg.com/cssdb/-/cssdb-8.2.3.tgz#7e6980bb5a785a9b4eb2a21bd38d50624b56cb46" + integrity sha512-9BDG5XmJrJQQnJ51VFxXCAtpZ5ebDlAREmO8sxMOVU0aSxN/gocbctjIG5LMh3WBUq+xTlb/jw2LoljBEqraTA== + cssesc@^3.0.0: version "3.0.0" resolved "https://registry.yarnpkg.com/cssesc/-/cssesc-3.0.0.tgz#37741919903b868565e1c09ea747445cd18983ee" @@ -5241,15 +4562,10 @@ cytoscape-fcose@^2.2.0: dependencies: cose-base "^2.2.0" -cytoscape@^3.28.1: - version "3.30.0" - resolved "https://registry.yarnpkg.com/cytoscape/-/cytoscape-3.30.0.tgz#5b0c13f7bb305481e2c70414d4c5f149d92eda82" - integrity sha512-l590mjTHT6/Cbxp13dGPC2Y7VXdgc+rUeF8AnF/JPzhjNevbDJfObnJgaSjlldOgBQZbue+X6IUZ7r5GAgvauQ== - cytoscape@^3.29.2: - version "3.30.3" - resolved "https://registry.yarnpkg.com/cytoscape/-/cytoscape-3.30.3.tgz#1b2726bbfa6673f643488a81147354841c252352" - integrity sha512-HncJ9gGJbVtw7YXtIs3+6YAFSSiKsom0amWc33Z7QbylbY2JGMrA0yz4EwrdTScZxnwclXeEZHzO5pxoy0ZE4g== + version "3.31.0" + resolved "https://registry.yarnpkg.com/cytoscape/-/cytoscape-3.31.0.tgz#cffbbb8ca51db01cbf360e0cf59088db6d429837" + integrity sha512-zDGn1K/tfZwEnoGOcHc0H4XazqAAXAuDpcYw9mUnUjATjqljyCNGJv8uEvbvxGaGHaVshxMecyl6oc6uKzRfbw== "d3-array@1 - 2": version "2.12.1" @@ -5486,7 +4802,7 @@ d3-zoom@3: d3-selection "2 - 3" d3-transition "2 - 3" -d3@^7.4.0, d3@^7.8.2, d3@^7.9.0: +d3@^7.9.0: version "7.9.0" resolved "https://registry.yarnpkg.com/d3/-/d3-7.9.0.tgz#579e7acb3d749caf8860bd1741ae8d371070cd5d" integrity sha512-e1U46jVP+w7Iut8Jt8ri1YsPOvFpg46k+K8TpCb0P+zjCkjkPnV7WzfDJzMHy1LnA+wj5pLT1wjO901gLXeEhA== @@ -5522,14 +4838,6 @@ d3@^7.4.0, d3@^7.8.2, d3@^7.9.0: d3-transition "3" d3-zoom "3" -dagre-d3-es@7.0.10: - version "7.0.10" - resolved "https://registry.yarnpkg.com/dagre-d3-es/-/dagre-d3-es-7.0.10.tgz#19800d4be674379a3cd8c86a8216a2ac6827cadc" - integrity sha512-qTCQmEhcynucuaZgY5/+ti3X/rnszKZhEQH/ZdWdtP1tA/y3VoHJzcVrO9pjjJCNpigfscAtoUB5ONcd2wNn0A== - dependencies: - d3 "^7.8.2" - lodash-es "^4.17.21" - dagre-d3-es@7.0.11: version "7.0.11" resolved "https://registry.yarnpkg.com/dagre-d3-es/-/dagre-d3-es-7.0.11.tgz#2237e726c0577bfe67d1a7cfd2265b9ab2c15c40" @@ -5538,43 +4846,16 @@ dagre-d3-es@7.0.11: d3 "^7.9.0" lodash-es "^4.17.21" -data-view-buffer@^1.0.1: - version "1.0.1" - resolved "https://registry.yarnpkg.com/data-view-buffer/-/data-view-buffer-1.0.1.tgz#8ea6326efec17a2e42620696e671d7d5a8bc66b2" - integrity sha512-0lht7OugA5x3iJLOWFhWK/5ehONdprk0ISXqVFn/NFrDu+cuc8iADFrGQz5BnRK7LLU3JmkbXSxaqX+/mXYtUA== - dependencies: - call-bind "^1.0.6" - es-errors "^1.3.0" - is-data-view "^1.0.1" - -data-view-byte-length@^1.0.1: - version "1.0.1" - resolved "https://registry.yarnpkg.com/data-view-byte-length/-/data-view-byte-length-1.0.1.tgz#90721ca95ff280677eb793749fce1011347669e2" - integrity sha512-4J7wRJD3ABAzr8wP+OcIcqq2dlUKp4DVflx++hs5h5ZKydWMI6/D/fAot+yh6g2tHh8fLFTvNOaVN357NvSrOQ== - dependencies: - call-bind "^1.0.7" - es-errors "^1.3.0" - is-data-view "^1.0.1" - -data-view-byte-offset@^1.0.0: - version "1.0.0" - resolved "https://registry.yarnpkg.com/data-view-byte-offset/-/data-view-byte-offset-1.0.0.tgz#5e0bbfb4828ed2d1b9b400cd8a7d119bca0ff18a" - integrity sha512-t/Ygsytq+R995EJ5PZlD4Cu56sWa8InXySaViRzw9apusqsOO2bQP+SbYzAhR0pFKoB+43lYy8rWban9JSuXnA== - dependencies: - call-bind "^1.0.6" - es-errors "^1.3.0" - is-data-view "^1.0.1" +data-uri-to-buffer@^6.0.2: + version "6.0.2" + resolved "https://registry.yarnpkg.com/data-uri-to-buffer/-/data-uri-to-buffer-6.0.2.tgz#8a58bb67384b261a38ef18bea1810cb01badd28b" + integrity sha512-7hvf7/GW8e86rW0ptuwS3OcBGDjIi6SZva7hCyWC0yYry2cOPmLIjXAUHI6DK2HsnwJd9ifmt57i8eV2n4YNpw== dayjs@^1.11.10: version "1.11.13" resolved "https://registry.yarnpkg.com/dayjs/-/dayjs-1.11.13.tgz#92430b0139055c3ebb60150aa13e860a4b5a366c" integrity sha512-oaMBel6gjolK862uaPQOVTA7q3TZhuSvuMQAAglQDOWYO9A91IrAOUJEyKVlqJlHE0vq5p5UXxzdPfMH/x6xNg== -dayjs@^1.11.7: - version "1.11.11" - resolved "https://registry.yarnpkg.com/dayjs/-/dayjs-1.11.11.tgz#dfe0e9d54c5f8b68ccf8ca5f72ac603e7e5ed59e" - integrity sha512-okzr3f11N6WuqYtZSvm+F776mB41wRZMhKP+hc34YdW+KmtYYK9iqvHSwo2k9FEH3fhGXvOPV6yz2IcSrfRUDg== - debounce@^1.2.1: version "1.2.1" resolved "https://registry.yarnpkg.com/debounce/-/debounce-1.2.1.tgz#38881d8f4166a5c5848020c11827b834bcb3e0a5" @@ -5587,24 +4868,10 @@ debug@2.6.9, debug@^2.1.3, debug@^2.6.0: dependencies: ms "2.0.0" -debug@4, debug@^4.0.0, debug@^4.1.0, debug@^4.1.1, debug@^4.3.1, debug@^4.3.4: - version "4.3.5" - resolved "https://registry.yarnpkg.com/debug/-/debug-4.3.5.tgz#e83444eceb9fedd4a1da56d671ae2446a01a6e1e" - integrity sha512-pt0bNEmneDIvdL1Xsd9oDQ/wrQRkXDT4AUWlNZNPKvW5x/jyO9VFXkJUP07vQ2upmw5PlaITaPKc31jK13V+jg== - dependencies: - ms "2.1.2" - -debug@4.3.4: - version "4.3.4" - resolved "https://registry.yarnpkg.com/debug/-/debug-4.3.4.tgz#1319f6579357f2338d3337d2cdd4914bb5dcc865" - integrity sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ== - dependencies: - ms "2.1.2" - -debug@^4.3.6: - version "4.3.7" - resolved "https://registry.yarnpkg.com/debug/-/debug-4.3.7.tgz#87945b4151a011d76d95a198d7111c865c360a52" - integrity sha512-Er2nc/H7RrMXZBFCEim6TCmMk02Z8vLC2Rbi1KEBggpo0fS6l0S1nnapwmIi3yW/+GOJap1Krg4w0Hg80oCqgQ== +debug@4, debug@^4.0.0, debug@^4.1.0, debug@^4.1.1, debug@^4.3.1, debug@^4.3.4, debug@^4.3.5, debug@^4.3.6, debug@^4.4.0: + version "4.4.0" + resolved "https://registry.yarnpkg.com/debug/-/debug-4.4.0.tgz#2b3f2aea2ffeb776477460267377dc8710faba8a" + integrity sha512-6WTZ/IxCY/T6BALoZHaE4ctp9xm+Z5kY/pzYaCHRFeyVhojxlrm+46y68HA6hr0TcwEssoxNiDEUJQjfPZ/RYA== dependencies: ms "^2.1.3" @@ -5663,7 +4930,7 @@ define-lazy-prop@^2.0.0: resolved "https://registry.yarnpkg.com/define-lazy-prop/-/define-lazy-prop-2.0.0.tgz#3f7ae421129bcaaac9bc74905c98a0009ec9ee7f" integrity sha512-Ds09qNh8yw3khSjiJjiUInaGX9xlqZDY7JVryGxdxV7NPeuqQfplOpQ66yJFZut3jLa5zOwkXw1g9EI2uKh4Og== -define-properties@^1.2.0, define-properties@^1.2.1: +define-properties@^1.2.1: version "1.2.1" resolved "https://registry.yarnpkg.com/define-properties/-/define-properties-1.2.1.tgz#10781cc616eb951a80a034bafcaa7377f6af2b6c" integrity sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg== @@ -5672,6 +4939,15 @@ define-properties@^1.2.0, define-properties@^1.2.1: has-property-descriptors "^1.0.0" object-keys "^1.1.1" +degenerator@^5.0.0: + version "5.0.1" + resolved "https://registry.yarnpkg.com/degenerator/-/degenerator-5.0.1.tgz#9403bf297c6dad9a1ece409b37db27954f91f2f5" + integrity sha512-TllpMR/t0M5sqCXfj85i4XaAzxmS5tVA16dqvdkMwGmzI+dXLXnw3J+3Vdv7VKw+ThlTMboK6i9rnZ6Nntj5CQ== + dependencies: + ast-types "^0.13.4" + escodegen "^2.1.0" + esprima "^4.0.1" + del@^6.1.1: version "6.1.1" resolved "https://registry.yarnpkg.com/del/-/del-6.1.1.tgz#3b70314f1ec0aa325c6b14eb36b95786671edb7a" @@ -5741,10 +5017,10 @@ devlop@^1.0.0, devlop@^1.1.0: dependencies: dequal "^2.0.0" -devtools-protocol@0.0.1045489: - version "0.0.1045489" - resolved "https://registry.yarnpkg.com/devtools-protocol/-/devtools-protocol-0.0.1045489.tgz#f959ad560b05acd72d55644bc3fb8168a83abf28" - integrity sha512-D+PTmWulkuQW4D1NTiCRCFxF7pQPn0hgp4YyX4wAQ6xYXKOadSWPR3ENGDQ47MW/Ewc9v2rpC/UEEGahgBYpSQ== +devtools-protocol@0.0.1312386: + version "0.0.1312386" + resolved "https://registry.yarnpkg.com/devtools-protocol/-/devtools-protocol-0.0.1312386.tgz#5ab824d6f1669ec6c6eb0fba047e73601d969052" + integrity sha512-DPnhUXvmvKT2dFA/j7B+riVLUt9Q6RKJlcppojL5CoRywJJKLDYnRlw0gTFKfgDPHP5E04UoB71SxoJlVZy8FA== diff@^5.0.0: version "5.2.0" @@ -5770,10 +5046,10 @@ docusaurus-gtm-plugin@^0.0.2: resolved "https://registry.yarnpkg.com/docusaurus-gtm-plugin/-/docusaurus-gtm-plugin-0.0.2.tgz#f39864b54ca594e3281902c23b6df0763761602b" integrity sha512-Xx/df0Ppd5SultlzUj9qlQk2lX9mNVfTb41juyBUPZ1Nc/5dNx+uN0VuLyF4JEObkDRrUY1EFo9fEUDo8I6QOQ== -docusaurus-plugin-redoc@2.1.1: - version "2.1.1" - resolved "https://registry.yarnpkg.com/docusaurus-plugin-redoc/-/docusaurus-plugin-redoc-2.1.1.tgz#b930b007844d918f186631cb8bd42da7e6314f79" - integrity sha512-gf9HbFAKPZu17rbx+3C6vIpfMMTuvUFG8rRKeuHro1B5wUutBSjE5/VjB1owVGjIJQ74OgVKJvgczqUjhcQcjQ== +docusaurus-plugin-redoc@2.2.1: + version "2.2.1" + resolved "https://registry.yarnpkg.com/docusaurus-plugin-redoc/-/docusaurus-plugin-redoc-2.2.1.tgz#9c9ec63cf1c31151d7c3cbdcc01864563897f1ee" + integrity sha512-zwP5RfTLH3C4fAzCbOzJ0UJFNQ7rT1CU0C5rAWDiB86m9p2fKWS05NHeDdGE+tOsOjzEBBMSky8ooEFzo78yXA== dependencies: "@redocly/openapi-core" "1.16.0" redoc "2.1.5" @@ -5783,15 +5059,17 @@ docusaurus-pushfeedback@^1.0.1: resolved "https://registry.yarnpkg.com/docusaurus-pushfeedback/-/docusaurus-pushfeedback-1.0.1.tgz#9bff88b897ed8024c95eef1c4a5a163f7c32cd71" integrity sha512-pD9RvbKKivQmIcGrXfDD+UMlavK0yAt/OhhUG/pz8sdfgSU0Hx5AmlEc/xJAsEYj78aVSWX3SV6/XXoksudjDg== -docusaurus-theme-redoc@2.1.1: - version "2.1.1" - resolved "https://registry.yarnpkg.com/docusaurus-theme-redoc/-/docusaurus-theme-redoc-2.1.1.tgz#2e6ba70aac88e053cc7f527970a7b22a66424012" - integrity sha512-a9yuYyGVhj7NgBYiqJyjLEkJg/yTdsqg9Rn/cG8YXMIFwxIpn4tanIplUqwisK2PS81ZxOv7SfSgvGm/FSi/wA== +docusaurus-theme-redoc@2.2.1: + version "2.2.1" + resolved "https://registry.yarnpkg.com/docusaurus-theme-redoc/-/docusaurus-theme-redoc-2.2.1.tgz#c8f9b05023735a5f07faa2471be5e04fdaf209f2" + integrity sha512-QO9ZU4/vWJTuCYiE4S14u4xEZEOHRNCqdT4wvPma0J8YII+z1kNSk2IIDSJDFMVHVZbOVc0KsUh7YpWrCh54nw== dependencies: "@redocly/openapi-core" "1.16.0" clsx "^1.2.1" lodash "^4.17.21" mobx "^6.12.4" + postcss "^8.4.45" + postcss-prefix-selector "^1.16.1" redoc "2.1.5" styled-components "^6.1.11" @@ -5847,10 +5125,12 @@ domhandler@^5.0.2, domhandler@^5.0.3: dependencies: domelementtype "^2.3.0" -"dompurify@^3.0.11 <3.1.7", "dompurify@^3.0.5 <3.1.7", dompurify@^3.0.6: - version "3.1.6" - resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.1.6.tgz#43c714a94c6a7b8801850f82e756685300a027e2" - integrity sha512-cTOAhc36AalkjtBpfG6O8JimdTMWNXjiePT2xQH/ppBGi/4uIpmj8eKyIkMJErXWARyINV/sB38yf8JCLF5pbQ== +dompurify@^3.0.6, dompurify@^3.2.1: + version "3.2.3" + resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.2.3.tgz#05dd2175225324daabfca6603055a09b2382a4cd" + integrity sha512-U1U5Hzc2MO0oW3DF+G9qYN0aT7atAou4AgI0XjWz061nyBPbdxkfdhfy5uMgGn6+oLFCfn44ZGbdDqCzVmlOWA== + optionalDependencies: + "@types/trusted-types" "^2.0.7" domutils@^2.5.2, domutils@^2.8.0: version "2.8.0" @@ -5862,9 +5142,9 @@ domutils@^2.5.2, domutils@^2.8.0: domhandler "^4.2.0" domutils@^3.0.1: - version "3.1.0" - resolved "https://registry.yarnpkg.com/domutils/-/domutils-3.1.0.tgz#c47f551278d3dc4b0b1ab8cbb42d751a6f0d824e" - integrity sha512-H78uMmQtI2AhgDJjWeQmHwJJ2bLPD3GMmO7Zja/ZZh84wkm+4ut+IUnUdRa8uCGX88DiVx1j6FRe1XfxEgjEZA== + version "3.2.2" + resolved "https://registry.yarnpkg.com/domutils/-/domutils-3.2.2.tgz#edbfe2b668b0c1d97c24baf0f1062b132221bc78" + integrity sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw== dependencies: dom-serializer "^2.0.0" domelementtype "^2.3.0" @@ -5886,9 +5166,18 @@ dot-prop@^6.0.1: is-obj "^2.0.0" dotenv@^16.3.1: - version "16.4.5" - resolved "https://registry.yarnpkg.com/dotenv/-/dotenv-16.4.5.tgz#cdd3b3b604cb327e286b4762e13502f717cb099f" - integrity sha512-ZmdL2rui+eB2YwhsWzjInR8LldtZHGDoQ1ugH85ppHKwpUHL7j7rN0Ti9NCnGiQbhaZ11FpR+7ao1dNsmduNUg== + version "16.4.7" + resolved "https://registry.yarnpkg.com/dotenv/-/dotenv-16.4.7.tgz#0e20c5b82950140aa99be360a8a5f52335f53c26" + integrity sha512-47qPchRCykZC03FhkYAhrvwU4xDBFIj1QPqaarj6mdM/hgUzfPHcpkHJOn3mJAufFeeAxAzeGsr5X0M4k6fLZQ== + +dunder-proto@^1.0.1: + version "1.0.1" + resolved "https://registry.yarnpkg.com/dunder-proto/-/dunder-proto-1.0.1.tgz#d7ae667e1dc83482f8b70fd0f6eefc50da30f58a" + integrity sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A== + dependencies: + call-bind-apply-helpers "^1.0.1" + es-errors "^1.3.0" + gopd "^1.2.0" duplexer@^0.1.2: version "0.1.2" @@ -5905,20 +5194,10 @@ ee-first@1.1.1: resolved "https://registry.yarnpkg.com/ee-first/-/ee-first-1.1.1.tgz#590c61156b0ae2f4f0255732a158b266bc56b21d" integrity sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow== -electron-to-chromium@^1.4.820: - version "1.4.823" - resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.4.823.tgz#38587f7aa55bed14930f04091dfc65c39a3d8bd7" - integrity sha512-4h+oPeAiGQOHFyUJOqpoEcPj/xxlicxBzOErVeYVMMmAiXUXsGpsFd0QXBMaUUbnD8hhSfLf9uw+MlsoIA7j5w== - -electron-to-chromium@^1.5.41: - version "1.5.51" - resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.5.51.tgz#bb99216fed4892d131a8585a8593b00739310163" - integrity sha512-kKeWV57KSS8jH4alKt/jKnvHPmJgBxXzGUSbMd4eQF+iOsVPl7bz2KUmu6eo80eMP8wVioTfTyTzdMgM15WXNg== - -elkjs@^0.9.0: - version "0.9.3" - resolved "https://registry.yarnpkg.com/elkjs/-/elkjs-0.9.3.tgz#16711f8ceb09f1b12b99e971b138a8384a529161" - integrity sha512-f/ZeWvW/BCXbhGEf1Ujp29EASo/lk1FDnETgNKwJrsVvGZhUWCZyg3xLJjAsxfOmt8KjswHmI5EwCQcPMpOYhQ== +electron-to-chromium@^1.5.73: + version "1.5.84" + resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.5.84.tgz#8e334ca206bb293a20b16418bf454783365b0a95" + integrity sha512-I+DQ8xgafao9Ha6y0qjHHvpZ9OfyA1qKlkHkjywxzniORU2awxyz7f/iVJcULmrF2yrM3nHQf+iDjJtbbexd/g== emoji-regex@^8.0.0: version "8.0.0" @@ -5941,9 +5220,9 @@ emojis-list@^3.0.0: integrity sha512-/kyM18EfinwXZbno9FyUGeFh87KC8HRQBQGildHZbEuRyWFOmv1U10o9BBp8XVZDVNNuQKyIGIu5ZYAAXJ0V2Q== emoticon@^4.0.1: - version "4.0.1" - resolved "https://registry.yarnpkg.com/emoticon/-/emoticon-4.0.1.tgz#2d2bbbf231ce3a5909e185bbb64a9da703a1e749" - integrity sha512-dqx7eA9YaqyvYtUhJwT4rC1HIp82j5ybS1/vQ42ur+jBe17dJMwZE4+gvL1XadSFfxaPFFGt3Xsw+Y8akThDlw== + version "4.1.0" + resolved "https://registry.yarnpkg.com/emoticon/-/emoticon-4.1.0.tgz#d5a156868ee173095627a33de3f1e914c3dde79e" + integrity sha512-VWZfnxqwNcc51hIy/sbOdEem6D+cVtpPzEEtVAFdaas30+1dgkyaOQ4sQ6Bp0tOMqWO1v+HQfYaoodOkdhK6SQ== encodeurl@~1.0.2: version "1.0.2" @@ -5955,7 +5234,7 @@ encodeurl@~2.0.0: resolved "https://registry.yarnpkg.com/encodeurl/-/encodeurl-2.0.0.tgz#7b8ea898077d7e409d3ac45474ea38eaf0857a58" integrity sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg== -end-of-stream@^1.1.0, end-of-stream@^1.4.1: +end-of-stream@^1.1.0: version "1.4.4" resolved "https://registry.yarnpkg.com/end-of-stream/-/end-of-stream-1.4.4.tgz#5ae64a5f45057baf3626ec14da0ca5e4b2431eb0" integrity sha512-+uw1inIHVPQoaVuHzRyXd21icM+cnt4CzD5rW+NC1wjOUSTOs+Te7FOv7AhN7vS9x/oIyhLP5PR1H+phQAHu5Q== @@ -5963,9 +5242,9 @@ end-of-stream@^1.1.0, end-of-stream@^1.4.1: once "^1.4.0" enhanced-resolve@^5.17.1: - version "5.17.1" - resolved "https://registry.yarnpkg.com/enhanced-resolve/-/enhanced-resolve-5.17.1.tgz#67bfbbcc2f81d511be77d686a90267ef7f898a15" - integrity sha512-LMHl3dXhTcfv8gM4kEzIUeTQ+7fpdA0l2tUf34BddXPkz2A5xJ5L/Pchd5BL6rdccM9QGvu0sWZzK1Z1t4wwyg== + version "5.18.0" + resolved "https://registry.yarnpkg.com/enhanced-resolve/-/enhanced-resolve-5.18.0.tgz#91eb1db193896b9801251eeff1c6980278b1e404" + integrity sha512-0/r0MySGYG8YqlayBZ6MuCfECmHFdJ5qyPh8s8wa5Hnm6SaFLSK1VYCbj+NKp090Nm1caZhD+QTnmxO7esYGyQ== dependencies: graceful-fs "^4.2.4" tapable "^2.2.0" @@ -5975,11 +5254,16 @@ entities@^2.0.0: resolved "https://registry.yarnpkg.com/entities/-/entities-2.2.0.tgz#098dc90ebb83d8dffa089d55256b351d34c4da55" integrity sha512-p92if5Nz619I0w+akJrLZH0MX0Pb5DX39XOwQTtXSdQQOaYH03S1uIQp4mhOZtAXrxq4ViO67YTiLBo2638o9A== -entities@^4.2.0, entities@^4.4.0: +entities@^4.2.0, entities@^4.4.0, entities@^4.5.0: version "4.5.0" resolved "https://registry.yarnpkg.com/entities/-/entities-4.5.0.tgz#5d268ea5e7113ec74c4d033b79ea5a35a488fb48" integrity sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw== +env-paths@^2.2.1: + version "2.2.1" + resolved "https://registry.yarnpkg.com/env-paths/-/env-paths-2.2.1.tgz#420399d416ce1fbe9bc0a07c62fa68d67fd0f8f2" + integrity sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A== + enzyme-shallow-equal@^1.0.0: version "1.0.7" resolved "https://registry.yarnpkg.com/enzyme-shallow-equal/-/enzyme-shallow-equal-1.0.7.tgz#4e3aa678022387a68e6c47aff200587851885b5e" @@ -5995,111 +5279,54 @@ error-ex@^1.3.1: dependencies: is-arrayish "^0.2.1" -es-abstract@^1.22.1, es-abstract@^1.22.3, es-abstract@^1.23.0: - version "1.23.3" - resolved "https://registry.yarnpkg.com/es-abstract/-/es-abstract-1.23.3.tgz#8f0c5a35cd215312573c5a27c87dfd6c881a0aa0" - integrity sha512-e+HfNH61Bj1X9/jLc5v1owaLYuHdeHHSQlkhCBiTK8rBvKaULl/beGMxwrMXjpYrv4pz22BlY570vVePA2ho4A== - dependencies: - array-buffer-byte-length "^1.0.1" - arraybuffer.prototype.slice "^1.0.3" - available-typed-arrays "^1.0.7" - call-bind "^1.0.7" - data-view-buffer "^1.0.1" - data-view-byte-length "^1.0.1" - data-view-byte-offset "^1.0.0" - es-define-property "^1.0.0" - es-errors "^1.3.0" - es-object-atoms "^1.0.0" - es-set-tostringtag "^2.0.3" - es-to-primitive "^1.2.1" - function.prototype.name "^1.1.6" - get-intrinsic "^1.2.4" - get-symbol-description "^1.0.2" - globalthis "^1.0.3" - gopd "^1.0.1" - has-property-descriptors "^1.0.2" - has-proto "^1.0.3" - has-symbols "^1.0.3" - hasown "^2.0.2" - internal-slot "^1.0.7" - is-array-buffer "^3.0.4" - is-callable "^1.2.7" - is-data-view "^1.0.1" - is-negative-zero "^2.0.3" - is-regex "^1.1.4" - is-shared-array-buffer "^1.0.3" - is-string "^1.0.7" - is-typed-array "^1.1.13" - is-weakref "^1.0.2" - object-inspect "^1.13.1" - object-keys "^1.1.1" - object.assign "^4.1.5" - regexp.prototype.flags "^1.5.2" - safe-array-concat "^1.1.2" - safe-regex-test "^1.0.3" - string.prototype.trim "^1.2.9" - string.prototype.trimend "^1.0.8" - string.prototype.trimstart "^1.0.8" - typed-array-buffer "^1.0.2" - typed-array-byte-length "^1.0.1" - typed-array-byte-offset "^1.0.2" - typed-array-length "^1.0.6" - unbox-primitive "^1.0.2" - which-typed-array "^1.1.15" - -es-define-property@^1.0.0: - version "1.0.0" - resolved "https://registry.yarnpkg.com/es-define-property/-/es-define-property-1.0.0.tgz#c7faefbdff8b2696cf5f46921edfb77cc4ba3845" - integrity sha512-jxayLKShrEqqzJ0eumQbVhTYQM27CfT1T35+gCgDFoL82JLsXqTJ76zv6A0YLOgEnLUMvLzsDsGIrl8NFpT2gQ== - dependencies: - get-intrinsic "^1.2.4" +es-define-property@^1.0.0, es-define-property@^1.0.1: + version "1.0.1" + resolved "https://registry.yarnpkg.com/es-define-property/-/es-define-property-1.0.1.tgz#983eb2f9a6724e9303f61addf011c72e09e0b0fa" + integrity sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g== -es-errors@^1.2.1, es-errors@^1.3.0: +es-errors@^1.3.0: version "1.3.0" resolved "https://registry.yarnpkg.com/es-errors/-/es-errors-1.3.0.tgz#05f75a25dab98e4fb1dcd5e1472c0546d5057c8f" integrity sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw== es-module-lexer@^1.2.1: - version "1.5.4" - resolved "https://registry.yarnpkg.com/es-module-lexer/-/es-module-lexer-1.5.4.tgz#a8efec3a3da991e60efa6b633a7cad6ab8d26b78" - integrity sha512-MVNK56NiMrOwitFB7cqDwq0CQutbw+0BvLshJSse0MUNU+y1FC3bUS/AQg7oUng+/wKrrki7JfmwtVHkVfPLlw== + version "1.6.0" + resolved "https://registry.yarnpkg.com/es-module-lexer/-/es-module-lexer-1.6.0.tgz#da49f587fd9e68ee2404fe4e256c0c7d3a81be21" + integrity sha512-qqnD1yMU6tk/jnaMosogGySTZP8YtUgAffA9nMN+E/rjxcfRQ6IEk7IiozUjgxKoFHBGjTLnrHB/YC45r/59EQ== es-object-atoms@^1.0.0: - version "1.0.0" - resolved "https://registry.yarnpkg.com/es-object-atoms/-/es-object-atoms-1.0.0.tgz#ddb55cd47ac2e240701260bc2a8e31ecb643d941" - integrity sha512-MZ4iQ6JwHOBQjahnjwaC1ZtIBH+2ohjamzAO3oaHcXYup7qxjF2fixyH+Q71voWHeOkI2q/TnJao/KfXYIZWbw== + version "1.1.1" + resolved "https://registry.yarnpkg.com/es-object-atoms/-/es-object-atoms-1.1.1.tgz#1c4f2c4837327597ce69d2ca190a7fdd172338c1" + integrity sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA== dependencies: es-errors "^1.3.0" -es-set-tostringtag@^2.0.3: - version "2.0.3" - resolved "https://registry.yarnpkg.com/es-set-tostringtag/-/es-set-tostringtag-2.0.3.tgz#8bb60f0a440c2e4281962428438d58545af39777" - integrity sha512-3T8uNMC3OQTHkFUsFq8r/BwAXLHvU/9O9mE0fBc/MY5iq/8H7ncvO947LmYA6ldWw9Uh8Yhf25zu6n7nML5QWQ== - dependencies: - get-intrinsic "^1.2.4" - has-tostringtag "^1.0.2" - hasown "^2.0.1" - -es-to-primitive@^1.2.1: - version "1.2.1" - resolved "https://registry.yarnpkg.com/es-to-primitive/-/es-to-primitive-1.2.1.tgz#e55cd4c9cdc188bcefb03b366c736323fc5c898a" - integrity sha512-QCOllgZJtaUo9miYBcLChTUaHNjJF3PYs1VidD7AwiEj1kYxKeQTctLAezAOH5ZKRH0g2IgPn6KwB4IT8iRpvA== - dependencies: - is-callable "^1.1.4" - is-date-object "^1.0.1" - is-symbol "^1.0.2" - es6-promise@^3.2.1: version "3.3.1" resolved "https://registry.yarnpkg.com/es6-promise/-/es6-promise-3.3.1.tgz#a08cdde84ccdbf34d027a1451bc91d4bcd28a613" integrity sha512-SOp9Phqvqn7jtEUxPWdWfWoLmyt2VaJ6MpvP9Comy1MceMXqE6bxvaTu4iaxpYYPzhny28Lc+M87/c2cPK6lDg== -escalade@^3.1.1, escalade@^3.1.2: - version "3.1.2" - resolved "https://registry.yarnpkg.com/escalade/-/escalade-3.1.2.tgz#54076e9ab29ea5bf3d8f1ed62acffbb88272df27" - integrity sha512-ErCHMCae19vR8vQGe50xIsVomy19rg6gFu3+r3jkEO46suLMWBksvVyoGgQV+jOfl84ZSOSlmv6Gxa89PmTGmA== +esast-util-from-estree@^2.0.0: + version "2.0.0" + resolved "https://registry.yarnpkg.com/esast-util-from-estree/-/esast-util-from-estree-2.0.0.tgz#8d1cfb51ad534d2f159dc250e604f3478a79f1ad" + integrity sha512-4CyanoAudUSBAn5K13H4JhsMH6L9ZP7XbLVe/dKybkxMO7eDyLsT8UHl9TRNrU2Gr9nz+FovfSIjuXWJ81uVwQ== + dependencies: + "@types/estree-jsx" "^1.0.0" + devlop "^1.0.0" + estree-util-visit "^2.0.0" + unist-util-position-from-estree "^2.0.0" + +esast-util-from-js@^2.0.0: + version "2.0.1" + resolved "https://registry.yarnpkg.com/esast-util-from-js/-/esast-util-from-js-2.0.1.tgz#5147bec34cc9da44accf52f87f239a40ac3e8225" + integrity sha512-8Ja+rNJ0Lt56Pcf3TAmpBZjmx8ZcK5Ts4cAzIOjsjevg9oSXJnl6SUQ2EevU8tv3h6ZLWmoKL5H4fgWvdvfETw== + dependencies: + "@types/estree-jsx" "^1.0.0" + acorn "^8.0.0" + esast-util-from-estree "^2.0.0" + vfile-message "^4.0.0" -escalade@^3.2.0: +escalade@^3.1.1, escalade@^3.2.0: version "3.2.0" resolved "https://registry.yarnpkg.com/escalade/-/escalade-3.2.0.tgz#011a3f69856ba189dffa7dc8fcce99d2a87903e5" integrity sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA== @@ -6129,6 +5356,17 @@ escape-string-regexp@^5.0.0: resolved "https://registry.yarnpkg.com/escape-string-regexp/-/escape-string-regexp-5.0.0.tgz#4683126b500b61762f2dbebace1806e8be31b1c8" integrity sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw== +escodegen@^2.1.0: + version "2.1.0" + resolved "https://registry.yarnpkg.com/escodegen/-/escodegen-2.1.0.tgz#ba93bbb7a43986d29d6041f99f5262da773e2e17" + integrity sha512-2NlIDTwUWJN0mRPQOdtQBzbUHvdGY2P1VXSyU83Q3xKxM7WHX2Ql8dKq782Q9TgQUNOLEzEYu9bzLNj1q88I5w== + dependencies: + esprima "^4.0.1" + estraverse "^5.2.0" + esutils "^2.0.2" + optionalDependencies: + source-map "~0.6.1" + eslint-scope@5.1.1: version "5.1.1" resolved "https://registry.yarnpkg.com/eslint-scope/-/eslint-scope-5.1.1.tgz#e786e59a66cb92b3f6c1fb0d508aab174848f48c" @@ -6137,7 +5375,7 @@ eslint-scope@5.1.1: esrecurse "^4.3.0" estraverse "^4.1.1" -esprima@^4.0.0: +esprima@^4.0.0, esprima@^4.0.1: version "4.0.1" resolved "https://registry.yarnpkg.com/esprima/-/esprima-4.0.1.tgz#13b04cdb3e6c5d19df91ab6987a8695619b0aa71" integrity sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A== @@ -6193,7 +5431,15 @@ estree-util-is-identifier-name@^3.0.0: resolved "https://registry.yarnpkg.com/estree-util-is-identifier-name/-/estree-util-is-identifier-name-3.0.0.tgz#0b5ef4c4ff13508b34dcd01ecfa945f61fce5dbd" integrity sha512-hFtqIDZTIUZ9BXLb8y4pYGyk6+wekIivNVTcmvk8NoOh+VeRn5y6cEHzbURrWbfp1fIqdVipilzj+lfaadNZmg== -estree-util-to-js@^1.1.0: +estree-util-scope@^1.0.0: + version "1.0.0" + resolved "https://registry.yarnpkg.com/estree-util-scope/-/estree-util-scope-1.0.0.tgz#9cbdfc77f5cb51e3d9ed4ad9c4adbff22d43e585" + integrity sha512-2CAASclonf+JFWBNJPndcOpA8EMJwa0Q8LUFJEKqXLW6+qBvbFZuF5gItbQOs/umBUkjviCSDCbBwU2cXbmrhQ== + dependencies: + "@types/estree" "^1.0.0" + devlop "^1.0.0" + +estree-util-to-js@^1.2.0: version "1.2.0" resolved "https://registry.yarnpkg.com/estree-util-to-js/-/estree-util-to-js-1.2.0.tgz#0f80d42443e3b13bd32f7012fffa6f93603f4a36" integrity sha512-IzU74r1PK5IMMGZXUVZbmiu4A1uhiPgW5hm1GjcOfr4ZzHaMPpLNJjR7HjXiIOzi25nZDrgFTobHTkV5Q6ITjA== @@ -6212,13 +5458,13 @@ estree-util-to-js@^2.0.0: source-map "^0.7.0" estree-util-value-to-estree@^3.0.1: - version "3.1.2" - resolved "https://registry.yarnpkg.com/estree-util-value-to-estree/-/estree-util-value-to-estree-3.1.2.tgz#d2f0e5d350a6c181673eb7299743325b86a9bf5c" - integrity sha512-S0gW2+XZkmsx00tU2uJ4L9hUT7IFabbml9pHh2WQqFmAbxit++YGZne0sKJbNwkj9Wvg9E4uqWl4nCIFQMmfag== + version "3.2.1" + resolved "https://registry.yarnpkg.com/estree-util-value-to-estree/-/estree-util-value-to-estree-3.2.1.tgz#f8083e56f51efb4889794490730c036ba6167ee6" + integrity sha512-Vt2UOjyPbNQQgT5eJh+K5aATti0OjCIAGc9SgMdOFYbohuifsWclR74l0iZTJwePMgWYdX1hlVS+dedH9XV8kw== dependencies: "@types/estree" "^1.0.0" -estree-util-visit@^1.0.0, estree-util-visit@^1.2.0: +estree-util-visit@^1.0.0, estree-util-visit@^1.2.1: version "1.2.1" resolved "https://registry.yarnpkg.com/estree-util-visit/-/estree-util-visit-1.2.1.tgz#8bc2bc09f25b00827294703835aabee1cc9ec69d" integrity sha512-xbgqcrkIVbIG+lI/gzbvd9SGTJL4zqJKBFttUl5pP27KhAjtMKbX/mQXJ7qgyXpMgVy/zvpm0xoQQaGL8OloOw== @@ -6295,16 +5541,16 @@ execa@^5.0.0: strip-final-newline "^2.0.0" express@^4.17.3: - version "4.21.0" - resolved "https://registry.yarnpkg.com/express/-/express-4.21.0.tgz#d57cb706d49623d4ac27833f1cbc466b668eb915" - integrity sha512-VqcNGcj/Id5ZT1LZ/cfihi3ttTn+NJmkli2eZADigjq29qTlWi/hAQ43t/VLPq8+UX06FCEx3ByOYet6ZFblng== + version "4.21.2" + resolved "https://registry.yarnpkg.com/express/-/express-4.21.2.tgz#cf250e48362174ead6cea4a566abef0162c1ec32" + integrity sha512-28HqgMZAmih1Czt9ny7qr6ek2qddF4FclbMzwhCREB6OFfH+rXAnuNCwo1/wFvrtbgsQDb4kSbX9de9lFbrXnA== dependencies: accepts "~1.3.8" array-flatten "1.1.1" body-parser "1.20.3" content-disposition "0.5.4" content-type "~1.0.4" - cookie "0.6.0" + cookie "0.7.1" cookie-signature "1.0.6" debug "2.6.9" depd "2.0.0" @@ -6318,7 +5564,7 @@ express@^4.17.3: methods "~1.1.2" on-finished "2.4.1" parseurl "~1.3.3" - path-to-regexp "0.1.10" + path-to-regexp "0.1.12" proxy-addr "~2.0.7" qs "6.13.0" range-parser "~1.2.1" @@ -6343,7 +5589,7 @@ extend@^3.0.0: resolved "https://registry.yarnpkg.com/extend/-/extend-3.0.2.tgz#f8b1136b4071fbd8eb140aff858b1019ec2915fa" integrity sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g== -extract-zip@2.0.1: +extract-zip@^2.0.1: version "2.0.1" resolved "https://registry.yarnpkg.com/extract-zip/-/extract-zip-2.0.1.tgz#663dca56fe46df890d5f131ef4a06d22bb8ba13a" integrity sha512-GDhU9ntwuKyGXdZBUgTIe+vXnWj0fppUEtMDL0+idd5Sta8TGpHssn/eusA9mrPr9qNDym6SxAYZjNvCn/9RBg== @@ -6359,16 +5605,21 @@ fast-deep-equal@^3.1.1, fast-deep-equal@^3.1.3: resolved "https://registry.yarnpkg.com/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz#3a7d56b559d6cbc3eb512325244e619a65c6c525" integrity sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q== +fast-fifo@^1.2.0, fast-fifo@^1.3.2: + version "1.3.2" + resolved "https://registry.yarnpkg.com/fast-fifo/-/fast-fifo-1.3.2.tgz#286e31de96eb96d38a97899815740ba2a4f3640c" + integrity sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ== + fast-glob@^3.2.11, fast-glob@^3.2.9, fast-glob@^3.3.0: - version "3.3.2" - resolved "https://registry.yarnpkg.com/fast-glob/-/fast-glob-3.3.2.tgz#a904501e57cfdd2ffcded45e99a54fef55e46129" - integrity sha512-oX2ruAFQwf/Orj8m737Y5adxDQO0LAB7/S5MnxCdTNDd4p6BsyIVsv9JQsATbTSq8KHRpLwIHbVlUNatxd+1Ow== + version "3.3.3" + resolved "https://registry.yarnpkg.com/fast-glob/-/fast-glob-3.3.3.tgz#d06d585ce8dba90a16b0505c543c3ccfb3aeb818" + integrity sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg== dependencies: "@nodelib/fs.stat" "^2.0.2" "@nodelib/fs.walk" "^1.2.3" glob-parent "^5.1.2" merge2 "^1.3.0" - micromatch "^4.0.4" + micromatch "^4.0.8" fast-json-stable-stringify@^2.0.0: version "2.1.0" @@ -6380,10 +5631,22 @@ fast-safe-stringify@^2.0.7: resolved "https://registry.yarnpkg.com/fast-safe-stringify/-/fast-safe-stringify-2.1.1.tgz#c406a83b6e70d9e35ce3b30a81141df30aeba884" integrity sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA== +fast-uri@^3.0.1: + version "3.0.6" + resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.0.6.tgz#88f130b77cfaea2378d56bf970dea21257a68748" + integrity sha512-Atfo14OibSv5wAp4VWNsFYE1AchQRTv9cBGWET4pZWHzYshFSS9NQI6I57rdKn9croWVMbYFbLhJ+yJvmZIIHw== + +fast-xml-parser@^4.5.0: + version "4.5.1" + resolved "https://registry.yarnpkg.com/fast-xml-parser/-/fast-xml-parser-4.5.1.tgz#a7e665ff79b7919100a5202f23984b6150f9b31e" + integrity sha512-y655CeyUQ+jj7KBbYMc4FG01V8ZQqjN+gDYGJ50RtfsUB8iG9AmwmwoAgeKLJdmueKKMrH1RJ7yXHTSoczdv5w== + dependencies: + strnum "^1.0.5" + fastq@^1.6.0: - version "1.17.1" - resolved "https://registry.yarnpkg.com/fastq/-/fastq-1.17.1.tgz#2a523f07a4e7b1e81a42b91b8bf2254107753b47" - integrity sha512-sRVD3lWVIXWg6By68ZN7vho9a1pQcN/WBFaAAsDDFzlJjvoGx0P8z7V1t72grFJfJhu3YPZBuu25f7Kaw2jN1w== + version "1.18.0" + resolved "https://registry.yarnpkg.com/fastq/-/fastq-1.18.0.tgz#d631d7e25faffea81887fe5ea8c9010e1b36fee0" + integrity sha512-QKHXPW0hD8g4UET03SdOdunzSouc9N4AuHdsX8XNcTsuz+yYFILVNIX4l9yHABMhiEI9Db0JTTIpu0wB+Y1QQw== dependencies: reusify "^1.0.4" @@ -6497,16 +5760,9 @@ flat@^5.0.2: integrity sha512-b6suED+5/3rTpUBdG1gupIl8MPFCAMA0QXwmljLhvCUKcUvdE4gWky9zpuGCcXHOsz4J9wPGNWq6OKpmIzz3hQ== follow-redirects@^1.0.0: - version "1.15.6" - resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.15.6.tgz#7f815c0cda4249c74ff09e95ef97c23b5fd0399b" - integrity sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA== - -for-each@^0.3.3: - version "0.3.3" - resolved "https://registry.yarnpkg.com/for-each/-/for-each-0.3.3.tgz#69b447e88a0a5d32c3e7084f3f1710034b21376e" - integrity sha512-jqYfLp7mo9vIyQf8ykW2v7A+2N4QjeCeI5+Dz9XraiO1ign81wjiH7Fb9vSOWvQfNtmSa4H2RoQTrrXivdUZmw== - dependencies: - is-callable "^1.1.3" + version "1.15.9" + resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.15.9.tgz#a604fa10e443bf98ca94228d9eebcc2e8a2c8ee1" + integrity sha512-gew4GsXizNgdoRyqmyfMHyAmXsZDk6mHkSxZFCzW9gwlbtOW44CDtYavM+y+72qD/Vq2l550kMF52DT8fOLJqQ== foreach@^2.0.4: version "2.0.6" @@ -6557,15 +5813,10 @@ fresh@0.5.2: resolved "https://registry.yarnpkg.com/fresh/-/fresh-0.5.2.tgz#3d8cadd90d976569fa835ab1f8e4b23a105605a7" integrity sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q== -fs-constants@^1.0.0: - version "1.0.0" - resolved "https://registry.yarnpkg.com/fs-constants/-/fs-constants-1.0.0.tgz#6be0de9be998ce16af8afc24497b9ee9b7ccd9ad" - integrity sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow== - fs-extra@^11.1.1, fs-extra@^11.2.0: - version "11.2.0" - resolved "https://registry.yarnpkg.com/fs-extra/-/fs-extra-11.2.0.tgz#e70e17dfad64232287d01929399e0ea7c86b0e5b" - integrity sha512-PmDi3uwK5nFuXh7XDTlVnS17xJS7vW36is2+w3xcv8SVxiB4NyATf4ctkVY5bkSjX0Y4nbvZCq1/EjtEyr9ktw== + version "11.3.0" + resolved "https://registry.yarnpkg.com/fs-extra/-/fs-extra-11.3.0.tgz#0daced136bbaf65a555a326719af931adc7a314d" + integrity sha512-Z4XaCL6dUDHfP/jT25jJKMmtxvuwbkrD1vNSMFlo9lNLY2c5FHYSQgHPRZUjAB26TpDEoW9HCOgplrdbaPV/ew== dependencies: graceful-fs "^4.2.0" jsonfile "^6.0.1" @@ -6602,14 +5853,16 @@ function-bind@^1.1.2: integrity sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA== function.prototype.name@^1.1.6: - version "1.1.6" - resolved "https://registry.yarnpkg.com/function.prototype.name/-/function.prototype.name-1.1.6.tgz#cdf315b7d90ee77a4c6ee216c3c3362da07533fd" - integrity sha512-Z5kx79swU5P27WEayXM1tBi5Ze/lbIyiNgU3qyXUOf9b2rgXYyF9Dy9Cx+IQv/Lc8WCG6L82zwUPpSS9hGehIg== + version "1.1.8" + resolved "https://registry.yarnpkg.com/function.prototype.name/-/function.prototype.name-1.1.8.tgz#e68e1df7b259a5c949eeef95cdbde53edffabb78" + integrity sha512-e5iwyodOHhbMr/yNrc7fDYG4qlbIvI5gajyzPnb5TCwyhjApznQh1BMFou9b30SevY43gCJKXycoCBjMbsuW0Q== dependencies: - call-bind "^1.0.2" - define-properties "^1.2.0" - es-abstract "^1.22.1" + call-bind "^1.0.8" + call-bound "^1.0.3" + define-properties "^1.2.1" functions-have-names "^1.2.3" + hasown "^2.0.2" + is-callable "^1.2.7" functions-have-names@^1.2.3: version "1.2.3" @@ -6626,22 +5879,35 @@ get-caller-file@^2.0.5: resolved "https://registry.yarnpkg.com/get-caller-file/-/get-caller-file-2.0.5.tgz#4f94412a82db32f36e3b0b9741f8a97feb031f7e" integrity sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg== -get-intrinsic@^1.1.3, get-intrinsic@^1.2.1, get-intrinsic@^1.2.3, get-intrinsic@^1.2.4: - version "1.2.4" - resolved "https://registry.yarnpkg.com/get-intrinsic/-/get-intrinsic-1.2.4.tgz#e385f5a4b5227d449c3eabbad05494ef0abbeadd" - integrity sha512-5uYhsJH8VJBTv7oslg4BznJYhDoRI6waYCxMmCdnTrcCrHA/fCFKoTFz2JKKE0HdDFUF7/oQuhzumXJK7paBRQ== +get-intrinsic@^1.2.4, get-intrinsic@^1.2.5, get-intrinsic@^1.2.6: + version "1.2.7" + resolved "https://registry.yarnpkg.com/get-intrinsic/-/get-intrinsic-1.2.7.tgz#dcfcb33d3272e15f445d15124bc0a216189b9044" + integrity sha512-VW6Pxhsrk0KAOqs3WEd0klDiF/+V7gQOpAvY1jVU/LHmaD/kQO4523aiJuikX/QAKYiW6x8Jh+RJej1almdtCA== dependencies: + call-bind-apply-helpers "^1.0.1" + es-define-property "^1.0.1" es-errors "^1.3.0" + es-object-atoms "^1.0.0" function-bind "^1.1.2" - has-proto "^1.0.1" - has-symbols "^1.0.3" - hasown "^2.0.0" + get-proto "^1.0.0" + gopd "^1.2.0" + has-symbols "^1.1.0" + hasown "^2.0.2" + math-intrinsics "^1.1.0" get-own-enumerable-property-symbols@^3.0.0: version "3.0.2" resolved "https://registry.yarnpkg.com/get-own-enumerable-property-symbols/-/get-own-enumerable-property-symbols-3.0.2.tgz#b5fde77f22cbe35f390b4e089922c50bce6ef664" integrity sha512-I0UBV/XOz1XkIJHEUDMZAbzCThU/H8DxmSfmdGcKPnVhu2VfFqr34jr9777IyaTYvxjedWhqVIilEDsCdP5G6g== +get-proto@^1.0.0: + version "1.0.1" + resolved "https://registry.yarnpkg.com/get-proto/-/get-proto-1.0.1.tgz#150b3f2743869ef3e851ec0c49d15b1d14d00ee1" + integrity sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g== + dependencies: + dunder-proto "^1.0.1" + es-object-atoms "^1.0.0" + get-stream@^5.1.0: version "5.2.0" resolved "https://registry.yarnpkg.com/get-stream/-/get-stream-5.2.0.tgz#4966a1795ee5ace65e706c4b7beb71257d6e22d3" @@ -6654,14 +5920,14 @@ get-stream@^6.0.0, get-stream@^6.0.1: resolved "https://registry.yarnpkg.com/get-stream/-/get-stream-6.0.1.tgz#a262d8eef67aced57c2852ad6167526a43cbf7b7" integrity sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg== -get-symbol-description@^1.0.2: - version "1.0.2" - resolved "https://registry.yarnpkg.com/get-symbol-description/-/get-symbol-description-1.0.2.tgz#533744d5aa20aca4e079c8e5daf7fd44202821f5" - integrity sha512-g0QYk1dZBxGwk+Ngc+ltRH2IBp2f7zBkBMBJZCDerh6EhlhSR6+9irMCuT/09zD6qkarHUSn529sK/yL4S27mg== +get-uri@^6.0.1: + version "6.0.4" + resolved "https://registry.yarnpkg.com/get-uri/-/get-uri-6.0.4.tgz#6daaee9e12f9759e19e55ba313956883ef50e0a7" + integrity sha512-E1b1lFFLvLgak2whF2xDBcOy6NLVGZBqqjJjsIhvopKfWWEi64pLVTWWehV8KlLerZkfNTA95sTe2OdJKm1OzQ== dependencies: - call-bind "^1.0.5" - es-errors "^1.3.0" - get-intrinsic "^1.2.4" + basic-ftp "^5.0.2" + data-uri-to-buffer "^6.0.2" + debug "^4.3.4" github-slugger@^1.5.0: version "1.5.0" @@ -6727,13 +5993,10 @@ globals@^11.1.0: resolved "https://registry.yarnpkg.com/globals/-/globals-11.12.0.tgz#ab8795338868a0babd8525758018c2a7eb95c42e" integrity sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA== -globalthis@^1.0.3: - version "1.0.4" - resolved "https://registry.yarnpkg.com/globalthis/-/globalthis-1.0.4.tgz#7430ed3a975d97bfb59bcce41f5cabbafa651236" - integrity sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ== - dependencies: - define-properties "^1.2.1" - gopd "^1.0.1" +globals@^15.13.0: + version "15.14.0" + resolved "https://registry.yarnpkg.com/globals/-/globals-15.14.0.tgz#b8fd3a8941ff3b4d38f3319d433b61bbb482e73f" + integrity sha512-OkToC372DtlQeje9/zHIo5CT8lRP/FUgEOKBEhU4e0abL7J7CD24fD9ohiLN5hagG/kWCYj4K5oaxxtj2Z0Dig== globby@^11.0.1, globby@^11.0.4, globby@^11.1.0: version "11.1.0" @@ -6758,12 +6021,10 @@ globby@^13.1.1: merge2 "^1.4.1" slash "^4.0.0" -gopd@^1.0.1: - version "1.0.1" - resolved "https://registry.yarnpkg.com/gopd/-/gopd-1.0.1.tgz#29ff76de69dac7489b7c0918a5788e56477c332c" - integrity sha512-d65bNlIadxvpb/A2abVdlqKqV563juRnZ1Wtk6s1sIR8uNsXR70xqIzVqxVf1eTqDunwT2MkczEeaezCKTZhwA== - dependencies: - get-intrinsic "^1.1.3" +gopd@^1.0.1, gopd@^1.2.0: + version "1.2.0" + resolved "https://registry.yarnpkg.com/gopd/-/gopd-1.2.0.tgz#89f56b8217bdbc8802bd299df6d7f1081d7e51a1" + integrity sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg== got@^12.1.0: version "12.6.1" @@ -6819,16 +6080,6 @@ handle-thing@^2.0.0: resolved "https://registry.yarnpkg.com/handle-thing/-/handle-thing-2.0.1.tgz#857f79ce359580c340d43081cc648970d0bb234e" integrity sha512-9Qn4yBxelxoh2Ow62nP+Ka/kMnOXRi8BXnRaUwezLNhqelnN49xKz4F/dPP8OYLxLxq6JDtZb2i9XznUQbNPTg== -has-bigints@^1.0.1, has-bigints@^1.0.2: - version "1.0.2" - resolved "https://registry.yarnpkg.com/has-bigints/-/has-bigints-1.0.2.tgz#0871bd3e3d51626f6ca0966668ba35d5602d6eaa" - integrity sha512-tSvCKtBr9lkF0Ex0aQiP9N+OpV4zi2r/Nee5VkRDbaqv35RLYMzbwQfFSZZH0kR+Rd6302UJZ2p/bJCEoR3VoQ== - -has-flag@^3.0.0: - version "3.0.0" - resolved "https://registry.yarnpkg.com/has-flag/-/has-flag-3.0.0.tgz#b5d454dc2199ae225699f3467e5a07f3b955bafd" - integrity sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw== - has-flag@^4.0.0: version "4.0.0" resolved "https://registry.yarnpkg.com/has-flag/-/has-flag-4.0.0.tgz#944771fd9c81c81265c4d6941860da06bb59479b" @@ -6841,22 +6092,10 @@ has-property-descriptors@^1.0.0, has-property-descriptors@^1.0.2: dependencies: es-define-property "^1.0.0" -has-proto@^1.0.1, has-proto@^1.0.3: - version "1.0.3" - resolved "https://registry.yarnpkg.com/has-proto/-/has-proto-1.0.3.tgz#b31ddfe9b0e6e9914536a6ab286426d0214f77fd" - integrity sha512-SJ1amZAJUiZS+PhsVLf5tGydlaVB8EdFpaSO4gmiUKUOxk8qzn5AIy4ZeJUmh22znIdk/uMAUT2pl3FxzVUH+Q== - -has-symbols@^1.0.2, has-symbols@^1.0.3: - version "1.0.3" - resolved "https://registry.yarnpkg.com/has-symbols/-/has-symbols-1.0.3.tgz#bb7b2c4349251dce87b125f7bdf874aa7c8b39f8" - integrity sha512-l3LCuF6MgDNwTDKkdYGEihYjt5pRPbEg46rtlmnSPlUbgmB8LOIrKJbYYFBSbnPaJexMKtiPO8hmeRjRz2Td+A== - -has-tostringtag@^1.0.0, has-tostringtag@^1.0.2: - version "1.0.2" - resolved "https://registry.yarnpkg.com/has-tostringtag/-/has-tostringtag-1.0.2.tgz#2cdc42d40bef2e5b4eeab7c01a73c54ce7ab5abc" - integrity sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw== - dependencies: - has-symbols "^1.0.3" +has-symbols@^1.1.0: + version "1.1.0" + resolved "https://registry.yarnpkg.com/has-symbols/-/has-symbols-1.1.0.tgz#fc9c6a783a084951d0b971fe1018de813707a338" + integrity sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ== has-yarn@^3.0.0: version "3.0.0" @@ -6868,14 +6107,14 @@ has@^1.0.4: resolved "https://registry.yarnpkg.com/has/-/has-1.0.4.tgz#2eb2860e000011dae4f1406a86fe80e530fb2ec6" integrity sha512-qdSAmqLF6209RFj4VVItywPMbm3vWylknmB3nvNiUIs72xAimcM8nVYxYr7ncvZq5qzk9MKIZR8ijqD/1QuYjQ== -hasown@^2.0.0, hasown@^2.0.1, hasown@^2.0.2: +hasown@^2.0.0, hasown@^2.0.2: version "2.0.2" resolved "https://registry.yarnpkg.com/hasown/-/hasown-2.0.2.tgz#003eaf91be7adc372e84ec59dc37252cedb80003" integrity sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ== dependencies: function-bind "^1.1.2" -hast-util-from-html@^1.0.1: +hast-util-from-html@^1.0.2: version "1.0.2" resolved "https://registry.yarnpkg.com/hast-util-from-html/-/hast-util-from-html-1.0.2.tgz#2482fd701b2d8270b912b3909d6fb645d4a346cf" integrity sha512-LhrTA2gfCbLOGJq2u/asp4kwuG0y6NhWTXiPKP+n0qNukKy7hc10whqqCFfyvIA1Q5U5d0sp9HhNim9gglEH4A== @@ -6900,14 +6139,14 @@ hast-util-from-parse5@^7.0.0: web-namespaces "^2.0.0" hast-util-from-parse5@^8.0.0: - version "8.0.1" - resolved "https://registry.yarnpkg.com/hast-util-from-parse5/-/hast-util-from-parse5-8.0.1.tgz#654a5676a41211e14ee80d1b1758c399a0327651" - integrity sha512-Er/Iixbc7IEa7r/XLtuG52zoqn/b3Xng/w6aZQ0xGVxzhw5xUFxcRqdPzP6yFi/4HBYRaifaI5fQ1RH8n0ZeOQ== + version "8.0.2" + resolved "https://registry.yarnpkg.com/hast-util-from-parse5/-/hast-util-from-parse5-8.0.2.tgz#29b42758ba96535fd6021f0f533c000886c0f00f" + integrity sha512-SfMzfdAi/zAoZ1KkFEyyeXBn7u/ShQrfd675ZEE9M3qj+PMFX05xubzRyF76CCSJu8au9jgVxDV1+okFvgZU4A== dependencies: "@types/hast" "^3.0.0" "@types/unist" "^3.0.0" devlop "^1.0.0" - hastscript "^8.0.0" + hastscript "^9.0.0" property-information "^6.0.0" vfile "^6.0.0" vfile-location "^5.0.0" @@ -6928,9 +6167,9 @@ hast-util-parse-selector@^4.0.0: "@types/hast" "^3.0.0" hast-util-raw@^9.0.0: - version "9.0.4" - resolved "https://registry.yarnpkg.com/hast-util-raw/-/hast-util-raw-9.0.4.tgz#2da03e37c46eb1a6f1391f02f9b84ae65818f7ed" - integrity sha512-LHE65TD2YiNsHD3YuXcKPHXPLuYh/gjp12mOfU8jxSrm1f/yJpsb0F/KKljS6U9LJoP0Ux+tCe8iJ2AsPzTdgA== + version "9.1.0" + resolved "https://registry.yarnpkg.com/hast-util-raw/-/hast-util-raw-9.1.0.tgz#79b66b26f6f68fb50dfb4716b2cdca90d92adf2e" + integrity sha512-Y8/SBAHkZGoNkpzqqfCldijcuUKh7/su31kEBp67cFY09Wy0mTRgtsLYsiIxMJxlu0f6AA5SUTbDR8K0rxnbUw== dependencies: "@types/hast" "^3.0.0" "@types/unist" "^3.0.0" @@ -6946,7 +6185,7 @@ hast-util-raw@^9.0.0: web-namespaces "^2.0.0" zwitch "^2.0.0" -hast-util-to-estree@^2.1.0: +hast-util-to-estree@^2.3.3: version "2.3.3" resolved "https://registry.yarnpkg.com/hast-util-to-estree/-/hast-util-to-estree-2.3.3.tgz#da60142ffe19a6296923ec222aba73339c8bf470" integrity sha512-ihhPIUPxN0v0w6M5+IiAZZrn0LH2uZomeWwhn7uP7avZC6TE7lIiEh2yBMPr5+zi1aUCXq6VoYRgs2Bw9xmycQ== @@ -6968,9 +6207,9 @@ hast-util-to-estree@^2.1.0: zwitch "^2.0.0" hast-util-to-estree@^3.0.0: - version "3.1.0" - resolved "https://registry.yarnpkg.com/hast-util-to-estree/-/hast-util-to-estree-3.1.0.tgz#f2afe5e869ddf0cf690c75f9fc699f3180b51b19" - integrity sha512-lfX5g6hqVh9kjS/B9E2gSkvHH4SZNiQFiqWS0x9fENzEl+8W12RqdRxX6d/Cwxi30tPQs3bIO+aolQJNp1bIyw== + version "3.1.1" + resolved "https://registry.yarnpkg.com/hast-util-to-estree/-/hast-util-to-estree-3.1.1.tgz#b7f0b247d9f62127bb5db34e3a86c93d17279071" + integrity sha512-IWtwwmPskfSmma9RpzCappDUitC8t5jhAynHhc1m2+5trOgsrp7txscUSavc5Ic8PATyAjfrCK1wgtxh2cICVQ== dependencies: "@types/estree" "^1.0.0" "@types/estree-jsx" "^1.0.0" @@ -6985,14 +6224,14 @@ hast-util-to-estree@^3.0.0: mdast-util-mdxjs-esm "^2.0.0" property-information "^6.0.0" space-separated-tokens "^2.0.0" - style-to-object "^0.4.0" + style-to-object "^1.0.0" unist-util-position "^5.0.0" zwitch "^2.0.0" hast-util-to-jsx-runtime@^2.0.0: - version "2.3.0" - resolved "https://registry.yarnpkg.com/hast-util-to-jsx-runtime/-/hast-util-to-jsx-runtime-2.3.0.tgz#3ed27caf8dc175080117706bf7269404a0aa4f7c" - integrity sha512-H/y0+IWPdsLLS738P8tDnrQ8Z+dj12zQQ6WC11TIM21C8WFVoIxcqWXf2H3hiTVZjF1AWqoimGwrTWecWrnmRQ== + version "2.3.2" + resolved "https://registry.yarnpkg.com/hast-util-to-jsx-runtime/-/hast-util-to-jsx-runtime-2.3.2.tgz#6d11b027473e69adeaa00ca4cfb5bb68e3d282fa" + integrity sha512-1ngXYb+V9UT5h+PxNRa1O1FYguZK/XL+gkeqvp7EdHlB9oHUG0eYRo/vY5inBdcqo3RkPMC58/H94HvkbfGdyg== dependencies: "@types/estree" "^1.0.0" "@types/hast" "^3.0.0" @@ -7046,10 +6285,10 @@ hastscript@^7.0.0: property-information "^6.0.0" space-separated-tokens "^2.0.0" -hastscript@^8.0.0: - version "8.0.0" - resolved "https://registry.yarnpkg.com/hastscript/-/hastscript-8.0.0.tgz#4ef795ec8dee867101b9f23cc830d4baf4fd781a" - integrity sha512-dMOtzCEd3ABUeSIISmrETiKuyydk1w0pa+gE/uormcTpSYuaNJPbX1NU3JLyscSLjwAQM8bWMhhIlnCqnRvDTw== +hastscript@^9.0.0: + version "9.0.0" + resolved "https://registry.yarnpkg.com/hastscript/-/hastscript-9.0.0.tgz#2b76b9aa3cba8bf6d5280869f6f6f7165c230763" + integrity sha512-jzaLBGavEDKHrc5EfFImKN7nZKKBdSLIdGvCwDZ9TfzbF2ffXiov8CKE445L2Z1Ek2t/m4SKQ2j6Ipv7NyUolw== dependencies: "@types/hast" "^3.0.0" comma-separated-tokens "^2.0.0" @@ -7200,9 +6439,17 @@ http-errors@~1.6.2: statuses ">= 1.4.0 < 2" http-parser-js@>=0.5.1: - version "0.5.8" - resolved "https://registry.yarnpkg.com/http-parser-js/-/http-parser-js-0.5.8.tgz#af23090d9ac4e24573de6f6aecc9d84a48bf20e3" - integrity sha512-SGeBX54F94Wgu5RH3X5jsDtf4eHyRogWX1XGT3b4HuW3tQPM4AaBzoUji/4AAJNXCEOWZ5O0DgZmJw1947gD5Q== + version "0.5.9" + resolved "https://registry.yarnpkg.com/http-parser-js/-/http-parser-js-0.5.9.tgz#b817b3ca0edea6236225000d795378707c169cec" + integrity sha512-n1XsPy3rXVxlqxVioEWdC+0+M+SQw0DpJynwtOPo1X+ZlvdzTLtDBIJJlDQTnwZIFJrZSzSGmIOUdP8tu+SgLw== + +http-proxy-agent@^7.0.0, http-proxy-agent@^7.0.1: + version "7.0.2" + resolved "https://registry.yarnpkg.com/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz#9a8b1f246866c028509486585f62b8f2c18c270e" + integrity sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig== + dependencies: + agent-base "^7.1.0" + debug "^4.3.4" http-proxy-middleware@^2.0.3: version "2.0.7" @@ -7237,20 +6484,12 @@ http2-wrapper@^2.1.10: quick-lru "^5.1.1" resolve-alpn "^1.2.0" -https-proxy-agent@5.0.1: - version "5.0.1" - resolved "https://registry.yarnpkg.com/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz#c59ef224a04fe8b754f3db0063a25ea30d0005d6" - integrity sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA== - dependencies: - agent-base "6" - debug "4" - -https-proxy-agent@^7.0.4: - version "7.0.5" - resolved "https://registry.yarnpkg.com/https-proxy-agent/-/https-proxy-agent-7.0.5.tgz#9e8b5013873299e11fab6fd548405da2d6c602b2" - integrity sha512-1e4Wqeblerz+tMKPIq2EMGiiWW1dIjZOksyHWSUm1rmuvw/how9hBHZ38lAGj5ID4Ik6EdkOw7NmWPy6LAwalw== +https-proxy-agent@^7.0.4, https-proxy-agent@^7.0.6: + version "7.0.6" + resolved "https://registry.yarnpkg.com/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz#da8dfeac7da130b05c2ba4b59c9b6cd66611a6b9" + integrity sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw== dependencies: - agent-base "^7.0.2" + agent-base "^7.1.2" debug "4" human-signals@^2.1.0: @@ -7283,14 +6522,14 @@ ieee754@^1.1.13: integrity sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA== ignore@^5.2.0, ignore@^5.2.4: - version "5.3.1" - resolved "https://registry.yarnpkg.com/ignore/-/ignore-5.3.1.tgz#5073e554cd42c5b33b394375f538b8593e34d4ef" - integrity sha512-5Fytz/IraMjqpwfd34ke28PTVMjZjJG2MPn5t7OE4eUCUNf8BAa7b5WUS9/Qvr6mwOQS7Mk6vdsMno5he+T8Xw== + version "5.3.2" + resolved "https://registry.yarnpkg.com/ignore/-/ignore-5.3.2.tgz#3cd40e729f3643fd87cb04e50bf0eb722bc596f5" + integrity sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g== -image-size@^1.0.2: - version "1.1.1" - resolved "https://registry.yarnpkg.com/image-size/-/image-size-1.1.1.tgz#ddd67d4dc340e52ac29ce5f546a09f4e29e840ac" - integrity sha512-541xKlUw6jr/6gGuk92F+mYM5zaFAc5ahphvkqvNe2bQ6gVBkd6bfrmVJ2t4KDAfikAYZyIqTnktX3i6/aQDrQ== +image-size@^1.0.2, image-size@^1.2.0: + version "1.2.0" + resolved "https://registry.yarnpkg.com/image-size/-/image-size-1.2.0.tgz#312af27a2ff4ff58595ad00b9344dd684c910df6" + integrity sha512-4S8fwbO6w3GeCVN6OPtA9I5IGKkcDMPcKndtUlpJuCwu7JLjtj7JZpwqLuyY2nrmQT3AWsCJLSKPsc2mPBSl3w== dependencies: queue "6.0.2" @@ -7335,7 +6574,7 @@ inflight@^1.0.4: once "^1.3.0" wrappy "1" -inherits@2, inherits@2.0.4, inherits@^2.0.1, inherits@^2.0.3, inherits@^2.0.4, inherits@~2.0.3: +inherits@2, inherits@2.0.4, inherits@^2.0.1, inherits@^2.0.3, inherits@~2.0.3: version "2.0.4" resolved "https://registry.yarnpkg.com/inherits/-/inherits-2.0.4.tgz#0fa2c64f932917c3433a0ded55363aae37416b7c" integrity sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ== @@ -7360,19 +6599,10 @@ inline-style-parser@0.1.1: resolved "https://registry.yarnpkg.com/inline-style-parser/-/inline-style-parser-0.1.1.tgz#ec8a3b429274e9c0a1f1c4ffa9453a7fef72cea1" integrity sha512-7NXolsK4CAS5+xvdj5OMMbI962hU/wvwoxk+LWR9Ek9bVtyuuYScDN6eS0rUm6TxApFpw7CX1o4uJzcd4AyD3Q== -inline-style-parser@0.2.3: - version "0.2.3" - resolved "https://registry.yarnpkg.com/inline-style-parser/-/inline-style-parser-0.2.3.tgz#e35c5fb45f3a83ed7849fe487336eb7efa25971c" - integrity sha512-qlD8YNDqyTKTyuITrDOffsl6Tdhv+UC4hcdAVuQsK4IMQ99nSgd1MIA/Q+jQYoh9r3hVUXhYh7urSRmXPkW04g== - -internal-slot@^1.0.7: - version "1.0.7" - resolved "https://registry.yarnpkg.com/internal-slot/-/internal-slot-1.0.7.tgz#c06dcca3ed874249881007b0a5523b172a190802" - integrity sha512-NGnrKwXzSms2qUUih/ILZ5JBqNTSa1+ZmP6flaIp6KmSElgE9qdndzS3cqjrDovwFdmwsGsLdeFgB6suw+1e9g== - dependencies: - es-errors "^1.3.0" - hasown "^2.0.0" - side-channel "^1.0.4" +inline-style-parser@0.2.4: + version "0.2.4" + resolved "https://registry.yarnpkg.com/inline-style-parser/-/inline-style-parser-0.2.4.tgz#f4af5fe72e612839fcd453d989a586566d695f22" + integrity sha512-0aO8FkhNZlj/ZIbNi7Lxxr12obT7cL1moPfE4tg1LkX7LlLfC6DeX4l2ZEud1ukP9jNQyNnfzQVqwbwmAATY4Q== "internmap@1 - 2": version "2.0.3" @@ -7396,6 +6626,14 @@ invariant@^2.2.4: dependencies: loose-envify "^1.0.0" +ip-address@^9.0.5: + version "9.0.5" + resolved "https://registry.yarnpkg.com/ip-address/-/ip-address-9.0.5.tgz#117a960819b08780c3bd1f14ef3c1cc1d3f3ea5a" + integrity sha512-zHtQzGojZXTwZTHQqra+ETKd4Sn3vgi7uBmlPoXVWZqYvuKmtI0l/VZTjqGmJY9x88GGOaZ9+G9ES8hC4T4X8g== + dependencies: + jsbn "1.1.0" + sprintf-js "^1.1.3" + ipaddr.js@1.9.1: version "1.9.1" resolved "https://registry.yarnpkg.com/ipaddr.js/-/ipaddr.js-1.9.1.tgz#bff38543eeb8984825079ff3a2a8e6cbd46781b3" @@ -7419,26 +6657,11 @@ is-alphanumerical@^2.0.0: is-alphabetical "^2.0.0" is-decimal "^2.0.0" -is-array-buffer@^3.0.4: - version "3.0.4" - resolved "https://registry.yarnpkg.com/is-array-buffer/-/is-array-buffer-3.0.4.tgz#7a1f92b3d61edd2bc65d24f130530ea93d7fae98" - integrity sha512-wcjaerHw0ydZwfhiKbXJWLDY8A7yV7KhjQOpb83hGgGfId/aQa4TOvwyzn2PuswW2gPCYEL/nEAiSVpdOj1lXw== - dependencies: - call-bind "^1.0.2" - get-intrinsic "^1.2.1" - is-arrayish@^0.2.1: version "0.2.1" resolved "https://registry.yarnpkg.com/is-arrayish/-/is-arrayish-0.2.1.tgz#77c99840527aa8ecb1a8ba697b80645a7a926a9d" integrity sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg== -is-bigint@^1.0.1: - version "1.0.4" - resolved "https://registry.yarnpkg.com/is-bigint/-/is-bigint-1.0.4.tgz#08147a1875bc2b32005d41ccd8291dffc6691df3" - integrity sha512-zB9CruMamjym81i2JZ3UMn54PKGsQzsJeo6xvN3HJJ4CAsQNB6iRutp2To77OfCNuoxspsIhzaPoO1zyCEhFOg== - dependencies: - has-bigints "^1.0.1" - is-binary-path@~2.1.0: version "2.1.0" resolved "https://registry.yarnpkg.com/is-binary-path/-/is-binary-path-2.1.0.tgz#ea1f7f3b80f064236e83470f86c09c254fb45b09" @@ -7446,20 +6669,12 @@ is-binary-path@~2.1.0: dependencies: binary-extensions "^2.0.0" -is-boolean-object@^1.1.0: - version "1.1.2" - resolved "https://registry.yarnpkg.com/is-boolean-object/-/is-boolean-object-1.1.2.tgz#5c6dc200246dd9321ae4b885a114bb1f75f63719" - integrity sha512-gDYaKHJmnj4aWxyj6YHyXVpdQawtVLHU5cb+eztPGczf6cjuTdwve5ZIEfgXqH4e57An1D1AKf8CZ3kYrQRqYA== - dependencies: - call-bind "^1.0.2" - has-tostringtag "^1.0.0" - is-buffer@^2.0.0: version "2.0.5" resolved "https://registry.yarnpkg.com/is-buffer/-/is-buffer-2.0.5.tgz#ebc252e400d22ff8d77fa09888821a24a658c191" integrity sha512-i2R6zNFDwgEHJyQUtJEk0XFi1i0dPFn/oqjK3/vPCcDeJvW5NQ83V8QbicfF1SupOaB0h8ntgBC2YiE7dfyctQ== -is-callable@^1.1.3, is-callable@^1.1.4, is-callable@^1.2.7: +is-callable@^1.2.7: version "1.2.7" resolved "https://registry.yarnpkg.com/is-callable/-/is-callable-1.2.7.tgz#3bc2a85ea742d9e36205dcacdd72ca1fdc51b055" integrity sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA== @@ -7471,27 +6686,13 @@ is-ci@^3.0.1: dependencies: ci-info "^3.2.0" -is-core-module@^2.13.0: - version "2.14.0" - resolved "https://registry.yarnpkg.com/is-core-module/-/is-core-module-2.14.0.tgz#43b8ef9f46a6a08888db67b1ffd4ec9e3dfd59d1" - integrity sha512-a5dFJih5ZLYlRtDc0dZWP7RiKr6xIKzmn/oAYCDvdLThadVgyJwlaoQPmRtMSpz+rk0OGAgIu+TcM9HUF0fk1A== +is-core-module@^2.16.0: + version "2.16.1" + resolved "https://registry.yarnpkg.com/is-core-module/-/is-core-module-2.16.1.tgz#2a98801a849f43e2add644fbb6bc6229b19a4ef4" + integrity sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w== dependencies: hasown "^2.0.2" -is-data-view@^1.0.1: - version "1.0.1" - resolved "https://registry.yarnpkg.com/is-data-view/-/is-data-view-1.0.1.tgz#4b4d3a511b70f3dc26d42c03ca9ca515d847759f" - integrity sha512-AHkaJrsUVW6wq6JS8y3JnM/GJF/9cf+k20+iDzlSaJrinEo5+7vRiteOSwBhHRiAyQATN1AmY4hwzxJKPmYf+w== - dependencies: - is-typed-array "^1.1.13" - -is-date-object@^1.0.1: - version "1.0.5" - resolved "https://registry.yarnpkg.com/is-date-object/-/is-date-object-1.0.5.tgz#0841d5536e724c25597bf6ea62e1bd38298df31f" - integrity sha512-9YQaSxsAiSwcvS33MBk3wTCVnWK+HhF8VZR2jRxehM16QcVOdHqPn4VPHmRK4lSr38n9JriurInLcP90xsYNfQ== - dependencies: - has-tostringtag "^1.0.0" - is-decimal@^2.0.0: version "2.0.1" resolved "https://registry.yarnpkg.com/is-decimal/-/is-decimal-2.0.1.tgz#9469d2dc190d0214fd87d78b78caecc0cc14eef7" @@ -7537,23 +6738,11 @@ is-installed-globally@^0.4.0: global-dirs "^3.0.0" is-path-inside "^3.0.2" -is-negative-zero@^2.0.3: - version "2.0.3" - resolved "https://registry.yarnpkg.com/is-negative-zero/-/is-negative-zero-2.0.3.tgz#ced903a027aca6381b777a5743069d7376a49747" - integrity sha512-5KoIu2Ngpyek75jXodFvnafB6DJgr3u8uuK0LEZJjrU19DrMD3EVERaR8sjz8CCGgpZvxPl9SuE1GMVPFHx1mw== - is-npm@^6.0.0: version "6.0.0" resolved "https://registry.yarnpkg.com/is-npm/-/is-npm-6.0.0.tgz#b59e75e8915543ca5d881ecff864077cba095261" integrity sha512-JEjxbSmtPSt1c8XTkVrlujcXdKV1/tvuQ7GwKcAlyiVLeYFQ2VHat8xfrDJsIkhCdF/tZ7CiIR3sy141c6+gPQ== -is-number-object@^1.0.4: - version "1.0.7" - resolved "https://registry.yarnpkg.com/is-number-object/-/is-number-object-1.0.7.tgz#59d50ada4c45251784e9904f5246c742f07a42fc" - integrity sha512-k1U0IRzLMo7ZlYIfzRu23Oh6MiIFasgpb9X76eqfFZAqwH44UI4KTBvBYIZ1dSL9ZzChTB9ShHfLkR4pdW5krQ== - dependencies: - has-tostringtag "^1.0.0" - is-number@^7.0.0: version "7.0.0" resolved "https://registry.yarnpkg.com/is-number/-/is-number-7.0.0.tgz#7535345b896734d5f80c4d06c50955527a14f12b" @@ -7596,21 +6785,6 @@ is-plain-object@^2.0.4: dependencies: isobject "^3.0.1" -is-reference@^3.0.0: - version "3.0.2" - resolved "https://registry.yarnpkg.com/is-reference/-/is-reference-3.0.2.tgz#154747a01f45cd962404ee89d43837af2cba247c" - integrity sha512-v3rht/LgVcsdZa3O2Nqs+NMowLOxeOm7Ay9+/ARQ2F+qEoANRcqrjAZKGN0v8ymUetZGgkp26LTnGT7H0Qo9Pg== - dependencies: - "@types/estree" "*" - -is-regex@^1.1.4: - version "1.1.4" - resolved "https://registry.yarnpkg.com/is-regex/-/is-regex-1.1.4.tgz#eef5663cd59fa4c0ae339505323df6854bb15958" - integrity sha512-kvRdxDsxZjhzUX07ZnLydzS1TU/TJlTUHHY4YLL87e37oUA49DfkLqgy+VjFocowy29cKvcSiu+kIv728jTTVg== - dependencies: - call-bind "^1.0.2" - has-tostringtag "^1.0.0" - is-regexp@^1.0.0: version "1.0.0" resolved "https://registry.yarnpkg.com/is-regexp/-/is-regexp-1.0.0.tgz#fd2d883545c46bac5a633e7b9a09e87fa2cb5069" @@ -7621,51 +6795,16 @@ is-root@^2.1.0: resolved "https://registry.yarnpkg.com/is-root/-/is-root-2.1.0.tgz#809e18129cf1129644302a4f8544035d51984a9c" integrity sha512-AGOriNp96vNBd3HtU+RzFEc75FfR5ymiYv8E553I71SCeXBiMsVDUtdio1OEFvrPyLIQ9tVR5RxXIFe5PUFjMg== -is-shared-array-buffer@^1.0.2, is-shared-array-buffer@^1.0.3: - version "1.0.3" - resolved "https://registry.yarnpkg.com/is-shared-array-buffer/-/is-shared-array-buffer-1.0.3.tgz#1237f1cba059cdb62431d378dcc37d9680181688" - integrity sha512-nA2hv5XIhLR3uVzDDfCIknerhx8XUKnstuOERPNNIinXG7v9u+ohXF67vxm4TPTEPU6lm61ZkwP3c9PCB97rhg== - dependencies: - call-bind "^1.0.7" - is-stream@^2.0.0: version "2.0.1" resolved "https://registry.yarnpkg.com/is-stream/-/is-stream-2.0.1.tgz#fac1e3d53b97ad5a9d0ae9cef2389f5810a5c077" integrity sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg== -is-string@^1.0.5, is-string@^1.0.7: - version "1.0.7" - resolved "https://registry.yarnpkg.com/is-string/-/is-string-1.0.7.tgz#0dd12bf2006f255bb58f695110eff7491eebc0fd" - integrity sha512-tE2UXzivje6ofPW7l23cjDOMa09gb7xlAqG6jG5ej6uPV32TlWP3NKPigtaGeHNu9fohccRYvIiZMfOOnOYUtg== - dependencies: - has-tostringtag "^1.0.0" - -is-symbol@^1.0.2, is-symbol@^1.0.3: - version "1.0.4" - resolved "https://registry.yarnpkg.com/is-symbol/-/is-symbol-1.0.4.tgz#a6dac93b635b063ca6872236de88910a57af139c" - integrity sha512-C/CPBqKWnvdcxqIARxyOh4v1UUEOCHpgDa0WYgpKDFMszcrPcffg5uhwSgPCLD2WWxmq6isisz87tzT01tuGhg== - dependencies: - has-symbols "^1.0.2" - -is-typed-array@^1.1.13: - version "1.1.13" - resolved "https://registry.yarnpkg.com/is-typed-array/-/is-typed-array-1.1.13.tgz#d6c5ca56df62334959322d7d7dd1cca50debe229" - integrity sha512-uZ25/bUAlUY5fR4OKT4rZQEBrzQWYV9ZJYGGsUmEJ6thodVJ1HX64ePQ6Z0qPWP+m+Uq6e9UugrE38jeYsDSMw== - dependencies: - which-typed-array "^1.1.14" - is-typedarray@^1.0.0: version "1.0.0" resolved "https://registry.yarnpkg.com/is-typedarray/-/is-typedarray-1.0.0.tgz#e479c80858df0c1b11ddda6940f96011fcda4a9a" integrity sha512-cyA56iCMHAh5CdzjJIa4aohJyeO1YbwLi3Jc35MmRU6poroFjIGZzUzupGiRPOjgHg9TLu43xbpwXk523fMxKA== -is-weakref@^1.0.2: - version "1.0.2" - resolved "https://registry.yarnpkg.com/is-weakref/-/is-weakref-1.0.2.tgz#9529f383a9338205e89765e0392efc2f100f06f2" - integrity sha512-qctsuLZmIQ0+vSSMfoVvyFe2+GSEvnmZ2ezTup1SBse9+twCCeial6EEi3Nc2KFcf6+qz2FBPnjXsk8xhKSaPQ== - dependencies: - call-bind "^1.0.2" - is-wsl@^2.2.0: version "2.2.0" resolved "https://registry.yarnpkg.com/is-wsl/-/is-wsl-2.2.0.tgz#74a4c76e77ca9fd3f932f290c17ea326cd157271" @@ -7683,11 +6822,6 @@ isarray@0.0.1: resolved "https://registry.yarnpkg.com/isarray/-/isarray-0.0.1.tgz#8a18acfca9a8f4177e09abfc6038939b05d1eedf" integrity sha512-D2S+3GLxWH+uhrNEcoh/fnmYeP8E8/zHl644d/jdA0g2uyXvy3sb0qxotE+ne0LtccHknQzWwZEzhak7oJ0COQ== -isarray@^2.0.5: - version "2.0.5" - resolved "https://registry.yarnpkg.com/isarray/-/isarray-2.0.5.tgz#8af1e4c1221244cc62459faf38940d4e644a5723" - integrity sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw== - isarray@~1.0.0: version "1.0.0" resolved "https://registry.yarnpkg.com/isarray/-/isarray-1.0.0.tgz#bb935d48582cba168c06834957a54a3e07124f11" @@ -7735,9 +6869,9 @@ jest-worker@^29.4.3: supports-color "^8.0.0" jiti@^1.20.0: - version "1.21.6" - resolved "https://registry.yarnpkg.com/jiti/-/jiti-1.21.6.tgz#6c7f7398dd4b3142767f9a168af2f317a428d268" - integrity sha512-2yTgeWTWzMWkHu6Jp9NKgePDaYHbntiwvYuuJLbbN9vl7DC9DvXKOB2BC3ZZ92D3cvV/aflH0osDfwpHepQ53w== + version "1.21.7" + resolved "https://registry.yarnpkg.com/jiti/-/jiti-1.21.7.tgz#9dd81043424a3d28458b193d965f0d18a2300ba9" + integrity sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A== joi@^17.9.2: version "17.13.3" @@ -7775,21 +6909,21 @@ js-yaml@^4.1.0: dependencies: argparse "^2.0.1" -jsesc@^2.5.1: - version "2.5.2" - resolved "https://registry.yarnpkg.com/jsesc/-/jsesc-2.5.2.tgz#80564d2e483dacf6e8ef209650a67df3f0c283a4" - integrity sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA== +jsbn@1.1.0: + version "1.1.0" + resolved "https://registry.yarnpkg.com/jsbn/-/jsbn-1.1.0.tgz#b01307cb29b618a1ed26ec79e911f803c4da0040" + integrity sha512-4bYVV3aAMtDTTu4+xsDYa6sy9GyJ69/amsu9sYF2zqjiEoZA5xJi3BrfX3uY+/IekIu7MwdObdbDWpoZdBv3/A== + +jsesc@^3.0.2: + version "3.1.0" + resolved "https://registry.yarnpkg.com/jsesc/-/jsesc-3.1.0.tgz#74d335a234f67ed19907fdadfac7ccf9d409825d" + integrity sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA== -jsesc@^3.0.2, jsesc@~3.0.2: +jsesc@~3.0.2: version "3.0.2" resolved "https://registry.yarnpkg.com/jsesc/-/jsesc-3.0.2.tgz#bb8b09a6597ba426425f2e4a07245c3d00b9343e" integrity sha512-xKqzzWXDttJuOcawBt4KnKHHIf5oQ/Cxax+0PWFG+DFDgHNAdi+TXECADI+RYiFUMmx8792xsMbbgXj4CwnP4g== -jsesc@~0.5.0: - version "0.5.0" - resolved "https://registry.yarnpkg.com/jsesc/-/jsesc-0.5.0.tgz#e7dee66e35d6fc16f710fe91d5cf69f70f08911d" - integrity sha512-uZz5UnB7u4T9LvwmFqXii7pZSouaRPorGs5who1Ip7VO0wxanFvBL7GkM6dTHlgX+jhBApRetaWpnDabOeTcnA== - json-buffer@3.0.1: version "3.0.1" resolved "https://registry.yarnpkg.com/json-buffer/-/json-buffer-3.0.1.tgz#9338802a30d3b6605fbe0613e094008ca8c05a13" @@ -7839,9 +6973,9 @@ jsonp@^0.2.1: debug "^2.1.3" katex@^0.16.9: - version "0.16.11" - resolved "https://registry.yarnpkg.com/katex/-/katex-0.16.11.tgz#4bc84d5584f996abece5f01c6ad11304276a33f5" - integrity sha512-RQrI8rlHY92OLf3rho/Ts8i/XvjgguEjOkO1BEXcU3N8BqPpSzBNwV/G0Ukr+P/l3ivvJUE/Fa/CwbS6HesGNQ== + version "0.16.21" + resolved "https://registry.yarnpkg.com/katex/-/katex-0.16.21.tgz#8f63c659e931b210139691f2cc7bb35166b792a3" + integrity sha512-XvqR7FgOHtWupfMiigNzmh+MgUVmDGU2kXZm899ZkPfcuoPuFxyHmXsgATDpFZDAXCI8tvinaVcDo8PIIJSo4A== dependencies: commander "^8.3.0" @@ -7852,7 +6986,7 @@ keyv@^4.5.3: dependencies: json-buffer "3.0.1" -khroma@^2.0.0, khroma@^2.1.0: +khroma@^2.1.0: version "2.1.0" resolved "https://registry.yarnpkg.com/khroma/-/khroma-2.1.0.tgz#45f2ce94ce231a437cf5b63c2e886e6eb42bbbb1" integrity sha512-Ls993zuzfayK269Svk9hzpeGUKob/sIgZzyHYdjQoAdQetRKpOLj+k/QQQ/6Qi0Yz65mlROrfd+Ev+1+7dz9Kw== @@ -7896,9 +7030,9 @@ latest-version@^7.0.0: package-json "^8.1.0" launch-editor@^2.6.0: - version "2.8.0" - resolved "https://registry.yarnpkg.com/launch-editor/-/launch-editor-2.8.0.tgz#7255d90bdba414448e2138faa770a74f28451305" - integrity sha512-vJranOAJrI/llyWGRQqiDM+adrw+k83fvmmx3+nV47g3+36xM15jE+zyZ6Ffel02+xSvuM0b2GDRosXZkbb6wA== + version "2.9.1" + resolved "https://registry.yarnpkg.com/launch-editor/-/launch-editor-2.9.1.tgz#253f173bd441e342d4344b4dae58291abb425047" + integrity sha512-Gcnl4Bd+hRO9P9icCP/RVVT2o8SFlPXofuCxvA2SaZuH45whSvf5p8x5oih5ftLiVhEI4sp5xDY+R+b3zJBh5w== dependencies: picocolors "^1.0.0" shell-quote "^1.8.1" @@ -7919,9 +7053,9 @@ leven@^3.1.0: integrity sha512-qsda+H8jTaUaN/x5vzW2rzc+8Rw4TAQ/4KjB46IwK5VH+IlVeeeje/EoZRpiXvIqjFgK84QffqPztGI3VBLG1A== lilconfig@^3.1.1: - version "3.1.2" - resolved "https://registry.yarnpkg.com/lilconfig/-/lilconfig-3.1.2.tgz#e4a7c3cb549e3a606c8dcc32e5ae1005e62c05cb" - integrity sha512-eop+wDAvpItUys0FWkHIKeC9ybYrTGbU41U5K7+bttZZeohvnY7M9dZ5kB21GNWiFT2q1OoPTvncPCgSOVO5ow== + version "3.1.3" + resolved "https://registry.yarnpkg.com/lilconfig/-/lilconfig-3.1.3.tgz#a1bcfd6257f9585bf5ae14ceeebb7b559025e4c4" + integrity sha512-/vlFKAoH5Cgt3Ie+JLhRbwOsCQePABiU3tJ1egGvyQ+33R/vcwM2Zl2QR/LzjsBeItPt3oSVXapn+m4nQDvpzw== lines-and-columns@^1.1.6: version "1.2.4" @@ -7947,13 +7081,13 @@ loader-utils@^3.2.0: resolved "https://registry.yarnpkg.com/loader-utils/-/loader-utils-3.3.1.tgz#735b9a19fd63648ca7adbd31c2327dfe281304e5" integrity sha512-FMJTLMXfCLMLfJxcX9PFqX5qD88Z5MRGaZCVzfuqeZSPsyiBzs+pahDQjbIWz2QIzPZz0NX9Zy4FX3lmK6YHIg== -local-pkg@^0.5.0: - version "0.5.0" - resolved "https://registry.yarnpkg.com/local-pkg/-/local-pkg-0.5.0.tgz#093d25a346bae59a99f80e75f6e9d36d7e8c925c" - integrity sha512-ok6z3qlYyCDS4ZEU27HaU6x/xZa9Whf8jD4ptH5UZTQYZVYeb9bnZ3ojVhiJNLiXK1Hfc0GNbLXcmZ5plLDDBg== +local-pkg@^0.5.1: + version "0.5.1" + resolved "https://registry.yarnpkg.com/local-pkg/-/local-pkg-0.5.1.tgz#69658638d2a95287534d4c2fff757980100dbb6d" + integrity sha512-9rrA30MRRP3gBD3HTGnC6cDFpaE1kVDWxWgqWJUN0RvDNAo+Nz/9GxB+nHOH0ifbVFy0hSA1V6vFDvnx54lTEQ== dependencies: - mlly "^1.4.2" - pkg-types "^1.0.3" + mlly "^1.7.3" + pkg-types "^1.2.1" locate-path@^3.0.0: version "3.0.0" @@ -8038,6 +7172,11 @@ lru-cache@^5.1.1: dependencies: yallist "^3.0.2" +lru-cache@^7.14.1: + version "7.18.3" + resolved "https://registry.yarnpkg.com/lru-cache/-/lru-cache-7.18.3.tgz#f793896e0fd0e954a59dfdd82f0773808df6aa89" + integrity sha512-jumlc0BIUrS3qJGgIkWZsyfAM7NCWiBcCDhnd+3NNM5KbBmLTgHVfWBcg6W+rLUsIpzpERPsvwUP7CckAQSOoA== + lunr@^2.3.9: version "2.3.9" resolved "https://registry.yarnpkg.com/lunr/-/lunr-2.3.9.tgz#18b123142832337dd6e964df1a5a7707b25d35e1" @@ -8061,9 +7200,9 @@ markdown-table@^2.0.0: repeat-string "^1.0.0" markdown-table@^3.0.0: - version "3.0.3" - resolved "https://registry.yarnpkg.com/markdown-table/-/markdown-table-3.0.3.tgz#e6331d30e493127e031dd385488b5bd326e4a6bd" - integrity sha512-Z1NL3Tb1M9wH4XESsCDEksWoKTdlUafKc4pt0GRwjUyXaCFZ+dc3g2erqB6zm3szA2IUSi7VnPI+o/9jnxh9hw== + version "3.0.4" + resolved "https://registry.yarnpkg.com/markdown-table/-/markdown-table-3.0.4.tgz#fe44d6d410ff9d6f2ea1797a3f60aa4d2b631c2a" + integrity sha512-wiYz4+JrLyb/DqW2hkFJxP7Vd7JuTDm77fvbM8VfEQdmSMqcImWeeRbHwZjBjIFki/VaMK2BhFi7oUUZeM5bqw== marked@^13.0.2: version "13.0.3" @@ -8075,6 +7214,11 @@ marked@^4.3.0: resolved "https://registry.yarnpkg.com/marked/-/marked-4.3.0.tgz#796362821b019f734054582038b116481b456cf3" integrity sha512-PRsaiG84bK+AMvxziE/lCFss8juXjNaWzVbN5tXAm4XjeaS9NAHhop+PjQxz2A9h8Q4M/xGmzP8vqNwy6JeK0A== +math-intrinsics@^1.1.0: + version "1.1.0" + resolved "https://registry.yarnpkg.com/math-intrinsics/-/math-intrinsics-1.1.0.tgz#a0dd74be81e2aa5c2f27e65ce283605ee4e2b7f9" + integrity sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g== + mdast-util-directive@^3.0.0: version "3.0.0" resolved "https://registry.yarnpkg.com/mdast-util-directive/-/mdast-util-directive-3.0.0.tgz#3fb1764e705bbdf0afb0d3f889e4404c3e82561f" @@ -8090,16 +7234,16 @@ mdast-util-directive@^3.0.0: unist-util-visit-parents "^6.0.0" mdast-util-find-and-replace@^3.0.0, mdast-util-find-and-replace@^3.0.1: - version "3.0.1" - resolved "https://registry.yarnpkg.com/mdast-util-find-and-replace/-/mdast-util-find-and-replace-3.0.1.tgz#a6fc7b62f0994e973490e45262e4bc07607b04e0" - integrity sha512-SG21kZHGC3XRTSUhtofZkBzZTJNM5ecCi0SK2IMKmSXR8vO3peL+kb1O0z7Zl83jKtutG4k5Wv/W7V3/YHvzPA== + version "3.0.2" + resolved "https://registry.yarnpkg.com/mdast-util-find-and-replace/-/mdast-util-find-and-replace-3.0.2.tgz#70a3174c894e14df722abf43bc250cbae44b11df" + integrity sha512-Tmd1Vg/m3Xz43afeNxDIhWRtFZgM2VLyaf4vSTYwudTyeuTneoL3qtWMA5jeLyz/O1vDJmmV4QuScFCA2tBPwg== dependencies: "@types/mdast" "^4.0.0" escape-string-regexp "^5.0.0" unist-util-is "^6.0.0" unist-util-visit-parents "^6.0.0" -mdast-util-from-markdown@^1.0.0, mdast-util-from-markdown@^1.1.0, mdast-util-from-markdown@^1.2.0, mdast-util-from-markdown@^1.3.0: +mdast-util-from-markdown@^1.0.0, mdast-util-from-markdown@^1.1.0, mdast-util-from-markdown@^1.3.1: version "1.3.1" resolved "https://registry.yarnpkg.com/mdast-util-from-markdown/-/mdast-util-from-markdown-1.3.1.tgz#9421a5a247f10d31d2faed2a30df5ec89ceafcf0" integrity sha512-4xTO/M8c82qBcnQc1tgpNtubGUW/Y1tBQ1B0i5CtSoelOLKFYlElIr3bvgREYYO5iRqbMY1YuqZng0GVOI8Qww== @@ -8118,9 +7262,9 @@ mdast-util-from-markdown@^1.0.0, mdast-util-from-markdown@^1.1.0, mdast-util-fro uvu "^0.5.0" mdast-util-from-markdown@^2.0.0: - version "2.0.1" - resolved "https://registry.yarnpkg.com/mdast-util-from-markdown/-/mdast-util-from-markdown-2.0.1.tgz#32a6e8f512b416e1f51eb817fc64bd867ebcd9cc" - integrity sha512-aJEUyzZ6TzlsX2s5B4Of7lN7EQtAxvtradMMglCQDyaTFgse6CmtmdJ15ElnVRlCg1vpNyVtbem0PWzlNieZsA== + version "2.0.2" + resolved "https://registry.yarnpkg.com/mdast-util-from-markdown/-/mdast-util-from-markdown-2.0.2.tgz#4850390ca7cf17413a9b9a0fbefcd1bc0eb4160a" + integrity sha512-uZhTV/8NBuw0WHkPTrCqDOl0zVe1BIng5ZtHoDk49ME1qqcjYmmLmOf0gELgcRMxN4w2iuIeVso5/6QymSrgmA== dependencies: "@types/mdast" "^4.0.0" "@types/unist" "^3.0.0" @@ -8148,9 +7292,9 @@ mdast-util-frontmatter@^2.0.0: micromark-extension-frontmatter "^2.0.0" mdast-util-gfm-autolink-literal@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/mdast-util-gfm-autolink-literal/-/mdast-util-gfm-autolink-literal-2.0.0.tgz#5baf35407421310a08e68c15e5d8821e8898ba2a" - integrity sha512-FyzMsduZZHSc3i0Px3PQcBT4WJY/X/RCtEJKuybiC6sjPqLv7h1yqAkmILZtuxMSsUyaLUWNp71+vQH2zqp5cg== + version "2.0.1" + resolved "https://registry.yarnpkg.com/mdast-util-gfm-autolink-literal/-/mdast-util-gfm-autolink-literal-2.0.1.tgz#abd557630337bd30a6d5a4bd8252e1c2dc0875d5" + integrity sha512-5HVP2MKaP6L+G6YaxPNjuL0BPrq9orG3TsrZ9YXbA3vDw/ACI4MEsnoDpn6ZNm7GnZgtAcONJyPhOP8tNJQavQ== dependencies: "@types/mdast" "^4.0.0" ccount "^2.0.0" @@ -8224,9 +7368,9 @@ mdast-util-mdx-expression@^1.0.0: mdast-util-to-markdown "^1.0.0" mdast-util-mdx-expression@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/mdast-util-mdx-expression/-/mdast-util-mdx-expression-2.0.0.tgz#4968b73724d320a379110d853e943a501bfd9d87" - integrity sha512-fGCu8eWdKUKNu5mohVGkhBXCXGnOTLuFqOvGMvdikr+J1w7lDJgxThOKpwRWzzbyXAU2hhSwsmssOY4yTokluw== + version "2.0.1" + resolved "https://registry.yarnpkg.com/mdast-util-mdx-expression/-/mdast-util-mdx-expression-2.0.1.tgz#43f0abac9adc756e2086f63822a38c8d3c3a5096" + integrity sha512-J6f+9hUp+ldTZqKRSg7Vw5V6MqjATc+3E4gf3CFNcuZNWD8XdyI6zQ8GqH7f8169MM6P7hMBRDVGnn7oHB9kXQ== dependencies: "@types/estree-jsx" "^1.0.0" "@types/hast" "^3.0.0" @@ -8254,9 +7398,9 @@ mdast-util-mdx-jsx@^2.0.0: vfile-message "^3.0.0" mdast-util-mdx-jsx@^3.0.0: - version "3.1.2" - resolved "https://registry.yarnpkg.com/mdast-util-mdx-jsx/-/mdast-util-mdx-jsx-3.1.2.tgz#daae777c72f9c4a106592e3025aa50fb26068e1b" - integrity sha512-eKMQDeywY2wlHc97k5eD8VC+9ASMjN8ItEZQNGwJ6E0XWKiW/Z0V5/H8pvoXUf+y+Mj0VIgeRRbujBmFn4FTyA== + version "3.2.0" + resolved "https://registry.yarnpkg.com/mdast-util-mdx-jsx/-/mdast-util-mdx-jsx-3.2.0.tgz#fd04c67a2a7499efb905a8a5c578dddc9fdada0d" + integrity sha512-lj/z8v0r6ZtsN/cGNNtemmmfoLAFZnjMbNyLzBafjzikOM+glrjNHPlf6lQDOTccj9n5b0PPihEBbhneMyGs1Q== dependencies: "@types/estree-jsx" "^1.0.0" "@types/hast" "^3.0.0" @@ -8268,11 +7412,10 @@ mdast-util-mdx-jsx@^3.0.0: mdast-util-to-markdown "^2.0.0" parse-entities "^4.0.0" stringify-entities "^4.0.0" - unist-util-remove-position "^5.0.0" unist-util-stringify-position "^4.0.0" vfile-message "^4.0.0" -mdast-util-mdx@^2.0.0: +mdast-util-mdx@^2.0.1: version "2.0.1" resolved "https://registry.yarnpkg.com/mdast-util-mdx/-/mdast-util-mdx-2.0.1.tgz#49b6e70819b99bb615d7223c088d295e53bb810f" integrity sha512-38w5y+r8nyKlGvNjSEqWrhG0w5PmnRA+wnBvm+ulYCct7nsGYhFVb0lljS9bQav4psDAS1eGkP2LMVcZBi/aqw== @@ -8363,15 +7506,16 @@ mdast-util-to-markdown@^1.0.0, mdast-util-to-markdown@^1.3.0: zwitch "^2.0.0" mdast-util-to-markdown@^2.0.0: - version "2.1.0" - resolved "https://registry.yarnpkg.com/mdast-util-to-markdown/-/mdast-util-to-markdown-2.1.0.tgz#9813f1d6e0cdaac7c244ec8c6dabfdb2102ea2b4" - integrity sha512-SR2VnIEdVNCJbP6y7kVTJgPLifdr8WEU440fQec7qHoHOUz/oJ2jmNRqdDQ3rbiStOXb2mCDGTuwsK5OPUgYlQ== + version "2.1.2" + resolved "https://registry.yarnpkg.com/mdast-util-to-markdown/-/mdast-util-to-markdown-2.1.2.tgz#f910ffe60897f04bb4b7e7ee434486f76288361b" + integrity sha512-xj68wMTvGXVOKonmog6LwyJKrYXZPvlwabaryTjLh9LuvovB/KAH+kvi8Gjj+7rJjsFi23nkUxRQv1KqSroMqA== dependencies: "@types/mdast" "^4.0.0" "@types/unist" "^3.0.0" longest-streak "^3.0.0" mdast-util-phrasing "^4.0.0" mdast-util-to-string "^4.0.0" + micromark-util-classify-character "^2.0.0" micromark-util-decode-string "^2.0.0" unist-util-visit "^5.0.0" zwitch "^2.0.0" @@ -8401,18 +7545,18 @@ mdn-data@2.0.30: integrity sha512-GaqWWShW4kv/G9IEucWScBx9G1/vsFZZJUO+tD26M8J8z3Kw5RDQjaoZe03YAClgeS/SWPOcb4nkFBTEi5DUEA== mdx-mermaid@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/mdx-mermaid/-/mdx-mermaid-2.0.0.tgz#0bc73b31615810f5f52d0031b641a859fa30de7d" - integrity sha512-vmkh4yg/EgkhAWxdFsyol5Tgk9aTnM16njgGIYk3R3SdbejPt8YV+HRYycAOstR1TJefMNAmjAyqkRjukLP7qg== + version "2.0.3" + resolved "https://registry.yarnpkg.com/mdx-mermaid/-/mdx-mermaid-2.0.3.tgz#183d2ca9598f614a079e836d611d2c60e5618315" + integrity sha512-aVLaaVbQD8KmqzEk2AdLFb02MMENWkq5QQPD25sdtiswTIWk684JoaCOmy8oV+w3pthkcy2lRp0xVKIq1sLsqg== optionalDependencies: - estree-util-to-js "^1.1.0" - estree-util-visit "^1.2.0" - hast-util-from-html "^1.0.1" - hast-util-to-estree "^2.1.0" - mdast-util-from-markdown "^1.2.0" - mdast-util-mdx "^2.0.0" - micromark-extension-mdxjs "^1.0.0" - puppeteer "^18.0.0" + estree-util-to-js "^1.2.0" + estree-util-visit "^1.2.1" + hast-util-from-html "^1.0.2" + hast-util-to-estree "^2.3.3" + mdast-util-from-markdown "^1.3.1" + mdast-util-mdx "^2.0.1" + micromark-extension-mdxjs "^1.0.1" + puppeteer "^22.15.0" media-typer@0.3.0: version "0.3.0" @@ -8441,16 +7585,15 @@ merge2@^1.3.0, merge2@^1.4.1: resolved "https://registry.yarnpkg.com/merge2/-/merge2-1.4.1.tgz#4368892f885e907455a6fd7dc55c0c9d404990ae" integrity sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg== -mermaid@>=10.4: - version "11.4.0" - resolved "https://registry.yarnpkg.com/mermaid/-/mermaid-11.4.0.tgz#e510f45700ed4b31e1dc327b3a405ad9f6907ca3" - integrity sha512-mxCfEYvADJqOiHfGpJXLs4/fAjHz448rH0pfY5fAoxiz70rQiDSzUUy4dNET2T08i46IVpjohPd6WWbzmRHiPA== +mermaid@>=10.4, mermaid@^11.4.1: + version "11.4.1" + resolved "https://registry.yarnpkg.com/mermaid/-/mermaid-11.4.1.tgz#577fad5c31a01a06d9f793e298d411f1379eecc8" + integrity sha512-Mb01JT/x6CKDWaxigwfZYuYmDZ6xtrNwNlidKZwkSrDaY9n90tdrJTV5Umk+wP1fZscGptmKFXHsXMDEVZ+Q6A== dependencies: "@braintree/sanitize-url" "^7.0.1" "@iconify/utils" "^2.1.32" "@mermaid-js/parser" "^0.3.0" "@types/d3" "^7.4.3" - "@types/dompurify" "^3.0.5" cytoscape "^3.29.2" cytoscape-cose-bilkent "^4.1.0" cytoscape-fcose "^2.2.0" @@ -8458,7 +7601,7 @@ mermaid@>=10.4: d3-sankey "^0.12.3" dagre-d3-es "7.0.11" dayjs "^1.11.10" - dompurify "^3.0.11 <3.1.7" + dompurify "^3.2.1" katex "^0.16.9" khroma "^2.1.0" lodash-es "^4.17.21" @@ -8468,32 +7611,6 @@ mermaid@>=10.4: ts-dedent "^2.2.0" uuid "^9.0.1" -mermaid@^10.9.3: - version "10.9.3" - resolved "https://registry.yarnpkg.com/mermaid/-/mermaid-10.9.3.tgz#90bc6f15c33dbe5d9507fed31592cc0d88fee9f7" - integrity sha512-V80X1isSEvAewIL3xhmz/rVmc27CVljcsbWxkxlWJWY/1kQa4XOABqpDl2qQLGKzpKm6WbTfUEKImBlUfFYArw== - dependencies: - "@braintree/sanitize-url" "^6.0.1" - "@types/d3-scale" "^4.0.3" - "@types/d3-scale-chromatic" "^3.0.0" - cytoscape "^3.28.1" - cytoscape-cose-bilkent "^4.1.0" - d3 "^7.4.0" - d3-sankey "^0.12.3" - dagre-d3-es "7.0.10" - dayjs "^1.11.7" - dompurify "^3.0.5 <3.1.7" - elkjs "^0.9.0" - katex "^0.16.9" - khroma "^2.0.0" - lodash-es "^4.17.21" - mdast-util-from-markdown "^1.3.0" - non-layered-tidy-tree-layout "^2.0.2" - stylis "^4.1.3" - ts-dedent "^2.2.0" - uuid "^9.0.0" - web-worker "^1.2.0" - methods@~1.1.2: version "1.1.2" resolved "https://registry.yarnpkg.com/methods/-/methods-1.1.2.tgz#5529a4d67654134edcc5266656835b0f851afcee" @@ -8522,9 +7639,9 @@ micromark-core-commonmark@^1.0.0, micromark-core-commonmark@^1.0.1: uvu "^0.5.0" micromark-core-commonmark@^2.0.0: - version "2.0.1" - resolved "https://registry.yarnpkg.com/micromark-core-commonmark/-/micromark-core-commonmark-2.0.1.tgz#9a45510557d068605c6e9a80f282b2bb8581e43d" - integrity sha512-CUQyKr1e///ZODyD1U3xit6zXwy1a8q2a1S1HKtIlmgvurrEpaw/Y9y6KSIbF8P59cn/NjzHyO+Q2fAyYLQrAA== + version "2.0.2" + resolved "https://registry.yarnpkg.com/micromark-core-commonmark/-/micromark-core-commonmark-2.0.2.tgz#6a45bbb139e126b3f8b361a10711ccc7c6e15e93" + integrity sha512-FKjQKbxd1cibWMM1P9N+H8TwlgGgSkWZMmfuVucLCHaYqeSvJ0hFeHsIa65pA2nYbes0f8LDHPMrd9X7Ujxg9w== dependencies: decode-named-character-reference "^1.0.0" devlop "^1.0.0" @@ -8544,9 +7661,9 @@ micromark-core-commonmark@^2.0.0: micromark-util-types "^2.0.0" micromark-extension-directive@^3.0.0: - version "3.0.0" - resolved "https://registry.yarnpkg.com/micromark-extension-directive/-/micromark-extension-directive-3.0.0.tgz#527869de497a6de9024138479091bc885dae076b" - integrity sha512-61OI07qpQrERc+0wEysLHMvoiO3s2R56x5u7glHq2Yqq6EHbH4dW25G9GfDdGCDYqA21KE6DWgNSzxSwHc2hSg== + version "3.0.2" + resolved "https://registry.yarnpkg.com/micromark-extension-directive/-/micromark-extension-directive-3.0.2.tgz#2eb61985d1995a7c1ff7621676a4f32af29409e8" + integrity sha512-wjcXHgk+PPdmvR58Le9d7zQYWy+vKEU9Se44p2CrCDPiLr2FMyiT4Fyb5UFKFC66wGB3kPlgD7q3TnoqPS7SZA== dependencies: devlop "^1.0.0" micromark-factory-space "^2.0.0" @@ -8603,9 +7720,9 @@ micromark-extension-gfm-strikethrough@^2.0.0: micromark-util-types "^2.0.0" micromark-extension-gfm-table@^2.0.0: - version "2.1.0" - resolved "https://registry.yarnpkg.com/micromark-extension-gfm-table/-/micromark-extension-gfm-table-2.1.0.tgz#5cadedfbb29fca7abf752447967003dc3b6583c9" - integrity sha512-Ub2ncQv+fwD70/l4ou27b4YzfNaCJOvyX4HxXU15m7mpYY+rjuWzsLIPZHJL253Z643RpbcP1oeIJlQ/SKW67g== + version "2.1.1" + resolved "https://registry.yarnpkg.com/micromark-extension-gfm-table/-/micromark-extension-gfm-table-2.1.1.tgz#fac70bcbf51fe65f5f44033118d39be8a9b5940b" + integrity sha512-t2OU/dXXioARrC6yWfJ4hqB7rct14e8f7m0cbI5hUmDyyIlwv5vEtooptH8INkbLzOatzKuVbQmAYcbWoyz6Dg== dependencies: devlop "^1.0.0" micromark-factory-space "^2.0.0" @@ -8690,9 +7807,9 @@ micromark-extension-mdx-jsx@^1.0.0: vfile-message "^3.0.0" micromark-extension-mdx-jsx@^3.0.0: - version "3.0.0" - resolved "https://registry.yarnpkg.com/micromark-extension-mdx-jsx/-/micromark-extension-mdx-jsx-3.0.0.tgz#4aba0797c25efb2366a3fd2d367c6b1c1159f4f5" - integrity sha512-uvhhss8OGuzR4/N17L1JwvmJIpPhAd8oByMawEKx6NVdBCbesjH4t+vjEp3ZXft9DwvlKSD07fCeI44/N0Vf2w== + version "3.0.1" + resolved "https://registry.yarnpkg.com/micromark-extension-mdx-jsx/-/micromark-extension-mdx-jsx-3.0.1.tgz#5abb83da5ddc8e473a374453e6ea56fbd66b59ad" + integrity sha512-vNuFb9czP8QCtAQcEJn0UJQJZA8Dk6DXKBqx+bg/w0WGuSxDxNr7hErW89tHUY31dUW4NqEOWwmEUNhjTFmHkg== dependencies: "@types/acorn" "^4.0.0" "@types/estree" "^1.0.0" @@ -8701,6 +7818,7 @@ micromark-extension-mdx-jsx@^3.0.0: micromark-factory-mdx-expression "^2.0.0" micromark-factory-space "^2.0.0" micromark-util-character "^2.0.0" + micromark-util-events-to-acorn "^2.0.0" micromark-util-symbol "^2.0.0" micromark-util-types "^2.0.0" vfile-message "^4.0.0" @@ -8749,7 +7867,7 @@ micromark-extension-mdxjs-esm@^3.0.0: unist-util-position-from-estree "^2.0.0" vfile-message "^4.0.0" -micromark-extension-mdxjs@^1.0.0: +micromark-extension-mdxjs@^1.0.1: version "1.0.1" resolved "https://registry.yarnpkg.com/micromark-extension-mdxjs/-/micromark-extension-mdxjs-1.0.1.tgz#f78d4671678d16395efeda85170c520ee795ded8" integrity sha512-7YA7hF6i5eKOfFUzZ+0z6avRG52GpWR8DL+kN47y3f2KhxbBZMhmxe7auOeaTBrW2DenbbZTf1ea9tA2hDpC2Q== @@ -8787,9 +7905,9 @@ micromark-factory-destination@^1.0.0: micromark-util-types "^1.0.0" micromark-factory-destination@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/micromark-factory-destination/-/micromark-factory-destination-2.0.0.tgz#857c94debd2c873cba34e0445ab26b74f6a6ec07" - integrity sha512-j9DGrQLm/Uhl2tCzcbLhy5kXsgkHUrjJHg4fFAeoMRwJmJerT9aw4FEhIbZStWN8A3qMwOp1uzHr4UL8AInxtA== + version "2.0.1" + resolved "https://registry.yarnpkg.com/micromark-factory-destination/-/micromark-factory-destination-2.0.1.tgz#8fef8e0f7081f0474fbdd92deb50c990a0264639" + integrity sha512-Xe6rDdJlkmbFRExpTOmRj9N3MaWmbAgdpSrBQvCFqhezUn4AHqJHbaEnfbVYYiexVSs//tqOdY/DxhjdCiJnIA== dependencies: micromark-util-character "^2.0.0" micromark-util-symbol "^2.0.0" @@ -8806,9 +7924,9 @@ micromark-factory-label@^1.0.0: uvu "^0.5.0" micromark-factory-label@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/micromark-factory-label/-/micromark-factory-label-2.0.0.tgz#17c5c2e66ce39ad6f4fc4cbf40d972f9096f726a" - integrity sha512-RR3i96ohZGde//4WSe/dJsxOX6vxIg9TimLAS3i4EhBAFx8Sm5SmqVfR8E87DPSR31nEAjZfbt91OMZWcNgdZw== + version "2.0.1" + resolved "https://registry.yarnpkg.com/micromark-factory-label/-/micromark-factory-label-2.0.1.tgz#5267efa97f1e5254efc7f20b459a38cb21058ba1" + integrity sha512-VFMekyQExqIW7xIChcXn4ok29YE3rnuyveW3wZQWWqF4Nv9Wk5rgJ99KzPvHjkmPXF93FXIbBp6YdW3t71/7Vg== dependencies: devlop "^1.0.0" micromark-util-character "^2.0.0" @@ -8830,12 +7948,13 @@ micromark-factory-mdx-expression@^1.0.0: vfile-message "^3.0.0" micromark-factory-mdx-expression@^2.0.0: - version "2.0.1" - resolved "https://registry.yarnpkg.com/micromark-factory-mdx-expression/-/micromark-factory-mdx-expression-2.0.1.tgz#f2a9724ce174f1751173beb2c1f88062d3373b1b" - integrity sha512-F0ccWIUHRLRrYp5TC9ZYXmZo+p2AM13ggbsW4T0b5CRKP8KHVRB8t4pwtBgTxtjRmwrK0Irwm7vs2JOZabHZfg== + version "2.0.2" + resolved "https://registry.yarnpkg.com/micromark-factory-mdx-expression/-/micromark-factory-mdx-expression-2.0.2.tgz#2afaa8ba6d5f63e0cead3e4dee643cad184ca260" + integrity sha512-5E5I2pFzJyg2CtemqAbcyCktpHXuJbABnsb32wX2U8IQKhhVFBqkcZR5LRm1WVoFqa4kTueZK4abep7wdo9nrw== dependencies: "@types/estree" "^1.0.0" devlop "^1.0.0" + micromark-factory-space "^2.0.0" micromark-util-character "^2.0.0" micromark-util-events-to-acorn "^2.0.0" micromark-util-symbol "^2.0.0" @@ -8852,9 +7971,9 @@ micromark-factory-space@^1.0.0: micromark-util-types "^1.0.0" micromark-factory-space@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/micromark-factory-space/-/micromark-factory-space-2.0.0.tgz#5e7afd5929c23b96566d0e1ae018ae4fcf81d030" - integrity sha512-TKr+LIDX2pkBJXFLzpyPyljzYK3MtmllMUMODTQJIUfDGncESaqB90db9IAUcz4AZAJFdd8U9zOp9ty1458rxg== + version "2.0.1" + resolved "https://registry.yarnpkg.com/micromark-factory-space/-/micromark-factory-space-2.0.1.tgz#36d0212e962b2b3121f8525fc7a3c7c029f334fc" + integrity sha512-zRkxjtBxxLd2Sc0d+fbnEunsTj46SWXgXciZmHq0kDYGnck/ZSGj9/wULTV95uoeYiK5hRXP2mJ98Uo4cq/LQg== dependencies: micromark-util-character "^2.0.0" micromark-util-types "^2.0.0" @@ -8870,9 +7989,9 @@ micromark-factory-title@^1.0.0: micromark-util-types "^1.0.0" micromark-factory-title@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/micromark-factory-title/-/micromark-factory-title-2.0.0.tgz#726140fc77892af524705d689e1cf06c8a83ea95" - integrity sha512-jY8CSxmpWLOxS+t8W+FG3Xigc0RDQA9bKMY/EwILvsesiRniiVMejYTE4wumNc2f4UbAa4WsHqe3J1QS1sli+A== + version "2.0.1" + resolved "https://registry.yarnpkg.com/micromark-factory-title/-/micromark-factory-title-2.0.1.tgz#237e4aa5d58a95863f01032d9ee9b090f1de6e94" + integrity sha512-5bZ+3CjhAd9eChYTHsjy6TGxpOFSKgKKJPJxr293jTbfry2KDoWkhBb6TcPVB4NmzaPhMs1Frm9AZH7OD4Cjzw== dependencies: micromark-factory-space "^2.0.0" micromark-util-character "^2.0.0" @@ -8890,9 +8009,9 @@ micromark-factory-whitespace@^1.0.0: micromark-util-types "^1.0.0" micromark-factory-whitespace@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/micromark-factory-whitespace/-/micromark-factory-whitespace-2.0.0.tgz#9e92eb0f5468083381f923d9653632b3cfb5f763" - integrity sha512-28kbwaBjc5yAI1XadbdPYHX/eDnqaUFVikLwrO7FDnKG7lpgxnvk/XGRhX/PN0mOZ+dBSZ+LgunHS+6tYQAzhA== + version "2.0.1" + resolved "https://registry.yarnpkg.com/micromark-factory-whitespace/-/micromark-factory-whitespace-2.0.1.tgz#06b26b2983c4d27bfcc657b33e25134d4868b0b1" + integrity sha512-Ob0nuZ3PKt/n0hORHyvoD9uZhr+Za8sFoP+OnMcnWK5lngSzALgQYKMr9RJVOWLqQYuyn6ulqGWSXdwf6F80lQ== dependencies: micromark-factory-space "^2.0.0" micromark-util-character "^2.0.0" @@ -8908,9 +8027,9 @@ micromark-util-character@^1.0.0, micromark-util-character@^1.1.0: micromark-util-types "^1.0.0" micromark-util-character@^2.0.0: - version "2.1.0" - resolved "https://registry.yarnpkg.com/micromark-util-character/-/micromark-util-character-2.1.0.tgz#31320ace16b4644316f6bf057531689c71e2aee1" - integrity sha512-KvOVV+X1yLBfs9dCBSopq/+G1PcgT3lAK07mC4BzXi5E7ahzMAF8oIupDDJ6mievI6F+lAATkbQQlQixJfT3aQ== + version "2.1.1" + resolved "https://registry.yarnpkg.com/micromark-util-character/-/micromark-util-character-2.1.1.tgz#2f987831a40d4c510ac261e89852c4e9703ccda6" + integrity sha512-wv8tdUTJ3thSFFFJKtpYKOYiGP2+v96Hvk4Tu8KpCAsTMs6yi+nVmGh1syvSCsaxz45J6Jbw+9DD6g97+NV67Q== dependencies: micromark-util-symbol "^2.0.0" micromark-util-types "^2.0.0" @@ -8923,9 +8042,9 @@ micromark-util-chunked@^1.0.0: micromark-util-symbol "^1.0.0" micromark-util-chunked@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/micromark-util-chunked/-/micromark-util-chunked-2.0.0.tgz#e51f4db85fb203a79dbfef23fd41b2f03dc2ef89" - integrity sha512-anK8SWmNphkXdaKgz5hJvGa7l00qmcaUQoMYsBwDlSKFKjc6gjGXPDw3FNL3Nbwq5L8gE+RCbGqTw49FK5Qyvg== + version "2.0.1" + resolved "https://registry.yarnpkg.com/micromark-util-chunked/-/micromark-util-chunked-2.0.1.tgz#47fbcd93471a3fccab86cff03847fc3552db1051" + integrity sha512-QUNFEOPELfmvv+4xiNg2sRYeS/P84pTW0TCgP5zc9FpXetHY0ab7SxKyAQCNCc1eK0459uoLI1y5oO5Vc1dbhA== dependencies: micromark-util-symbol "^2.0.0" @@ -8939,9 +8058,9 @@ micromark-util-classify-character@^1.0.0: micromark-util-types "^1.0.0" micromark-util-classify-character@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/micromark-util-classify-character/-/micromark-util-classify-character-2.0.0.tgz#8c7537c20d0750b12df31f86e976d1d951165f34" - integrity sha512-S0ze2R9GH+fu41FA7pbSqNWObo/kzwf8rN/+IGlW/4tC6oACOs8B++bh+i9bVyNnwCcuksbFwsBme5OCKXCwIw== + version "2.0.1" + resolved "https://registry.yarnpkg.com/micromark-util-classify-character/-/micromark-util-classify-character-2.0.1.tgz#d399faf9c45ca14c8b4be98b1ea481bced87b629" + integrity sha512-K0kHzM6afW/MbeWYWLjoHQv1sgg2Q9EccHEDzSkxiP/EaagNzCm7T/WMKZ3rjMbvIpvBiZgwR3dKMygtA4mG1Q== dependencies: micromark-util-character "^2.0.0" micromark-util-symbol "^2.0.0" @@ -8956,9 +8075,9 @@ micromark-util-combine-extensions@^1.0.0: micromark-util-types "^1.0.0" micromark-util-combine-extensions@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/micromark-util-combine-extensions/-/micromark-util-combine-extensions-2.0.0.tgz#75d6ab65c58b7403616db8d6b31315013bfb7ee5" - integrity sha512-vZZio48k7ON0fVS3CUgFatWHoKbbLTK/rT7pzpJ4Bjp5JjkZeasRfrS9wsBdDJK2cJLHMckXZdzPSSr1B8a4oQ== + version "2.0.1" + resolved "https://registry.yarnpkg.com/micromark-util-combine-extensions/-/micromark-util-combine-extensions-2.0.1.tgz#2a0f490ab08bff5cc2fd5eec6dd0ca04f89b30a9" + integrity sha512-OnAnH8Ujmy59JcyZw8JSbK9cGpdVY44NKgSM7E9Eh7DiLS2E9RNQf0dONaGDzEG9yjEl5hcqeIsj4hfRkLH/Bg== dependencies: micromark-util-chunked "^2.0.0" micromark-util-types "^2.0.0" @@ -8971,9 +8090,9 @@ micromark-util-decode-numeric-character-reference@^1.0.0: micromark-util-symbol "^1.0.0" micromark-util-decode-numeric-character-reference@^2.0.0: - version "2.0.1" - resolved "https://registry.yarnpkg.com/micromark-util-decode-numeric-character-reference/-/micromark-util-decode-numeric-character-reference-2.0.1.tgz#2698bbb38f2a9ba6310e359f99fcb2b35a0d2bd5" - integrity sha512-bmkNc7z8Wn6kgjZmVHOX3SowGmVdhYS7yBpMnuMnPzDq/6xwVA604DuOXMZTO1lvq01g+Adfa0pE2UKGlxL1XQ== + version "2.0.2" + resolved "https://registry.yarnpkg.com/micromark-util-decode-numeric-character-reference/-/micromark-util-decode-numeric-character-reference-2.0.2.tgz#fcf15b660979388e6f118cdb6bf7d79d73d26fe5" + integrity sha512-ccUbYk6CwVdkmCQMyr64dXz42EfHGkPQlBj5p7YVGzq8I7CtjXZJrubAYezf7Rp+bjPseiROqe7G6foFd+lEuw== dependencies: micromark-util-symbol "^2.0.0" @@ -8988,9 +8107,9 @@ micromark-util-decode-string@^1.0.0: micromark-util-symbol "^1.0.0" micromark-util-decode-string@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/micromark-util-decode-string/-/micromark-util-decode-string-2.0.0.tgz#7dfa3a63c45aecaa17824e656bcdb01f9737154a" - integrity sha512-r4Sc6leeUTn3P6gk20aFMj2ntPwn6qpDZqWvYmAG6NgvFTIlj4WtrAudLi65qYoaGdXYViXYw2pkmn7QnIFasA== + version "2.0.1" + resolved "https://registry.yarnpkg.com/micromark-util-decode-string/-/micromark-util-decode-string-2.0.1.tgz#6cb99582e5d271e84efca8e61a807994d7161eb2" + integrity sha512-nDV/77Fj6eH1ynwscYTOsbK7rR//Uj0bZXBwJZRfaLEJ1iGBR6kIfNmlNqaqJf649EP0F3NWNdeJi03elllNUQ== dependencies: decode-named-character-reference "^1.0.0" micromark-util-character "^2.0.0" @@ -9003,9 +8122,9 @@ micromark-util-encode@^1.0.0: integrity sha512-EuEzTWSTAj9PA5GOAs992GzNh2dGQO52UvAbtSOMvXTxv3Criqb6IOzJUBCmEqrrXSblJIJBbFFv6zPxpreiJw== micromark-util-encode@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/micromark-util-encode/-/micromark-util-encode-2.0.0.tgz#0921ac7953dc3f1fd281e3d1932decfdb9382ab1" - integrity sha512-pS+ROfCXAGLWCOc8egcBvT0kf27GoWMqtdarNfDcjb6YLuV5cM3ioG45Ys2qOVqeqSbjaKg72vU+Wby3eddPsA== + version "2.0.1" + resolved "https://registry.yarnpkg.com/micromark-util-encode/-/micromark-util-encode-2.0.1.tgz#0d51d1c095551cfaac368326963cf55f15f540b8" + integrity sha512-c3cVx2y4KqUnwopcO9b/SCdo2O67LwJJ/UyqGfbigahfegL9myoEFoDYZgkT7f36T0bLrM9hZTAaAyH+PCAXjw== micromark-util-events-to-acorn@^1.0.0: version "1.2.3" @@ -9041,9 +8160,9 @@ micromark-util-html-tag-name@^1.0.0: integrity sha512-VTQzcuQgFUD7yYztuQFKXT49KghjtETQ+Wv/zUjGSGBioZnkA4P1XXZPT1FHeJA6RwRXSF47yvJ1tsJdoxwO+Q== micromark-util-html-tag-name@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/micromark-util-html-tag-name/-/micromark-util-html-tag-name-2.0.0.tgz#ae34b01cbe063363847670284c6255bb12138ec4" - integrity sha512-xNn4Pqkj2puRhKdKTm8t1YHC/BAjx6CEwRFXntTaRf/x16aqka6ouVoutm+QdkISTlT7e2zU7U4ZdlDLJd2Mcw== + version "2.0.1" + resolved "https://registry.yarnpkg.com/micromark-util-html-tag-name/-/micromark-util-html-tag-name-2.0.1.tgz#e40403096481986b41c106627f98f72d4d10b825" + integrity sha512-2cNEiYDhCWKI+Gs9T0Tiysk136SnR13hhO8yW6BGNyhOC4qYFnwF1nKfD3HFAIXA5c45RrIG1ub11GiXeYd1xA== micromark-util-normalize-identifier@^1.0.0: version "1.1.0" @@ -9053,9 +8172,9 @@ micromark-util-normalize-identifier@^1.0.0: micromark-util-symbol "^1.0.0" micromark-util-normalize-identifier@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/micromark-util-normalize-identifier/-/micromark-util-normalize-identifier-2.0.0.tgz#91f9a4e65fe66cc80c53b35b0254ad67aa431d8b" - integrity sha512-2xhYT0sfo85FMrUPtHcPo2rrp1lwbDEEzpx7jiH2xXJLqBuy4H0GgXk5ToU8IEwoROtXuL8ND0ttVa4rNqYK3w== + version "2.0.1" + resolved "https://registry.yarnpkg.com/micromark-util-normalize-identifier/-/micromark-util-normalize-identifier-2.0.1.tgz#c30d77b2e832acf6526f8bf1aa47bc9c9438c16d" + integrity sha512-sxPqmo70LyARJs0w2UclACPUUEqltCkJ6PhKdMIDuJ3gSf/Q+/GIe3WKl0Ijb/GyH9lOpUkRAO2wp0GVkLvS9Q== dependencies: micromark-util-symbol "^2.0.0" @@ -9067,9 +8186,9 @@ micromark-util-resolve-all@^1.0.0: micromark-util-types "^1.0.0" micromark-util-resolve-all@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/micromark-util-resolve-all/-/micromark-util-resolve-all-2.0.0.tgz#189656e7e1a53d0c86a38a652b284a252389f364" - integrity sha512-6KU6qO7DZ7GJkaCgwBNtplXCvGkJToU86ybBAUdavvgsCiG8lSSvYxr9MhwmQ+udpzywHsl4RpGJsYWG1pDOcA== + version "2.0.1" + resolved "https://registry.yarnpkg.com/micromark-util-resolve-all/-/micromark-util-resolve-all-2.0.1.tgz#e1a2d62cdd237230a2ae11839027b19381e31e8b" + integrity sha512-VdQyxFWFT2/FGJgwQnJYbe1jjQoNTS4RjglmSjTUlpUMa95Htx9NHeYW4rGDJzbjvCsl9eLjMQwGeElsqmzcHg== dependencies: micromark-util-types "^2.0.0" @@ -9083,9 +8202,9 @@ micromark-util-sanitize-uri@^1.0.0: micromark-util-symbol "^1.0.0" micromark-util-sanitize-uri@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/micromark-util-sanitize-uri/-/micromark-util-sanitize-uri-2.0.0.tgz#ec8fbf0258e9e6d8f13d9e4770f9be64342673de" - integrity sha512-WhYv5UEcZrbAtlsnPuChHUAsu/iBPOVaEVsntLBIdpibO0ddy8OzavZz3iL2xVvBZOpolujSliP65Kq0/7KIYw== + version "2.0.1" + resolved "https://registry.yarnpkg.com/micromark-util-sanitize-uri/-/micromark-util-sanitize-uri-2.0.1.tgz#ab89789b818a58752b73d6b55238621b7faa8fd7" + integrity sha512-9N9IomZ/YuGGZZmQec1MbgxtlgougxTodVwDzzEouPKo3qFWvymFHWcnDi2vzV1ff6kas9ucW+o3yzJK9YB1AQ== dependencies: micromark-util-character "^2.0.0" micromark-util-encode "^2.0.0" @@ -9102,9 +8221,9 @@ micromark-util-subtokenize@^1.0.0: uvu "^0.5.0" micromark-util-subtokenize@^2.0.0: - version "2.0.1" - resolved "https://registry.yarnpkg.com/micromark-util-subtokenize/-/micromark-util-subtokenize-2.0.1.tgz#76129c49ac65da6e479c09d0ec4b5f29ec6eace5" - integrity sha512-jZNtiFl/1aY73yS3UGQkutD0UbhTt68qnRpw2Pifmz5wV9h8gOVsN70v+Lq/f1rKaU/W8pxRe8y8Q9FX1AOe1Q== + version "2.0.3" + resolved "https://registry.yarnpkg.com/micromark-util-subtokenize/-/micromark-util-subtokenize-2.0.3.tgz#70ffb99a454bd8c913c8b709c3dc97baefb65f96" + integrity sha512-VXJJuNxYWSoYL6AJ6OQECCFGhIU2GGHMw8tahogePBrjkG8aCCas3ibkp7RnVOSTClg2is05/R7maAhF1XyQMg== dependencies: devlop "^1.0.0" micromark-util-chunked "^2.0.0" @@ -9117,9 +8236,9 @@ micromark-util-symbol@^1.0.0, micromark-util-symbol@^1.0.1: integrity sha512-uEjpEYY6KMs1g7QfJ2eX1SQEV+ZT4rUD3UcF6l57acZvLNK7PBZL+ty82Z1qhK1/yXIY4bdx04FKMgR0g4IAag== micromark-util-symbol@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/micromark-util-symbol/-/micromark-util-symbol-2.0.0.tgz#12225c8f95edf8b17254e47080ce0862d5db8044" - integrity sha512-8JZt9ElZ5kyTnO94muPxIGS8oyElRJaiJO8EzV6ZSyGQ1Is8xwl4Q45qU5UOg+bGH4AikWziz0iN4sFLWs8PGw== + version "2.0.1" + resolved "https://registry.yarnpkg.com/micromark-util-symbol/-/micromark-util-symbol-2.0.1.tgz#e5da494e8eb2b071a0d08fb34f6cefec6c0a19b8" + integrity sha512-vs5t8Apaud9N28kgCrRUdEed4UJ+wWNvicHLPxCa9ENlYuAY31M0ETy5y1vA33YoNPDFTghEbnh6efaE8h4x0Q== micromark-util-types@^1.0.0, micromark-util-types@^1.0.1: version "1.1.0" @@ -9127,9 +8246,9 @@ micromark-util-types@^1.0.0, micromark-util-types@^1.0.1: integrity sha512-ukRBgie8TIAcacscVHSiddHjO4k/q3pnedmzMQ4iwDcK0FtFCohKOlFbaOL/mPgfnPsL3C1ZyxJa4sbWrBl3jg== micromark-util-types@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/micromark-util-types/-/micromark-util-types-2.0.0.tgz#63b4b7ffeb35d3ecf50d1ca20e68fc7caa36d95e" - integrity sha512-oNh6S2WMHWRZrmutsRmDDfkzKtxF+bc2VxLC9dvtrDIRFln627VsFP6fLMgTryGDljgLPjkrzQSDcPrjPyDJ5w== + version "2.0.1" + resolved "https://registry.yarnpkg.com/micromark-util-types/-/micromark-util-types-2.0.1.tgz#a3edfda3022c6c6b55bfb049ef5b75d70af50709" + integrity sha512-534m2WhVTddrcKVepwmVEVnUAmtrx9bfIjNoQHRqfnvdaHQiFytEhJoTgpWJvDEXCO5gLTQh3wYC1PgOJA4NSQ== micromark@^3.0.0: version "3.2.0" @@ -9155,9 +8274,9 @@ micromark@^3.0.0: uvu "^0.5.0" micromark@^4.0.0: - version "4.0.0" - resolved "https://registry.yarnpkg.com/micromark/-/micromark-4.0.0.tgz#84746a249ebd904d9658cfabc1e8e5f32cbc6249" - integrity sha512-o/sd0nMof8kYff+TqcDx3VSrgBTcZpSvYcAHIfHhv5VAuNmisCxjhx6YmxS8PFEpb9z5WKWKPdzf0jM23ro3RQ== + version "4.0.1" + resolved "https://registry.yarnpkg.com/micromark/-/micromark-4.0.1.tgz#294c2f12364759e5f9e925a767ae3dfde72223ff" + integrity sha512-eBPdkcoCNvYcxQOAKAlceo5SNdzZWfF+FcSupREAzdAh9rRmE239CEQAiTwIgblwnoM8zzj35sZ5ZwvSEOF6Kw== dependencies: "@types/debug" "^4.0.0" debug "^4.0.0" @@ -9177,7 +8296,7 @@ micromark@^4.0.0: micromark-util-symbol "^2.0.0" micromark-util-types "^2.0.0" -micromatch@^4.0.2, micromatch@^4.0.4, micromatch@^4.0.5: +micromatch@^4.0.2, micromatch@^4.0.5, micromatch@^4.0.8: version "4.0.8" resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.8.tgz#d66fa18f3a47076789320b9b1af32bd86d9fa202" integrity sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA== @@ -9185,11 +8304,16 @@ micromatch@^4.0.2, micromatch@^4.0.4, micromatch@^4.0.5: braces "^3.0.3" picomatch "^2.3.1" -mime-db@1.52.0, "mime-db@>= 1.43.0 < 2": +mime-db@1.52.0: version "1.52.0" resolved "https://registry.yarnpkg.com/mime-db/-/mime-db-1.52.0.tgz#bbabcdc02859f4987301c856e3387ce5ec43bf70" integrity sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg== +"mime-db@>= 1.43.0 < 2": + version "1.53.0" + resolved "https://registry.yarnpkg.com/mime-db/-/mime-db-1.53.0.tgz#3cb63cd820fc29896d9d4e8c32ab4fcd74ccb447" + integrity sha512-oHlN/w+3MQ3rba9rqFr6V/ypF10LSkdwUysQL7GkXoTgIWeV+tcXGA852TBxH+gsh8UWoyhR1hKcoMJTuWflpg== + mime-db@~1.33.0: version "1.33.0" resolved "https://registry.yarnpkg.com/mime-db/-/mime-db-1.33.0.tgz#a3492050a5cb9b63450541e39d9788d2272783db" @@ -9261,34 +8385,34 @@ minimist@^1.2.0: resolved "https://registry.yarnpkg.com/minimist/-/minimist-1.2.8.tgz#c1a464e7693302e082a075cee0c057741ac4772c" integrity sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA== -mkdirp-classic@^0.5.2: - version "0.5.3" - resolved "https://registry.yarnpkg.com/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz#fa10c9115cc6d8865be221ba47ee9bed78601113" - integrity sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A== +mitt@3.0.1: + version "3.0.1" + resolved "https://registry.yarnpkg.com/mitt/-/mitt-3.0.1.tgz#ea36cf0cc30403601ae074c8f77b7092cdab36d1" + integrity sha512-vKivATfr97l2/QBCYAkXYDbrIWPM2IIKEl7YPhjCvKlG3kE2gm+uBo6nEXK3M5/Ffh/FLpKExzOQ3JJoJGFKBw== -mlly@^1.4.2, mlly@^1.7.1, mlly@^1.7.2: - version "1.7.2" - resolved "https://registry.yarnpkg.com/mlly/-/mlly-1.7.2.tgz#21c0d04543207495b8d867eff0ac29fac9a023c0" - integrity sha512-tN3dvVHYVz4DhSXinXIk7u9syPYaJvio118uomkovAtWBT+RdbP6Lfh/5Lvo519YMmwBafwlh20IPTXIStscpA== +mlly@^1.7.3, mlly@^1.7.4: + version "1.7.4" + resolved "https://registry.yarnpkg.com/mlly/-/mlly-1.7.4.tgz#3d7295ea2358ec7a271eaa5d000a0f84febe100f" + integrity sha512-qmdSIPC4bDJXgZTCR7XosJiNKySV7O215tsPtDN9iEO/7q/76b/ijtgRu/+epFXSJhijtTCCGp3DWS549P3xKw== dependencies: - acorn "^8.12.1" - pathe "^1.1.2" - pkg-types "^1.2.0" + acorn "^8.14.0" + pathe "^2.0.1" + pkg-types "^1.3.0" ufo "^1.5.4" -mobx-react-lite@^4.0.7: - version "4.0.7" - resolved "https://registry.yarnpkg.com/mobx-react-lite/-/mobx-react-lite-4.0.7.tgz#f4e21e18d05c811010dcb1d3007e797924c4d90b" - integrity sha512-RjwdseshK9Mg8On5tyJZHtGD+J78ZnCnRaxeQDSiciKVQDUbfZcXhmld0VMxAwvcTnPEHZySGGewm467Fcpreg== +mobx-react-lite@^4.1.0: + version "4.1.0" + resolved "https://registry.yarnpkg.com/mobx-react-lite/-/mobx-react-lite-4.1.0.tgz#6a03ed2d94150848213cfebd7d172e123528a972" + integrity sha512-QEP10dpHHBeQNv1pks3WnHRCem2Zp636lq54M2nKO2Sarr13pL4u6diQXf65yzXUn0mkk18SyIDCm9UOJYTi1w== dependencies: - use-sync-external-store "^1.2.0" + use-sync-external-store "^1.4.0" mobx-react@^9.1.1: - version "9.1.1" - resolved "https://registry.yarnpkg.com/mobx-react/-/mobx-react-9.1.1.tgz#b96e0d5d74a3d02fc62729fd344b2a3ad2a88aae" - integrity sha512-gVV7AdSrAAxqXOJ2bAbGa5TkPqvITSzaPiiEkzpW4rRsMhSec7C2NBCJYILADHKp2tzOAIETGRsIY0UaCV5aEw== + version "9.2.0" + resolved "https://registry.yarnpkg.com/mobx-react/-/mobx-react-9.2.0.tgz#c1e4d1ed406f6664d9de0787c948bac3a7ed5893" + integrity sha512-dkGWCx+S0/1mfiuFfHRH8D9cplmwhxOV5CkXMp38u6rQGG2Pv3FWYztS0M7ncR6TyPRQKaTG/pnitInoYE9Vrw== dependencies: - mobx-react-lite "^4.0.7" + mobx-react-lite "^4.1.0" mobx@^6.12.4: version "6.13.0" @@ -9310,11 +8434,6 @@ ms@2.0.0: resolved "https://registry.yarnpkg.com/ms/-/ms-2.0.0.tgz#5608aeadfc00be6c2901df5f9861788de0d597c8" integrity sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A== -ms@2.1.2: - version "2.1.2" - resolved "https://registry.yarnpkg.com/ms/-/ms-2.1.2.tgz#d09d1f357b443f493382a8eb3ccd183872ae6009" - integrity sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w== - ms@2.1.3, ms@^2.1.3: version "2.1.3" resolved "https://registry.yarnpkg.com/ms/-/ms-2.1.3.tgz#574c8138ce1d2b5861f0b44579dbadd60c6615b2" @@ -9328,21 +8447,31 @@ multicast-dns@^7.2.5: dns-packet "^5.2.2" thunky "^1.0.2" -nanoid@^3.3.7: - version "3.3.7" - resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.7.tgz#d0c301a691bc8d54efa0a2226ccf3fe2fd656bd8" - integrity sha512-eSRppjcPIatRIMC1U6UngP8XFcz8MQWGQdt1MTBQ7NaAmvXDfvNxbvWV3x2y6CdEUciCSsDHDQZbhYaB8QEo2g== +nanoid@^3.3.7, nanoid@^3.3.8: + version "3.3.8" + resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.8.tgz#b1be3030bee36aaff18bacb375e5cce521684baf" + integrity sha512-WNLf5Sd8oZxOm+TzppcYk8gVOgP+l58xNy58D0nbUnOxOWRWvlcCV4kUF7ltmI6PsrLl/BgKEyS4mqsGChFN0w== negotiator@0.6.3: version "0.6.3" resolved "https://registry.yarnpkg.com/negotiator/-/negotiator-0.6.3.tgz#58e323a72fedc0d6f9cd4d31fe49f51479590ccd" integrity sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg== +negotiator@~0.6.4: + version "0.6.4" + resolved "https://registry.yarnpkg.com/negotiator/-/negotiator-0.6.4.tgz#777948e2452651c570b712dd01c23e262713fff7" + integrity sha512-myRT3DiWPHqho5PrJaIRyaMv2kgYf0mUVgBNOYMuCH5Ki1yEiQaf/ZJuQ62nvpc44wL5WDbTX7yGJi1Neevw8w== + neo-async@^2.6.2: version "2.6.2" resolved "https://registry.yarnpkg.com/neo-async/-/neo-async-2.6.2.tgz#b4aafb93e3aeb2d8174ca53cf163ab7d7308305f" integrity sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw== +netmask@^2.0.2: + version "2.0.2" + resolved "https://registry.yarnpkg.com/netmask/-/netmask-2.0.2.tgz#8b01a07644065d536383835823bc52004ebac5e7" + integrity sha512-dBpDMdxv9Irdq66304OLfEmQ9tbNRFnFTuZiLo+bD+r332bBmMJ8GBLXklIXXgxd3+v9+KUnZaUR5PJMa75Gsg== + no-case@^3.0.4: version "3.0.4" resolved "https://registry.yarnpkg.com/no-case/-/no-case-3.0.4.tgz#d361fd5c9800f558551a8369fc0dcd4662b6124d" @@ -9352,9 +8481,9 @@ no-case@^3.0.4: tslib "^2.0.3" node-emoji@^2.1.0: - version "2.1.3" - resolved "https://registry.yarnpkg.com/node-emoji/-/node-emoji-2.1.3.tgz#93cfabb5cc7c3653aa52f29d6ffb7927d8047c06" - integrity sha512-E2WEOVsgs7O16zsURJ/eH8BqhF029wGpEOnv7Urwdo2wmQanOACwJQh0devF9D9RhoZru0+9JXIS0dBXIAz+lA== + version "2.2.0" + resolved "https://registry.yarnpkg.com/node-emoji/-/node-emoji-2.2.0.tgz#1d000e3c76e462577895be1b436f4aa2d6760eb0" + integrity sha512-Z3lTE9pLaJF47NyMhd4ww1yFTAP8YhYI8SleJiHzM46Fgpm5cnNzSl9XfzFNqbaz+VlJrIj3fXQ4DeN1Rjm6cw== dependencies: "@sindresorhus/is" "^4.6.0" char-regex "^1.0.2" @@ -9368,13 +8497,6 @@ node-fetch-h2@^2.3.0: dependencies: http2-client "^1.2.5" -node-fetch@2.6.7: - version "2.6.7" - resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.6.7.tgz#24de9fba827e3b4ae44dc8b20256a379160052ad" - integrity sha512-ZjMPFEfVx5j+y2yF35Kzx5sF7kDzxuDj6ziH4FFbOp87zKDZNx8yExJIb05OGF4Nlt9IHFIMBkRl41VdvcNdbQ== - dependencies: - whatwg-url "^5.0.0" - node-fetch@^2.6.1: version "2.7.0" resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.7.0.tgz#d0f0fa6e3e2dc1d27efcd8ad99d550bda94d187d" @@ -9394,20 +8516,10 @@ node-readfiles@^0.2.0: dependencies: es6-promise "^3.2.1" -node-releases@^2.0.14: - version "2.0.14" - resolved "https://registry.yarnpkg.com/node-releases/-/node-releases-2.0.14.tgz#2ffb053bceb8b2be8495ece1ab6ce600c4461b0b" - integrity sha512-y10wOWt8yZpqXmOgRo77WaHEmhYQYGNA6y421PKsKYWEK8aW+cqAphborZDhqfyKrbZEN92CN1X2KbafY2s7Yw== - -node-releases@^2.0.18: - version "2.0.18" - resolved "https://registry.yarnpkg.com/node-releases/-/node-releases-2.0.18.tgz#f010e8d35e2fe8d6b2944f03f70213ecedc4ca3f" - integrity sha512-d9VeXT4SJ7ZeOqGX6R5EM022wpL+eWPooLI+5UpWn2jCT1aosUQEhQP214x33Wkwx3JQMvIm+tIoVOdodFS40g== - -non-layered-tidy-tree-layout@^2.0.2: - version "2.0.2" - resolved "https://registry.yarnpkg.com/non-layered-tidy-tree-layout/-/non-layered-tidy-tree-layout-2.0.2.tgz#57d35d13c356643fc296a55fb11ac15e74da7804" - integrity sha512-gkXMxRzUH+PB0ax9dUN0yYF0S25BqeAYqhgMaLUFmpXLEk7Fcu8f4emJuOAY0V8kjDICxROIKsTAKsV/v355xw== +node-releases@^2.0.19: + version "2.0.19" + resolved "https://registry.yarnpkg.com/node-releases/-/node-releases-2.0.19.tgz#9e445a52950951ec4d177d843af370b411caf314" + integrity sha512-xxOWJsBKtzAq7DY0J+DTzuz58K8e7sJbdgwkbMWQe8UYB6ekmsQ45q0M/tJDsGaZmbC+l7n57UV8Hl5tHxO9uw== normalize-path@^3.0.0, normalize-path@~3.0.0: version "3.0.0" @@ -9502,10 +8614,10 @@ object-assign@^4.1.1: resolved "https://registry.yarnpkg.com/object-assign/-/object-assign-4.1.1.tgz#2109adc7965887cfc05cbbd442cac8bfbb360863" integrity sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg== -object-inspect@^1.13.1: - version "1.13.2" - resolved "https://registry.yarnpkg.com/object-inspect/-/object-inspect-1.13.2.tgz#dea0088467fb991e67af4058147a24824a3043ff" - integrity sha512-IRZSRuzJiynemAXPYtPe5BoI/RESNYR7TYm50MC5Mqbd3Jmw5y790sErYw3V6SryFJD64b74qQQs9wn5Bg/k3g== +object-inspect@^1.13.3: + version "1.13.3" + resolved "https://registry.yarnpkg.com/object-inspect/-/object-inspect-1.13.3.tgz#f14c183de51130243d6d18ae149375ff50ea488a" + integrity sha512-kDCGIbxkDSXE3euJZZXzc6to7fCrKHNI/hSRQnRuQ+BWjFNzZwiFF8fj/6o2t2G9/jTj8PSIYTfCLelLZEeRpA== object-is@^1.1.5: version "1.1.6" @@ -9520,14 +8632,16 @@ object-keys@^1.1.1: resolved "https://registry.yarnpkg.com/object-keys/-/object-keys-1.1.1.tgz#1c47f272df277f3b1daf061677d9c82e2322c60e" integrity sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA== -object.assign@^4.1.0, object.assign@^4.1.5: - version "4.1.5" - resolved "https://registry.yarnpkg.com/object.assign/-/object.assign-4.1.5.tgz#3a833f9ab7fdb80fc9e8d2300c803d216d8fdbb0" - integrity sha512-byy+U7gp+FVwmyzKPYhW2h5l3crpmGsxl7X2s8y43IgxvG4g3QZ6CffDtsNQy1WsmZpQbO+ybo0AlW7TY6DcBQ== +object.assign@^4.1.0: + version "4.1.7" + resolved "https://registry.yarnpkg.com/object.assign/-/object.assign-4.1.7.tgz#8c14ca1a424c6a561b0bb2a22f66f5049a945d3d" + integrity sha512-nK28WOo+QIjBkDduTINE4JkF/UJJKyf2EJxvJKfblDpyg0Q+pkOHNTL0Qwy6NP6FhE/EnzV73BxxqcJaXY9anw== dependencies: - call-bind "^1.0.5" + call-bind "^1.0.8" + call-bound "^1.0.3" define-properties "^1.2.1" - has-symbols "^1.0.3" + es-object-atoms "^1.0.0" + has-symbols "^1.1.0" object-keys "^1.1.1" obuf@^1.0.0, obuf@^1.1.2: @@ -9571,11 +8685,12 @@ open@^8.0.9, open@^8.4.0: is-wsl "^2.2.0" openapi-sampler@^1.5.0: - version "1.5.1" - resolved "https://registry.yarnpkg.com/openapi-sampler/-/openapi-sampler-1.5.1.tgz#2b0145179abb0d75eaf50c82b86ef044d22bd671" - integrity sha512-tIWIrZUKNAsbqf3bd9U1oH6JEXo8LNYuDlXw26By67EygpjT+ArFnsxxyTMjFWRfbqo5ozkvgSQDK69Gd8CddA== + version "1.6.1" + resolved "https://registry.yarnpkg.com/openapi-sampler/-/openapi-sampler-1.6.1.tgz#fa1839cd372d1789e12cd3cce46b0511d3f5c79e" + integrity sha512-s1cIatOqrrhSj2tmJ4abFYZQK6l5v+V4toO5q1Pa0DyN8mtyqy2I+Qrj5W9vOELEtybIMQs/TBZGVO/DtTFK8w== dependencies: "@types/json-schema" "^7.0.7" + fast-xml-parser "^4.5.0" json-pointer "0.6.2" opener@^1.5.2: @@ -9650,6 +8765,28 @@ p-try@^2.0.0: resolved "https://registry.yarnpkg.com/p-try/-/p-try-2.2.0.tgz#cb2868540e313d61de58fafbe35ce9004d5540e6" integrity sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ== +pac-proxy-agent@^7.1.0: + version "7.1.0" + resolved "https://registry.yarnpkg.com/pac-proxy-agent/-/pac-proxy-agent-7.1.0.tgz#da7c3b5c4cccc6655aaafb701ae140fb23f15df2" + integrity sha512-Z5FnLVVZSnX7WjBg0mhDtydeRZ1xMcATZThjySQUHqr+0ksP8kqaw23fNKkaaN/Z8gwLUs/W7xdl0I75eP2Xyw== + dependencies: + "@tootallnate/quickjs-emscripten" "^0.23.0" + agent-base "^7.1.2" + debug "^4.3.4" + get-uri "^6.0.1" + http-proxy-agent "^7.0.0" + https-proxy-agent "^7.0.6" + pac-resolver "^7.0.1" + socks-proxy-agent "^8.0.5" + +pac-resolver@^7.0.1: + version "7.0.1" + resolved "https://registry.yarnpkg.com/pac-resolver/-/pac-resolver-7.0.1.tgz#54675558ea368b64d210fd9c92a640b5f3b8abb6" + integrity sha512-5NPgf87AT2STgwa2ntRMr45jTKrYBGkVU36yT0ig/n/GMAa3oPqhZfIQ2kMEimReg0+t9kZViDVZ83qfVUlckg== + dependencies: + degenerator "^5.0.0" + netmask "^2.0.2" + package-json@^8.1.0: version "8.1.1" resolved "https://registry.yarnpkg.com/package-json/-/package-json-8.1.1.tgz#3e9948e43df40d1e8e78a85485f1070bf8f03dc8" @@ -9661,9 +8798,9 @@ package-json@^8.1.0: semver "^7.3.7" package-manager-detector@^0.2.0: - version "0.2.2" - resolved "https://registry.yarnpkg.com/package-manager-detector/-/package-manager-detector-0.2.2.tgz#fbbc8afe87cdaee471ca9b89c3700236c6d2d9e5" - integrity sha512-VgXbyrSNsml4eHWIvxxG/nTL4wgybMTXCV2Un/+yEc3aDKKU6nQBZjbeP3Pl3qm9Qg92X/1ng4ffvCeD/zwHgg== + version "0.2.8" + resolved "https://registry.yarnpkg.com/package-manager-detector/-/package-manager-detector-0.2.8.tgz#f5ace2dbd37666af54e5acec11bc37c8450f72d0" + integrity sha512-ts9KSdroZisdvKMWVAVCXiKqnqNfXz4+IbrBG8/BWx/TR5le+jfenvoBuIZ6UWM9nz47W7AbD9qYfAwfWMIwzA== param-case@^3.0.4: version "3.0.4" @@ -9681,12 +8818,11 @@ parent-module@^1.0.0: callsites "^3.0.0" parse-entities@^4.0.0: - version "4.0.1" - resolved "https://registry.yarnpkg.com/parse-entities/-/parse-entities-4.0.1.tgz#4e2a01111fb1c986549b944af39eeda258fc9e4e" - integrity sha512-SWzvYcSJh4d/SGLIOQfZ/CoNv6BTlI6YEQ7Nj82oDVnRpwe/Z/F1EMx42x3JAOwGBlCjeCH0BRJQbQ/opHL17w== + version "4.0.2" + resolved "https://registry.yarnpkg.com/parse-entities/-/parse-entities-4.0.2.tgz#61d46f5ed28e4ee62e9ddc43d6b010188443f159" + integrity sha512-GG2AQYWoLgL877gQIKeRPGO1xF9+eG1ujIb5soS5gPvLQ1y2o8FL90w2QWNdf9I361Mpp7726c+lj3U0qK1uGw== dependencies: "@types/unist" "^2.0.0" - character-entities "^2.0.0" character-entities-legacy "^3.0.0" character-reference-invalid "^2.0.0" decode-named-character-reference "^1.0.0" @@ -9710,19 +8846,19 @@ parse-numeric-range@^1.3.0: integrity sha512-twN+njEipszzlMJd4ONUYgSfZPDxgHhT9Ahed5uTigpQn90FggW4SA/AIPq/6a149fTbE9qBEcSwE3FAEp6wQQ== parse5-htmlparser2-tree-adapter@^7.0.0: - version "7.0.0" - resolved "https://registry.yarnpkg.com/parse5-htmlparser2-tree-adapter/-/parse5-htmlparser2-tree-adapter-7.0.0.tgz#23c2cc233bcf09bb7beba8b8a69d46b08c62c2f1" - integrity sha512-B77tOZrqqfUfnVcOrUvfdLbz4pu4RopLD/4vmu3HUPswwTA8OH0EMW9BlWR2B0RCoiZRAHEUu7IxeP1Pd1UU+g== + version "7.1.0" + resolved "https://registry.yarnpkg.com/parse5-htmlparser2-tree-adapter/-/parse5-htmlparser2-tree-adapter-7.1.0.tgz#b5a806548ed893a43e24ccb42fbb78069311e81b" + integrity sha512-ruw5xyKs6lrpo9x9rCZqZZnIUntICjQAd0Wsmp396Ul9lN/h+ifgVV1x1gZHi8euej6wTfpqX8j+BFQxF0NS/g== dependencies: - domhandler "^5.0.2" + domhandler "^5.0.3" parse5 "^7.0.0" parse5@^7.0.0: - version "7.1.2" - resolved "https://registry.yarnpkg.com/parse5/-/parse5-7.1.2.tgz#0736bebbfd77793823240a23b7fc5e010b7f8e32" - integrity sha512-Czj1WaSVpaoj0wbhMzLmWD69anp2WH7FXMB9n1Sy8/ZFF9jolSQVMu1Ij5WIyGmcBmhk7EOndpO4mIpihVqAXw== + version "7.2.1" + resolved "https://registry.yarnpkg.com/parse5/-/parse5-7.2.1.tgz#8928f55915e6125f430cc44309765bf17556a33a" + integrity sha512-BuBYQYlv1ckiPdQi/ohiivi9Sagc9JG+Ozs0r7b/0iK3sKmrb0b9FdWdBbOdx6hBCM/F9Ir82ofnBhtZOjCRPQ== dependencies: - entities "^4.4.0" + entities "^4.5.0" parseurl@~1.3.2, parseurl@~1.3.3: version "1.3.3" @@ -9782,10 +8918,10 @@ path-parse@^1.0.7: resolved "https://registry.yarnpkg.com/path-parse/-/path-parse-1.0.7.tgz#fbc114b60ca42b30d9daf5858e4bd68bbedb6735" integrity sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw== -path-to-regexp@0.1.10: - version "0.1.10" - resolved "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-0.1.10.tgz#67e9108c5c0551b9e5326064387de4763c4d5f8b" - integrity sha512-7lf7qcQidTku0Gu3YDPc8DJ1q7OOucfa/BSsIwjuh56VU7katFvuM8hULfkwB3Fns/rsVF7PwPKVw1sl5KQS9w== +path-to-regexp@0.1.12: + version "0.1.12" + resolved "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-0.1.12.tgz#d5e1a12e478a976d432ef3c58d534b9923164bb7" + integrity sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ== path-to-regexp@3.3.0: version "3.3.0" @@ -9793,9 +8929,9 @@ path-to-regexp@3.3.0: integrity sha512-qyCH421YQPS2WFDxDjftfc1ZR5WKQzVzqsp4n9M2kQhVOo/ByahFoUNJfl58kOcEGfQ//7weFTDhm+ss8Ecxgw== path-to-regexp@^1.7.0: - version "1.8.0" - resolved "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-1.8.0.tgz#887b3ba9d84393e87a0a0b9f4cb756198b53548a" - integrity sha512-n43JRhlUKUAlibEJhPeir1ncUID16QnEjNpwzNdO3Lm4ywrBpBZ5oLD0I6br9evr1Y9JTqwRtAh7JLoOzAQdVA== + version "1.9.0" + resolved "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-1.9.0.tgz#5dc0753acbf8521ca2e0f137b4578b917b10cf24" + integrity sha512-xIp7/apCFJuUHdDLWe8O1HIkb0kQrOMb/0u6FXQjemHn/ii5LrIzU6bdECnsiTF/GjZkMEKg1xdiZwNqDYlZ6g== dependencies: isarray "0.0.1" @@ -9804,10 +8940,10 @@ path-type@^4.0.0: resolved "https://registry.yarnpkg.com/path-type/-/path-type-4.0.0.tgz#84ed01c0a7ba380afe09d90a8c180dcd9d03043b" integrity sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw== -pathe@^1.1.2: - version "1.1.2" - resolved "https://registry.yarnpkg.com/pathe/-/pathe-1.1.2.tgz#6c4cb47a945692e48a1ddd6e4094d170516437ec" - integrity sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ== +pathe@^2.0.1: + version "2.0.2" + resolved "https://registry.yarnpkg.com/pathe/-/pathe-2.0.2.tgz#5ed86644376915b3c7ee4d00ac8c348d671da3a5" + integrity sha512-15Ztpk+nov8DR524R4BF7uEuzESgzUEAV4Ah7CUMNGXdE5ELuvxElxGXndBl32vMSsWa1jpNf22Z+Er3sKwq+w== pend@~1.2.0: version "1.2.0" @@ -9815,25 +8951,11 @@ pend@~1.2.0: integrity sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg== perfect-scrollbar@^1.5.5: - version "1.5.5" - resolved "https://registry.yarnpkg.com/perfect-scrollbar/-/perfect-scrollbar-1.5.5.tgz#41a211a2fb52a7191eff301432134ea47052b27f" - integrity sha512-dzalfutyP3e/FOpdlhVryN4AJ5XDVauVWxybSkLZmakFE2sS3y3pc4JnSprw8tGmHvkaG5Edr5T7LBTZ+WWU2g== - -periscopic@^3.0.0: - version "3.1.0" - resolved "https://registry.yarnpkg.com/periscopic/-/periscopic-3.1.0.tgz#7e9037bf51c5855bd33b48928828db4afa79d97a" - integrity sha512-vKiQ8RRtkl9P+r/+oefh25C3fhybptkHKCZSPlcXiJux2tJF55GnEj3BVn4A5gKfq9NWWXXrxkHBwVPUfH0opw== - dependencies: - "@types/estree" "^1.0.0" - estree-walker "^3.0.0" - is-reference "^3.0.0" - -picocolors@^1.0.0, picocolors@^1.0.1: - version "1.0.1" - resolved "https://registry.yarnpkg.com/picocolors/-/picocolors-1.0.1.tgz#a8ad579b571952f0e5d25892de5445bcfe25aaa1" - integrity sha512-anP1Z8qwhkbmu7MFP5iTt+wQKXgwzf7zTyGlcdzabySa9vd0Xt392U0rVmz9poOaBj0uHJKyyo9/upk0HrEQew== + version "1.5.6" + resolved "https://registry.yarnpkg.com/perfect-scrollbar/-/perfect-scrollbar-1.5.6.tgz#f1aead2588ba896435ee41b246812b2080573b7c" + integrity sha512-rixgxw3SxyJbCaSpo1n35A/fwI1r2rdwMKOTCg/AcG+xOEyZcE8UHVjpZMFCVImzsFoCZeJTT+M/rdEIQYO2nw== -picocolors@^1.1.0: +picocolors@^1.0.0, picocolors@^1.0.1, picocolors@^1.1.1: version "1.1.1" resolved "https://registry.yarnpkg.com/picocolors/-/picocolors-1.1.1.tgz#3d321af3eab939b083c8f929a1d12cda81c26b6b" integrity sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA== @@ -9850,14 +8972,14 @@ pkg-dir@^7.0.0: dependencies: find-up "^6.3.0" -pkg-types@^1.0.3, pkg-types@^1.2.0: - version "1.2.1" - resolved "https://registry.yarnpkg.com/pkg-types/-/pkg-types-1.2.1.tgz#6ac4e455a5bb4b9a6185c1c79abd544c901db2e5" - integrity sha512-sQoqa8alT3nHjGuTjuKgOnvjo4cljkufdtLMnO2LBP/wRwuDlo1tkaEdMxCRhyGRPacv/ztlZgDPm2b7FAmEvw== +pkg-types@^1.2.1, pkg-types@^1.3.0: + version "1.3.1" + resolved "https://registry.yarnpkg.com/pkg-types/-/pkg-types-1.3.1.tgz#bd7cc70881192777eef5326c19deb46e890917df" + integrity sha512-/Jm5M4RvtBFVkKWRu2BLUTNP8/M2a+UwuAX+ae4770q1qVGtfjG+WTCupoZixokjmHiry8uI+dlY8KXYV5HVVQ== dependencies: confbox "^0.1.8" - mlly "^1.7.2" - pathe "^1.1.2" + mlly "^1.7.4" + pathe "^2.0.1" pkg-up@^3.1.0: version "3.1.0" @@ -9891,10 +9013,12 @@ polished@^4.2.2: dependencies: "@babel/runtime" "^7.17.8" -possible-typed-array-names@^1.0.0: - version "1.0.0" - resolved "https://registry.yarnpkg.com/possible-typed-array-names/-/possible-typed-array-names-1.0.0.tgz#89bb63c6fada2c3e90adc4a647beeeb39cc7bf8f" - integrity sha512-d7Uw+eZoloe0EHDIYoe+bQ5WXnGMOpmiZFTuMWCwpjzzkL2nTjcKiAk4hh8TjnGye2TwWOk3UXucZ+3rbmBa8Q== +postcss-attribute-case-insensitive@^7.0.1: + version "7.0.1" + resolved "https://registry.yarnpkg.com/postcss-attribute-case-insensitive/-/postcss-attribute-case-insensitive-7.0.1.tgz#0c4500e3bcb2141848e89382c05b5a31c23033a3" + integrity sha512-Uai+SupNSqzlschRyNx3kbCTWgY/2hcwtHEI/ej2LJWc9JJ77qKgGptd8DHwY1mXtZ7Aoh4z4yxfwMBue9eNgw== + dependencies: + postcss-selector-parser "^7.0.0" postcss-calc@^9.0.1: version "9.0.1" @@ -9904,6 +9028,40 @@ postcss-calc@^9.0.1: postcss-selector-parser "^6.0.11" postcss-value-parser "^4.2.0" +postcss-clamp@^4.1.0: + version "4.1.0" + resolved "https://registry.yarnpkg.com/postcss-clamp/-/postcss-clamp-4.1.0.tgz#7263e95abadd8c2ba1bd911b0b5a5c9c93e02363" + integrity sha512-ry4b1Llo/9zz+PKC+030KUnPITTJAHeOwjfAyyB60eT0AorGLdzp52s31OsPRHRf8NchkgFoG2y6fCfn1IV1Ow== + dependencies: + postcss-value-parser "^4.2.0" + +postcss-color-functional-notation@^7.0.7: + version "7.0.7" + resolved "https://registry.yarnpkg.com/postcss-color-functional-notation/-/postcss-color-functional-notation-7.0.7.tgz#c5362df010926f902ce4e7fb3da2a46cff175d1b" + integrity sha512-EZvAHsvyASX63vXnyXOIynkxhaHRSsdb7z6yiXKIovGXAolW4cMZ3qoh7k3VdTsLBS6VGdksGfIo3r6+waLoOw== + dependencies: + "@csstools/css-color-parser" "^3.0.7" + "@csstools/css-parser-algorithms" "^3.0.4" + "@csstools/css-tokenizer" "^3.0.3" + "@csstools/postcss-progressive-custom-properties" "^4.0.0" + "@csstools/utilities" "^2.0.0" + +postcss-color-hex-alpha@^10.0.0: + version "10.0.0" + resolved "https://registry.yarnpkg.com/postcss-color-hex-alpha/-/postcss-color-hex-alpha-10.0.0.tgz#5dd3eba1f8facb4ea306cba6e3f7712e876b0c76" + integrity sha512-1kervM2cnlgPs2a8Vt/Qbe5cQ++N7rkYo/2rz2BkqJZIHQwaVuJgQH38REHrAi4uM0b1fqxMkWYmese94iMp3w== + dependencies: + "@csstools/utilities" "^2.0.0" + postcss-value-parser "^4.2.0" + +postcss-color-rebeccapurple@^10.0.0: + version "10.0.0" + resolved "https://registry.yarnpkg.com/postcss-color-rebeccapurple/-/postcss-color-rebeccapurple-10.0.0.tgz#5ada28406ac47e0796dff4056b0a9d5a6ecead98" + integrity sha512-JFta737jSP+hdAIEhk1Vs0q0YF5P8fFcj+09pweS8ktuGuZ8pPlykHsk6mPxZ8awDl4TrcxUqJo9l1IhVr/OjQ== + dependencies: + "@csstools/utilities" "^2.0.0" + postcss-value-parser "^4.2.0" + postcss-colormin@^6.1.0: version "6.1.0" resolved "https://registry.yarnpkg.com/postcss-colormin/-/postcss-colormin-6.1.0.tgz#076e8d3fb291fbff7b10e6b063be9da42ff6488d" @@ -9922,6 +9080,44 @@ postcss-convert-values@^6.1.0: browserslist "^4.23.0" postcss-value-parser "^4.2.0" +postcss-custom-media@^11.0.5: + version "11.0.5" + resolved "https://registry.yarnpkg.com/postcss-custom-media/-/postcss-custom-media-11.0.5.tgz#2fcd88a9b1d4da41c67dac6f2def903063a3377d" + integrity sha512-SQHhayVNgDvSAdX9NQ/ygcDQGEY+aSF4b/96z7QUX6mqL5yl/JgG/DywcF6fW9XbnCRE+aVYk+9/nqGuzOPWeQ== + dependencies: + "@csstools/cascade-layer-name-parser" "^2.0.4" + "@csstools/css-parser-algorithms" "^3.0.4" + "@csstools/css-tokenizer" "^3.0.3" + "@csstools/media-query-list-parser" "^4.0.2" + +postcss-custom-properties@^14.0.4: + version "14.0.4" + resolved "https://registry.yarnpkg.com/postcss-custom-properties/-/postcss-custom-properties-14.0.4.tgz#de9c663285a98833a946d7003a34369d3ce373a9" + integrity sha512-QnW8FCCK6q+4ierwjnmXF9Y9KF8q0JkbgVfvQEMa93x1GT8FvOiUevWCN2YLaOWyByeDX8S6VFbZEeWoAoXs2A== + dependencies: + "@csstools/cascade-layer-name-parser" "^2.0.4" + "@csstools/css-parser-algorithms" "^3.0.4" + "@csstools/css-tokenizer" "^3.0.3" + "@csstools/utilities" "^2.0.0" + postcss-value-parser "^4.2.0" + +postcss-custom-selectors@^8.0.4: + version "8.0.4" + resolved "https://registry.yarnpkg.com/postcss-custom-selectors/-/postcss-custom-selectors-8.0.4.tgz#95ef8268fdbbbd84f34cf84a4517c9d99d419c5a" + integrity sha512-ASOXqNvDCE0dAJ/5qixxPeL1aOVGHGW2JwSy7HyjWNbnWTQCl+fDc968HY1jCmZI0+BaYT5CxsOiUhavpG/7eg== + dependencies: + "@csstools/cascade-layer-name-parser" "^2.0.4" + "@csstools/css-parser-algorithms" "^3.0.4" + "@csstools/css-tokenizer" "^3.0.3" + postcss-selector-parser "^7.0.0" + +postcss-dir-pseudo-class@^9.0.1: + version "9.0.1" + resolved "https://registry.yarnpkg.com/postcss-dir-pseudo-class/-/postcss-dir-pseudo-class-9.0.1.tgz#80d9e842c9ae9d29f6bf5fd3cf9972891d6cc0ca" + integrity sha512-tRBEK0MHYvcMUrAuYMEOa0zg9APqirBcgzi6P21OhxtJyJADo/SWBwY1CAwEohQ/6HDaa9jCjLRG7K3PVQYHEA== + dependencies: + postcss-selector-parser "^7.0.0" + postcss-discard-comments@^6.0.2: version "6.0.2" resolved "https://registry.yarnpkg.com/postcss-discard-comments/-/postcss-discard-comments-6.0.2.tgz#e768dcfdc33e0216380623652b0a4f69f4678b6c" @@ -9949,6 +9145,58 @@ postcss-discard-unused@^6.0.5: dependencies: postcss-selector-parser "^6.0.16" +postcss-double-position-gradients@^6.0.0: + version "6.0.0" + resolved "https://registry.yarnpkg.com/postcss-double-position-gradients/-/postcss-double-position-gradients-6.0.0.tgz#eddd424ec754bb543d057d4d2180b1848095d4d2" + integrity sha512-JkIGah3RVbdSEIrcobqj4Gzq0h53GG4uqDPsho88SgY84WnpkTpI0k50MFK/sX7XqVisZ6OqUfFnoUO6m1WWdg== + dependencies: + "@csstools/postcss-progressive-custom-properties" "^4.0.0" + "@csstools/utilities" "^2.0.0" + postcss-value-parser "^4.2.0" + +postcss-focus-visible@^10.0.1: + version "10.0.1" + resolved "https://registry.yarnpkg.com/postcss-focus-visible/-/postcss-focus-visible-10.0.1.tgz#1f7904904368a2d1180b220595d77b6f8a957868" + integrity sha512-U58wyjS/I1GZgjRok33aE8juW9qQgQUNwTSdxQGuShHzwuYdcklnvK/+qOWX1Q9kr7ysbraQ6ht6r+udansalA== + dependencies: + postcss-selector-parser "^7.0.0" + +postcss-focus-within@^9.0.1: + version "9.0.1" + resolved "https://registry.yarnpkg.com/postcss-focus-within/-/postcss-focus-within-9.0.1.tgz#ac01ce80d3f2e8b2b3eac4ff84f8e15cd0057bc7" + integrity sha512-fzNUyS1yOYa7mOjpci/bR+u+ESvdar6hk8XNK/TRR0fiGTp2QT5N+ducP0n3rfH/m9I7H/EQU6lsa2BrgxkEjw== + dependencies: + postcss-selector-parser "^7.0.0" + +postcss-font-variant@^5.0.0: + version "5.0.0" + resolved "https://registry.yarnpkg.com/postcss-font-variant/-/postcss-font-variant-5.0.0.tgz#efd59b4b7ea8bb06127f2d031bfbb7f24d32fa66" + integrity sha512-1fmkBaCALD72CK2a9i468mA/+tr9/1cBxRRMXOUaZqO43oWPR5imcyPjXwuv7PXbCid4ndlP5zWhidQVVa3hmA== + +postcss-gap-properties@^6.0.0: + version "6.0.0" + resolved "https://registry.yarnpkg.com/postcss-gap-properties/-/postcss-gap-properties-6.0.0.tgz#d5ff0bdf923c06686499ed2b12e125fe64054fed" + integrity sha512-Om0WPjEwiM9Ru+VhfEDPZJAKWUd0mV1HmNXqp2C29z80aQ2uP9UVhLc7e3aYMIor/S5cVhoPgYQ7RtfeZpYTRw== + +postcss-image-set-function@^7.0.0: + version "7.0.0" + resolved "https://registry.yarnpkg.com/postcss-image-set-function/-/postcss-image-set-function-7.0.0.tgz#538e94e16716be47f9df0573b56bbaca86e1da53" + integrity sha512-QL7W7QNlZuzOwBTeXEmbVckNt1FSmhQtbMRvGGqqU4Nf4xk6KUEQhAoWuMzwbSv5jxiRiSZ5Tv7eiDB9U87znA== + dependencies: + "@csstools/utilities" "^2.0.0" + postcss-value-parser "^4.2.0" + +postcss-lab-function@^7.0.7: + version "7.0.7" + resolved "https://registry.yarnpkg.com/postcss-lab-function/-/postcss-lab-function-7.0.7.tgz#9c87c21ce5132c55824190b75d7d7adede9c2fac" + integrity sha512-+ONj2bpOQfsCKZE2T9VGMyVVdGcGUpr7u3SVfvkJlvhTRmDCfY25k4Jc8fubB9DclAPR4+w8uVtDZmdRgdAHig== + dependencies: + "@csstools/css-color-parser" "^3.0.7" + "@csstools/css-parser-algorithms" "^3.0.4" + "@csstools/css-tokenizer" "^3.0.3" + "@csstools/postcss-progressive-custom-properties" "^4.0.0" + "@csstools/utilities" "^2.0.0" + postcss-loader@^7.3.3: version "7.3.4" resolved "https://registry.yarnpkg.com/postcss-loader/-/postcss-loader-7.3.4.tgz#aed9b79ce4ed7e9e89e56199d25ad1ec8f606209" @@ -9958,6 +9206,13 @@ postcss-loader@^7.3.3: jiti "^1.20.0" semver "^7.5.4" +postcss-logical@^8.0.0: + version "8.0.0" + resolved "https://registry.yarnpkg.com/postcss-logical/-/postcss-logical-8.0.0.tgz#0db0b90c2dc53b485a8074a4b7a906297544f58d" + integrity sha512-HpIdsdieClTjXLOyYdUPAX/XQASNIwdKt5hoZW08ZOAiI+tbV0ta1oclkpVkW5ANU+xJvk3KkA0FejkjGLXUkg== + dependencies: + postcss-value-parser "^4.2.0" + postcss-merge-idents@^6.0.3: version "6.0.3" resolved "https://registry.yarnpkg.com/postcss-merge-idents/-/postcss-merge-idents-6.0.3.tgz#7b9c31c7bc823c94bec50f297f04e3c2b838ea65" @@ -10022,20 +9277,20 @@ postcss-modules-extract-imports@^3.1.0: integrity sha512-k3kNe0aNFQDAZGbin48pL2VNidTF0w4/eASDsxlyspobzU3wZQLOGj7L9gfRe0Jo9/4uud09DsjFNH7winGv8Q== postcss-modules-local-by-default@^4.0.5: - version "4.0.5" - resolved "https://registry.yarnpkg.com/postcss-modules-local-by-default/-/postcss-modules-local-by-default-4.0.5.tgz#f1b9bd757a8edf4d8556e8d0f4f894260e3df78f" - integrity sha512-6MieY7sIfTK0hYfafw1OMEG+2bg8Q1ocHCpoWLqOKj3JXlKu4G7btkmM/B7lFubYkYWmRSPLZi5chid63ZaZYw== + version "4.2.0" + resolved "https://registry.yarnpkg.com/postcss-modules-local-by-default/-/postcss-modules-local-by-default-4.2.0.tgz#d150f43837831dae25e4085596e84f6f5d6ec368" + integrity sha512-5kcJm/zk+GJDSfw+V/42fJ5fhjL5YbFDl8nVdXkJPLLW+Vf9mTD5Xe0wqIaDnLuL2U6cDNpTr+UQ+v2HWIBhzw== dependencies: icss-utils "^5.0.0" - postcss-selector-parser "^6.0.2" + postcss-selector-parser "^7.0.0" postcss-value-parser "^4.1.0" postcss-modules-scope@^3.2.0: - version "3.2.0" - resolved "https://registry.yarnpkg.com/postcss-modules-scope/-/postcss-modules-scope-3.2.0.tgz#a43d28289a169ce2c15c00c4e64c0858e43457d5" - integrity sha512-oq+g1ssrsZOsx9M96c5w8laRmvEu9C3adDSjI8oTcbfkrTE8hx/zfyobUoWIxaKPO8bt6S62kxpw5GqypEw1QQ== + version "3.2.1" + resolved "https://registry.yarnpkg.com/postcss-modules-scope/-/postcss-modules-scope-3.2.1.tgz#1bbccddcb398f1d7a511e0a2d1d047718af4078c" + integrity sha512-m9jZstCVaqGjTAuny8MdgE88scJnCiQSlSrOWcTQgM2t32UBe+MUmFSO5t7VMSfAf/FJKImAxBav8ooCHJXCJA== dependencies: - postcss-selector-parser "^6.0.4" + postcss-selector-parser "^7.0.0" postcss-modules-values@^4.0.0: version "4.0.0" @@ -10044,6 +9299,15 @@ postcss-modules-values@^4.0.0: dependencies: icss-utils "^5.0.0" +postcss-nesting@^13.0.1: + version "13.0.1" + resolved "https://registry.yarnpkg.com/postcss-nesting/-/postcss-nesting-13.0.1.tgz#c405796d7245a3e4c267a9956cacfe9670b5d43e" + integrity sha512-VbqqHkOBOt4Uu3G8Dm8n6lU5+9cJFxiuty9+4rcoyRPO9zZS1JIs6td49VIoix3qYqELHlJIn46Oih9SAKo+yQ== + dependencies: + "@csstools/selector-resolve-nested" "^3.0.0" + "@csstools/selector-specificity" "^5.0.0" + postcss-selector-parser "^7.0.0" + postcss-normalize-charset@^6.0.2: version "6.0.2" resolved "https://registry.yarnpkg.com/postcss-normalize-charset/-/postcss-normalize-charset-6.0.2.tgz#1ec25c435057a8001dac942942a95ffe66f721e1" @@ -10106,6 +9370,11 @@ postcss-normalize-whitespace@^6.0.2: dependencies: postcss-value-parser "^4.2.0" +postcss-opacity-percentage@^3.0.0: + version "3.0.0" + resolved "https://registry.yarnpkg.com/postcss-opacity-percentage/-/postcss-opacity-percentage-3.0.0.tgz#0b0db5ed5db5670e067044b8030b89c216e1eb0a" + integrity sha512-K6HGVzyxUxd/VgZdX04DCtdwWJ4NGLG212US4/LA1TLAbHgmAsTWVR86o+gGIbFtnTkfOpb9sCRBx8K7HO66qQ== + postcss-ordered-values@^6.0.2: version "6.0.2" resolved "https://registry.yarnpkg.com/postcss-ordered-values/-/postcss-ordered-values-6.0.2.tgz#366bb663919707093451ab70c3f99c05672aaae5" @@ -10114,6 +9383,106 @@ postcss-ordered-values@^6.0.2: cssnano-utils "^4.0.2" postcss-value-parser "^4.2.0" +postcss-overflow-shorthand@^6.0.0: + version "6.0.0" + resolved "https://registry.yarnpkg.com/postcss-overflow-shorthand/-/postcss-overflow-shorthand-6.0.0.tgz#f5252b4a2ee16c68cd8a9029edb5370c4a9808af" + integrity sha512-BdDl/AbVkDjoTofzDQnwDdm/Ym6oS9KgmO7Gr+LHYjNWJ6ExORe4+3pcLQsLA9gIROMkiGVjjwZNoL/mpXHd5Q== + dependencies: + postcss-value-parser "^4.2.0" + +postcss-page-break@^3.0.4: + version "3.0.4" + resolved "https://registry.yarnpkg.com/postcss-page-break/-/postcss-page-break-3.0.4.tgz#7fbf741c233621622b68d435babfb70dd8c1ee5f" + integrity sha512-1JGu8oCjVXLa9q9rFTo4MbeeA5FMe00/9C7lN4va606Rdb+HkxXtXsmEDrIraQ11fGz/WvKWa8gMuCKkrXpTsQ== + +postcss-place@^10.0.0: + version "10.0.0" + resolved "https://registry.yarnpkg.com/postcss-place/-/postcss-place-10.0.0.tgz#ba36ee4786ca401377ced17a39d9050ed772e5a9" + integrity sha512-5EBrMzat2pPAxQNWYavwAfoKfYcTADJ8AXGVPcUZ2UkNloUTWzJQExgrzrDkh3EKzmAx1evfTAzF9I8NGcc+qw== + dependencies: + postcss-value-parser "^4.2.0" + +postcss-prefix-selector@^1.16.1: + version "1.16.1" + resolved "https://registry.yarnpkg.com/postcss-prefix-selector/-/postcss-prefix-selector-1.16.1.tgz#87a77523838b79c0e8aec29f173234b2987cdc04" + integrity sha512-Umxu+FvKMwlY6TyDzGFoSUnzW+NOfMBLyC1tAkIjgX+Z/qGspJeRjVC903D7mx7TuBpJlwti2ibXtWuA7fKMeQ== + +postcss-preset-env@^10.1.0: + version "10.1.3" + resolved "https://registry.yarnpkg.com/postcss-preset-env/-/postcss-preset-env-10.1.3.tgz#7d07adef2237a643162e751b00eb1e339aa3b82e" + integrity sha512-9qzVhcMFU/MnwYHyYpJz4JhGku/4+xEiPTmhn0hj3IxnUYlEF9vbh7OC1KoLAnenS6Fgg43TKNp9xcuMeAi4Zw== + dependencies: + "@csstools/postcss-cascade-layers" "^5.0.1" + "@csstools/postcss-color-function" "^4.0.7" + "@csstools/postcss-color-mix-function" "^3.0.7" + "@csstools/postcss-content-alt-text" "^2.0.4" + "@csstools/postcss-exponential-functions" "^2.0.6" + "@csstools/postcss-font-format-keywords" "^4.0.0" + "@csstools/postcss-gamut-mapping" "^2.0.7" + "@csstools/postcss-gradients-interpolation-method" "^5.0.7" + "@csstools/postcss-hwb-function" "^4.0.7" + "@csstools/postcss-ic-unit" "^4.0.0" + "@csstools/postcss-initial" "^2.0.0" + "@csstools/postcss-is-pseudo-class" "^5.0.1" + "@csstools/postcss-light-dark-function" "^2.0.7" + "@csstools/postcss-logical-float-and-clear" "^3.0.0" + "@csstools/postcss-logical-overflow" "^2.0.0" + "@csstools/postcss-logical-overscroll-behavior" "^2.0.0" + "@csstools/postcss-logical-resize" "^3.0.0" + "@csstools/postcss-logical-viewport-units" "^3.0.3" + "@csstools/postcss-media-minmax" "^2.0.6" + "@csstools/postcss-media-queries-aspect-ratio-number-values" "^3.0.4" + "@csstools/postcss-nested-calc" "^4.0.0" + "@csstools/postcss-normalize-display-values" "^4.0.0" + "@csstools/postcss-oklab-function" "^4.0.7" + "@csstools/postcss-progressive-custom-properties" "^4.0.0" + "@csstools/postcss-random-function" "^1.0.2" + "@csstools/postcss-relative-color-syntax" "^3.0.7" + "@csstools/postcss-scope-pseudo-class" "^4.0.1" + "@csstools/postcss-sign-functions" "^1.1.1" + "@csstools/postcss-stepped-value-functions" "^4.0.6" + "@csstools/postcss-text-decoration-shorthand" "^4.0.1" + "@csstools/postcss-trigonometric-functions" "^4.0.6" + "@csstools/postcss-unset-value" "^4.0.0" + autoprefixer "^10.4.19" + browserslist "^4.23.1" + css-blank-pseudo "^7.0.1" + css-has-pseudo "^7.0.2" + css-prefers-color-scheme "^10.0.0" + cssdb "^8.2.3" + postcss-attribute-case-insensitive "^7.0.1" + postcss-clamp "^4.1.0" + postcss-color-functional-notation "^7.0.7" + postcss-color-hex-alpha "^10.0.0" + postcss-color-rebeccapurple "^10.0.0" + postcss-custom-media "^11.0.5" + postcss-custom-properties "^14.0.4" + postcss-custom-selectors "^8.0.4" + postcss-dir-pseudo-class "^9.0.1" + postcss-double-position-gradients "^6.0.0" + postcss-focus-visible "^10.0.1" + postcss-focus-within "^9.0.1" + postcss-font-variant "^5.0.0" + postcss-gap-properties "^6.0.0" + postcss-image-set-function "^7.0.0" + postcss-lab-function "^7.0.7" + postcss-logical "^8.0.0" + postcss-nesting "^13.0.1" + postcss-opacity-percentage "^3.0.0" + postcss-overflow-shorthand "^6.0.0" + postcss-page-break "^3.0.4" + postcss-place "^10.0.0" + postcss-pseudo-class-any-link "^10.0.1" + postcss-replace-overflow-wrap "^4.0.0" + postcss-selector-not "^8.0.1" + +postcss-pseudo-class-any-link@^10.0.1: + version "10.0.1" + resolved "https://registry.yarnpkg.com/postcss-pseudo-class-any-link/-/postcss-pseudo-class-any-link-10.0.1.tgz#06455431171bf44b84d79ebaeee9fd1c05946544" + integrity sha512-3el9rXlBOqTFaMFkWDOkHUTQekFIYnaQY55Rsp8As8QQkpiSgIYEcF/6Ond93oHiDsGb4kad8zjt+NPlOC1H0Q== + dependencies: + postcss-selector-parser "^7.0.0" + postcss-reduce-idents@^6.0.3: version "6.0.3" resolved "https://registry.yarnpkg.com/postcss-reduce-idents/-/postcss-reduce-idents-6.0.3.tgz#b0d9c84316d2a547714ebab523ec7d13704cd486" @@ -10136,10 +9505,30 @@ postcss-reduce-transforms@^6.0.2: dependencies: postcss-value-parser "^4.2.0" -postcss-selector-parser@^6.0.11, postcss-selector-parser@^6.0.16, postcss-selector-parser@^6.0.2, postcss-selector-parser@^6.0.4: - version "6.1.0" - resolved "https://registry.yarnpkg.com/postcss-selector-parser/-/postcss-selector-parser-6.1.0.tgz#49694cb4e7c649299fea510a29fa6577104bcf53" - integrity sha512-UMz42UD0UY0EApS0ZL9o1XnLhSTtvvvLe5Dc2H2O56fvRZi+KulDyf5ctDhhtYJBGKStV2FL1fy6253cmLgqVQ== +postcss-replace-overflow-wrap@^4.0.0: + version "4.0.0" + resolved "https://registry.yarnpkg.com/postcss-replace-overflow-wrap/-/postcss-replace-overflow-wrap-4.0.0.tgz#d2df6bed10b477bf9c52fab28c568b4b29ca4319" + integrity sha512-KmF7SBPphT4gPPcKZc7aDkweHiKEEO8cla/GjcBK+ckKxiZslIu3C4GCRW3DNfL0o7yW7kMQu9xlZ1kXRXLXtw== + +postcss-selector-not@^8.0.1: + version "8.0.1" + resolved "https://registry.yarnpkg.com/postcss-selector-not/-/postcss-selector-not-8.0.1.tgz#f2df9c6ac9f95e9fe4416ca41a957eda16130172" + integrity sha512-kmVy/5PYVb2UOhy0+LqUYAhKj7DUGDpSWa5LZqlkWJaaAV+dxxsOG3+St0yNLu6vsKD7Dmqx+nWQt0iil89+WA== + dependencies: + postcss-selector-parser "^7.0.0" + +postcss-selector-parser@^6.0.11, postcss-selector-parser@^6.0.16: + version "6.1.2" + resolved "https://registry.yarnpkg.com/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz#27ecb41fb0e3b6ba7a1ec84fff347f734c7929de" + integrity sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg== + dependencies: + cssesc "^3.0.0" + util-deprecate "^1.0.2" + +postcss-selector-parser@^7.0.0: + version "7.0.0" + resolved "https://registry.yarnpkg.com/postcss-selector-parser/-/postcss-selector-parser-7.0.0.tgz#41bd8b56f177c093ca49435f65731befe25d6b9c" + integrity sha512-9RbEr1Y7FFfptd/1eEdntyjMwLeghW1bHX9GWjXo19vx4ytPQhANltvVxDggzJl7mnWM+dX28kb6cyS/4iQjlQ== dependencies: cssesc "^3.0.0" util-deprecate "^1.0.2" @@ -10185,19 +9574,19 @@ postcss@8.4.38: picocolors "^1.0.0" source-map-js "^1.2.0" -postcss@^8.4.21, postcss@^8.4.24, postcss@^8.4.26, postcss@^8.4.33, postcss@^8.4.38: - version "8.4.39" - resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.4.39.tgz#aa3c94998b61d3a9c259efa51db4b392e1bde0e3" - integrity sha512-0vzE+lAiG7hZl1/9I8yzKLx3aR9Xbof3fBHKunvMfOCYAtMhrsnccJY2iTURb9EZd5+pLuiNV9/c/GZJOHsgIw== +postcss@^8.4.21, postcss@^8.4.24, postcss@^8.4.26, postcss@^8.4.33, postcss@^8.4.38, postcss@^8.4.45: + version "8.5.1" + resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.1.tgz#e2272a1f8a807fafa413218245630b5db10a3214" + integrity sha512-6oz2beyjc5VMn/KV1pPw8fliQkhBXrVn1Z3TVyqZxU8kZpzEKhBdmCFqI6ZbmGtamQvQGuU1sgPTk8ZrXDD7jQ== dependencies: - nanoid "^3.3.7" - picocolors "^1.0.1" - source-map-js "^1.2.0" + nanoid "^3.3.8" + picocolors "^1.1.1" + source-map-js "^1.2.1" -prettier@^3.1.1: - version "3.3.2" - resolved "https://registry.yarnpkg.com/prettier/-/prettier-3.3.2.tgz#03ff86dc7c835f2d2559ee76876a3914cec4a90a" - integrity sha512-rAVeHYMcv8ATV5d508CFdn+8/pHPpXeIid1DdrPwXnaAdH7cqjVbpJaT5eq4yRAFU/lsbwYwSF/n5iNrdJHPQA== +prettier@^3.4.2: + version "3.4.2" + resolved "https://registry.yarnpkg.com/prettier/-/prettier-3.4.2.tgz#a5ce1fb522a588bf2b78ca44c6e6fe5aa5a2b13f" + integrity sha512-e9MewbtFo+Fevyuxn/4rrcDAaq0IYxPGLvObpQjiZBMAzB9IGmzlnG9RZy3FFas+eBMu2vA0CszMeduow5dIuQ== pretty-error@^4.0.0: version "4.0.0" @@ -10210,17 +9599,12 @@ pretty-error@^4.0.0: pretty-time@^1.1.0: version "1.1.0" resolved "https://registry.yarnpkg.com/pretty-time/-/pretty-time-1.1.0.tgz#ffb7429afabb8535c346a34e41873adf3d74dd0e" - integrity sha512-28iF6xPQrP8Oa6uxE6a1biz+lWeTOAPKggvjB8HAs6nVMKZwf5bG++632Dx614hIWgUPkgivRfG+a8uAXGTIbA== - -prism-react-renderer@^1.3.1: - version "1.3.5" - resolved "https://registry.yarnpkg.com/prism-react-renderer/-/prism-react-renderer-1.3.5.tgz#786bb69aa6f73c32ba1ee813fbe17a0115435085" - integrity sha512-IJ+MSwBWKG+SM3b2SUfdrhC+gu01QkV2KmRQgREThBfSQRoufqRfxfHUxpG1WcaFjP+kojcFyO9Qqtpgt3qLCg== + integrity sha512-28iF6xPQrP8Oa6uxE6a1biz+lWeTOAPKggvjB8HAs6nVMKZwf5bG++632Dx614hIWgUPkgivRfG+a8uAXGTIbA== -prism-react-renderer@^2.3.0: - version "2.3.1" - resolved "https://registry.yarnpkg.com/prism-react-renderer/-/prism-react-renderer-2.3.1.tgz#e59e5450052ede17488f6bc85de1553f584ff8d5" - integrity sha512-Rdf+HzBLR7KYjzpJ1rSoxT9ioO85nZngQEoFIhL07XhtJHlCU3SOz0GJ6+qvMyQe0Se+BV3qpe6Yd/NmQF5Juw== +prism-react-renderer@^2.3.0, prism-react-renderer@^2.4.1: + version "2.4.1" + resolved "https://registry.yarnpkg.com/prism-react-renderer/-/prism-react-renderer-2.4.1.tgz#ac63b7f78e56c8f2b5e76e823a976d5ede77e35f" + integrity sha512-ey8Ls/+Di31eqzUxC46h8MksNuGx/n0AAC8uKpwFau4RPDYLuE3EXTp8N8G2vX2N7UC/+IXeNUnlWBGGcAG+Ig== dependencies: "@types/prismjs" "^1.26.0" clsx "^2.0.0" @@ -10235,7 +9619,7 @@ process-nextick-args@~2.0.0: resolved "https://registry.yarnpkg.com/process-nextick-args/-/process-nextick-args-2.0.1.tgz#7820d9b16120cc55ca9ae7792680ae7dba6d7fe2" integrity sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag== -progress@2.0.3: +progress@^2.0.3: version "2.0.3" resolved "https://registry.yarnpkg.com/progress/-/progress-2.0.3.tgz#7e8cf8d8f5b8f239c1bc68beb4eb78567d572ef8" integrity sha512-7PiHtLll5LdnKIMw100I+8xJXR5gW2QwWYkT6iJva0bXitZKa/XMrSbdmg3r2Xnaidz9Qumd0VPaMrZlF9V9sA== @@ -10275,7 +9659,21 @@ proxy-addr@~2.0.7: forwarded "0.2.0" ipaddr.js "1.9.1" -proxy-from-env@1.1.0: +proxy-agent@^6.4.0: + version "6.5.0" + resolved "https://registry.yarnpkg.com/proxy-agent/-/proxy-agent-6.5.0.tgz#9e49acba8e4ee234aacb539f89ed9c23d02f232d" + integrity sha512-TmatMXdr2KlRiA2CyDu8GqR8EjahTG3aY3nXjdzFyoZbmB8hrBsTyMezhULIXKnC0jpfjlmiZ3+EaCzoInSu/A== + dependencies: + agent-base "^7.1.2" + debug "^4.3.4" + http-proxy-agent "^7.0.1" + https-proxy-agent "^7.0.6" + lru-cache "^7.14.1" + pac-proxy-agent "^7.1.0" + proxy-from-env "^1.1.0" + socks-proxy-agent "^8.0.5" + +proxy-from-env@^1.1.0: version "1.1.0" resolved "https://registry.yarnpkg.com/proxy-from-env/-/proxy-from-env-1.1.0.tgz#e102f16ca355424865755d2c9e8ea4f24d58c3e2" integrity sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg== @@ -10300,31 +9698,26 @@ pupa@^3.1.0: dependencies: escape-goat "^4.0.0" -puppeteer-core@18.2.1: - version "18.2.1" - resolved "https://registry.yarnpkg.com/puppeteer-core/-/puppeteer-core-18.2.1.tgz#9b7827bb2bf478bb615e2c21425e4659555dc1fe" - integrity sha512-MRtTAZfQTluz3U2oU/X2VqVWPcR1+94nbA2V6ZrSZRVEwLqZ8eclZ551qGFQD/vD2PYqHJwWOW/fpC721uznVw== - dependencies: - cross-fetch "3.1.5" - debug "4.3.4" - devtools-protocol "0.0.1045489" - extract-zip "2.0.1" - https-proxy-agent "5.0.1" - proxy-from-env "1.1.0" - rimraf "3.0.2" - tar-fs "2.1.1" - unbzip2-stream "1.4.3" - ws "8.9.0" - -puppeteer@^18.0.0: - version "18.2.1" - resolved "https://registry.yarnpkg.com/puppeteer/-/puppeteer-18.2.1.tgz#08967cd423efe511ee4c6e3a5c882ffaf2e6bbf3" - integrity sha512-7+UhmYa7wxPh2oMRwA++k8UGVDxh3YdWFB52r9C3tM81T6BU7cuusUSxImz0GEYSOYUKk/YzIhkQ6+vc0gHbxQ== - dependencies: - https-proxy-agent "5.0.1" - progress "2.0.3" - proxy-from-env "1.1.0" - puppeteer-core "18.2.1" +puppeteer-core@22.15.0: + version "22.15.0" + resolved "https://registry.yarnpkg.com/puppeteer-core/-/puppeteer-core-22.15.0.tgz#c76926cce5dbc177572797a9dacc325c313fa91a" + integrity sha512-cHArnywCiAAVXa3t4GGL2vttNxh7GqXtIYGym99egkNJ3oG//wL9LkvO4WE8W1TJe95t1F1ocu9X4xWaGsOKOA== + dependencies: + "@puppeteer/browsers" "2.3.0" + chromium-bidi "0.6.3" + debug "^4.3.6" + devtools-protocol "0.0.1312386" + ws "^8.18.0" + +puppeteer@^22.15.0: + version "22.15.0" + resolved "https://registry.yarnpkg.com/puppeteer/-/puppeteer-22.15.0.tgz#4f842087090f1d9017ce947512e7baff55a10e75" + integrity sha512-XjCY1SiSEi1T7iSYuxS82ft85kwDJUS7wj1Z0eGVXKdtr5g4xnVcbjwxhq5xBnpK/E7x1VZZoJDxpjAOasHT4Q== + dependencies: + "@puppeteer/browsers" "2.3.0" + cosmiconfig "^9.0.0" + devtools-protocol "0.0.1312386" + puppeteer-core "22.15.0" qs@6.13.0: version "6.13.0" @@ -10338,6 +9731,11 @@ queue-microtask@^1.2.2: resolved "https://registry.yarnpkg.com/queue-microtask/-/queue-microtask-1.2.3.tgz#4929228bbc724dfac43e0efb058caf7b6cfb6243" integrity sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A== +queue-tick@^1.0.1: + version "1.0.1" + resolved "https://registry.yarnpkg.com/queue-tick/-/queue-tick-1.0.1.tgz#f6f07ac82c1fd60f82e098b417a80e52f1f4c142" + integrity sha512-kJt5qhMxoszgU/62PLP1CJytzd2NKetjSRnyuj31fDd3Rlcz3fzlFdFLD1SItunPwyqEOkca6GbV612BWfaBag== + queue@6.0.2: version "6.0.2" resolved "https://registry.yarnpkg.com/queue/-/queue-6.0.2.tgz#b91525283e2315c7553d2efa18d83e76432fed65" @@ -10438,24 +9836,15 @@ react-error-overlay@^6.0.11: resolved "https://registry.yarnpkg.com/react-error-overlay/-/react-error-overlay-6.0.11.tgz#92835de5841c5cf08ba00ddd2d677b6d17ff9adb" integrity sha512-/6UZ2qgEyH2aqzYZgQPxEnz33NJ2gNsnHA2o5+o4wW9bLM/JYQitNP9xPhsXwC08hMMovfGe/8retsdDsczPRg== -react-fast-compare@^3.2.0, react-fast-compare@^3.2.2: +react-fast-compare@^3.2.0: version "3.2.2" resolved "https://registry.yarnpkg.com/react-fast-compare/-/react-fast-compare-3.2.2.tgz#929a97a532304ce9fee4bcae44234f1ce2c21d49" integrity sha512-nsO+KSNgo1SbJqJEYRE9ERzo7YtYbou/OqjSQKxV7jcKox7+usiUVZOAC+XnDOABXggQTno0Y1CpVnuWEc1boQ== -react-helmet-async@*: - version "2.0.5" - resolved "https://registry.yarnpkg.com/react-helmet-async/-/react-helmet-async-2.0.5.tgz#cfc70cd7bb32df7883a8ed55502a1513747223ec" - integrity sha512-rYUYHeus+i27MvFE+Jaa4WsyBKGkL6qVgbJvSBoX8mbsWoABJXdEO0bZyi0F6i+4f0NuIb8AvqPMj3iXFHkMwg== - dependencies: - invariant "^2.2.4" - react-fast-compare "^3.2.2" - shallowequal "^1.1.0" - -react-helmet-async@^1.3.0: +"react-helmet-async@npm:@slorber/react-helmet-async@*", "react-helmet-async@npm:@slorber/react-helmet-async@1.3.0": version "1.3.0" - resolved "https://registry.yarnpkg.com/react-helmet-async/-/react-helmet-async-1.3.0.tgz#7bd5bf8c5c69ea9f02f6083f14ce33ef545c222e" - integrity sha512-9jZ57/dAn9t3q6hneQS0wukqC2ENOBgMNVEhb/ZG9ZSxUetzVIw4iAmEU38IaVg3QGYauQPhSeUTuIUtFglWpg== + resolved "https://registry.yarnpkg.com/@slorber/react-helmet-async/-/react-helmet-async-1.3.0.tgz#11fbc6094605cf60aa04a28c17e0aab894b4ecff" + integrity sha512-e9/OK8VhwUSc67diWI8Rb3I0YgI9/SBQtnhe9aEuK6MhZm7ntZZimXgwXnd8W96YTmSOb9M4d8LwhRZyhWr/1A== dependencies: "@babel/runtime" "^7.12.5" invariant "^2.2.4" @@ -10473,10 +9862,15 @@ react-is@^16.13.1, react-is@^16.6.0, react-is@^16.7.0: resolved "https://registry.yarnpkg.com/react-is/-/react-is-16.13.1.tgz#789729a4dc36de2999dc156dd6c1d9c18cea56a4" integrity sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ== +react-is@^19.0.0: + version "19.0.0" + resolved "https://registry.yarnpkg.com/react-is/-/react-is-19.0.0.tgz#d6669fd389ff022a9684f708cf6fa4962d1fea7a" + integrity sha512-H91OHcwjZsbq3ClIDHMzBShc1rotbfACdWENsmEf0IFvZ3FgGPtdHMcsv45bQ1hAbgdfiA8SnxTKfDS+x/8m2g== + react-json-view-lite@^1.2.0: - version "1.4.0" - resolved "https://registry.yarnpkg.com/react-json-view-lite/-/react-json-view-lite-1.4.0.tgz#0ff493245f4550abe5e1f1836f170fa70bb95914" - integrity sha512-wh6F6uJyYAmQ4fK0e8dSQMEWuvTs2Wr3el3sLD9bambX1+pSWUVXIz1RFaoy3TI1mZ0FqdpKq9YgbgTTgyrmXA== + version "1.5.0" + resolved "https://registry.yarnpkg.com/react-json-view-lite/-/react-json-view-lite-1.5.0.tgz#377cc302821717ac79a1b6d099e1891df54c8662" + integrity sha512-nWqA1E4jKPklL2jvHWs6s+7Na0qNgw9HCP6xehdQJeg6nPBTFZgGwyko9Q0oj+jQWKTTVRS30u0toM5wiuL3iw== react-loadable-ssr-addon-v5-slorber@^1.0.1: version "1.0.1" @@ -10545,9 +9939,9 @@ react-shallow-renderer@^16.15.0: react-is "^16.12.0 || ^17.0.0 || ^18.0.0" react-tabs@^6.0.2: - version "6.0.2" - resolved "https://registry.yarnpkg.com/react-tabs/-/react-tabs-6.0.2.tgz#bc1065c3828561fee285a8fd045f22e0fcdde1eb" - integrity sha512-aQXTKolnM28k3KguGDBSAbJvcowOQr23A+CUJdzJtOSDOtTwzEaJA+1U4KwhNL9+Obe+jFS7geuvA7ICQPXOnQ== + version "6.1.0" + resolved "https://registry.yarnpkg.com/react-tabs/-/react-tabs-6.1.0.tgz#a1fc9d9b8db4c6e7bb327a1b6783bc51a1c457a1" + integrity sha512-6QtbTRDKM+jA/MZTTefvigNxo0zz+gnBTVFw2CFVvq+f2BuH0nF0vDLNClL045nuTAdOoK/IL1vTP0ZLX0DAyQ== dependencies: clsx "^2.0.0" prop-types "^15.5.0" @@ -10582,7 +9976,7 @@ readable-stream@^2.0.1: string_decoder "~1.1.1" util-deprecate "~1.0.1" -readable-stream@^3.0.6, readable-stream@^3.1.1, readable-stream@^3.4.0: +readable-stream@^3.0.6: version "3.6.2" resolved "https://registry.yarnpkg.com/readable-stream/-/readable-stream-3.6.2.tgz#56a9b36ea965c00c5a93ef31eb111a0f11056967" integrity sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA== @@ -10610,6 +10004,46 @@ rechoir@^0.6.2: dependencies: resolve "^1.1.6" +recma-build-jsx@^1.0.0: + version "1.0.0" + resolved "https://registry.yarnpkg.com/recma-build-jsx/-/recma-build-jsx-1.0.0.tgz#c02f29e047e103d2fab2054954e1761b8ea253c4" + integrity sha512-8GtdyqaBcDfva+GUKDr3nev3VpKAhup1+RvkMvUxURHpW7QyIvk9F5wz7Vzo06CEMSilw6uArgRqhpiUcWp8ew== + dependencies: + "@types/estree" "^1.0.0" + estree-util-build-jsx "^3.0.0" + vfile "^6.0.0" + +recma-jsx@^1.0.0: + version "1.0.0" + resolved "https://registry.yarnpkg.com/recma-jsx/-/recma-jsx-1.0.0.tgz#f7bef02e571a49d6ba3efdfda8e2efab48dbe3aa" + integrity sha512-5vwkv65qWwYxg+Atz95acp8DMu1JDSqdGkA2Of1j6rCreyFUE/gp15fC8MnGEuG1W68UKjM6x6+YTWIh7hZM/Q== + dependencies: + acorn-jsx "^5.0.0" + estree-util-to-js "^2.0.0" + recma-parse "^1.0.0" + recma-stringify "^1.0.0" + unified "^11.0.0" + +recma-parse@^1.0.0: + version "1.0.0" + resolved "https://registry.yarnpkg.com/recma-parse/-/recma-parse-1.0.0.tgz#c351e161bb0ab47d86b92a98a9d891f9b6814b52" + integrity sha512-OYLsIGBB5Y5wjnSnQW6t3Xg7q3fQ7FWbw/vcXtORTnyaSFscOtABg+7Pnz6YZ6c27fG1/aN8CjfwoUEUIdwqWQ== + dependencies: + "@types/estree" "^1.0.0" + esast-util-from-js "^2.0.0" + unified "^11.0.0" + vfile "^6.0.0" + +recma-stringify@^1.0.0: + version "1.0.0" + resolved "https://registry.yarnpkg.com/recma-stringify/-/recma-stringify-1.0.0.tgz#54632030631e0c7546136ff9ef8fde8e7b44f130" + integrity sha512-cjwII1MdIIVloKvC9ErQ+OgAtwHBmcZ0Bg4ciz78FtbT8In39aAYbaA7zvxQ61xVMSPE8WxhLwLbhif4Js2C+g== + dependencies: + "@types/estree" "^1.0.0" + estree-util-to-js "^2.0.0" + unified "^11.0.0" + vfile "^6.0.0" + recursive-readdir@^2.2.2: version "2.2.3" resolved "https://registry.yarnpkg.com/recursive-readdir/-/recursive-readdir-2.2.3.tgz#e726f328c0d69153bcabd5c322d3195252379372" @@ -10645,26 +10079,19 @@ redoc@2.1.5: swagger2openapi "^7.0.8" url-template "^2.0.8" -redocusaurus@^2.0.2: - version "2.1.1" - resolved "https://registry.yarnpkg.com/redocusaurus/-/redocusaurus-2.1.1.tgz#f2caca4c876dd76b7da9f060e290ee1db848d309" - integrity sha512-uaiuSsty0TcYuibabEw72DzN5JL6eF9KTIR5dL61qP7smFwIY8THEsNogzKTfcKCb6MJ8ug4vohrnrANn3K3cg== +redocusaurus@^2.2.0: + version "2.2.1" + resolved "https://registry.yarnpkg.com/redocusaurus/-/redocusaurus-2.2.1.tgz#2b3c7df8d6c6749caaa40b9b72e5a9f1323db3eb" + integrity sha512-eYk807UrZ2/gWX3DoK/NxnmVNCeOuJI9o7rsUwDFkkVMIRDEiwpF/qy/5tSLKQvn7pqmHNxFONqsAozzoDK7Fw== dependencies: - docusaurus-plugin-redoc "2.1.1" - docusaurus-theme-redoc "2.1.1" + docusaurus-plugin-redoc "2.2.1" + docusaurus-theme-redoc "2.2.1" reftools@^1.1.9: version "1.1.9" resolved "https://registry.yarnpkg.com/reftools/-/reftools-1.1.9.tgz#e16e19f662ccd4648605312c06d34e5da3a2b77e" integrity sha512-OVede/NQE13xBQ+ob5CKd5KyeJYU2YInb1bmV4nRoOfquZPkAkxuOXicSe1PvqIuZZ4kD13sPKBbR7UFDmli6w== -regenerate-unicode-properties@^10.1.0: - version "10.1.1" - resolved "https://registry.yarnpkg.com/regenerate-unicode-properties/-/regenerate-unicode-properties-10.1.1.tgz#6b0e05489d9076b04c436f318d9b067bba459480" - integrity sha512-X007RyZLsCJVVrjgEFVpLUTZwyOZk3oiL75ZcuYjlIWd6rNJtOjkBwQc5AsRrpbKVkxN6sklw/k/9m2jJYOf8Q== - dependencies: - regenerate "^1.4.2" - regenerate-unicode-properties@^10.2.0: version "10.2.0" resolved "https://registry.yarnpkg.com/regenerate-unicode-properties/-/regenerate-unicode-properties-10.2.0.tgz#626e39df8c372338ea9b8028d1f99dc3fd9c3db0" @@ -10689,44 +10116,22 @@ regenerator-transform@^0.15.2: dependencies: "@babel/runtime" "^7.8.4" -regexp.prototype.flags@^1.5.2: - version "1.5.2" - resolved "https://registry.yarnpkg.com/regexp.prototype.flags/-/regexp.prototype.flags-1.5.2.tgz#138f644a3350f981a858c44f6bb1a61ff59be334" - integrity sha512-NcDiDkTLuPR+++OCKB0nWafEmhg/Da8aUPLPMQbK+bxKKCm1/S5he+AqYa4PlMCVBalb4/yxIRub6qkEx5yJbw== - dependencies: - call-bind "^1.0.6" - define-properties "^1.2.1" - es-errors "^1.3.0" - set-function-name "^2.0.1" - -regexpu-core@^5.3.1: - version "5.3.2" - resolved "https://registry.yarnpkg.com/regexpu-core/-/regexpu-core-5.3.2.tgz#11a2b06884f3527aec3e93dbbf4a3b958a95546b" - integrity sha512-RAM5FlZz+Lhmo7db9L298p2vHP5ZywrVXmVXpmAD9GuL5MPH6t9ROw1iA/wfHkQ76Qe7AaPF0nGuim96/IrQMQ== - dependencies: - "@babel/regjsgen" "^0.8.0" - regenerate "^1.4.2" - regenerate-unicode-properties "^10.1.0" - regjsparser "^0.9.1" - unicode-match-property-ecmascript "^2.0.0" - unicode-match-property-value-ecmascript "^2.1.0" - -regexpu-core@^6.1.1: - version "6.1.1" - resolved "https://registry.yarnpkg.com/regexpu-core/-/regexpu-core-6.1.1.tgz#b469b245594cb2d088ceebc6369dceb8c00becac" - integrity sha512-k67Nb9jvwJcJmVpw0jPttR1/zVfnKf8Km0IPatrU/zJ5XeG3+Slx0xLXs9HByJSzXzrlz5EDvN6yLNMDc2qdnw== +regexpu-core@^6.2.0: + version "6.2.0" + resolved "https://registry.yarnpkg.com/regexpu-core/-/regexpu-core-6.2.0.tgz#0e5190d79e542bf294955dccabae04d3c7d53826" + integrity sha512-H66BPQMrv+V16t8xtmq+UC0CBpiTBA60V8ibS1QVReIp8T1z8hwFxqcGzm9K6lgsN7sB5edVH8a+ze6Fqm4weA== dependencies: regenerate "^1.4.2" regenerate-unicode-properties "^10.2.0" regjsgen "^0.8.0" - regjsparser "^0.11.0" + regjsparser "^0.12.0" unicode-match-property-ecmascript "^2.0.0" unicode-match-property-value-ecmascript "^2.1.0" registry-auth-token@^5.0.1: - version "5.0.2" - resolved "https://registry.yarnpkg.com/registry-auth-token/-/registry-auth-token-5.0.2.tgz#8b026cc507c8552ebbe06724136267e63302f756" - integrity sha512-o/3ikDxtXaA59BmZuZrJZDJv8NMDGSj+6j6XaeBmHw8eY1i1qd9+6H+LjVvQXx3HN6aRCGa1cUdJ9RaJZUugnQ== + version "5.0.3" + resolved "https://registry.yarnpkg.com/registry-auth-token/-/registry-auth-token-5.0.3.tgz#417d758c8164569de8cf5cabff16cc937902dcc6" + integrity sha512-1bpc9IyC+e+CNFRaWyn77tk4xGG4PPUyfakSmA6F6cvUDjrm58dfyJ3II+9yb10EDkHoy1LaPSmHaWLOH3m6HA== dependencies: "@pnpm/npm-conf" "^2.1.0" @@ -10742,20 +10147,13 @@ regjsgen@^0.8.0: resolved "https://registry.yarnpkg.com/regjsgen/-/regjsgen-0.8.0.tgz#df23ff26e0c5b300a6470cad160a9d090c3a37ab" integrity sha512-RvwtGe3d7LvWiDQXeQw8p5asZUmfU1G/l6WbUXeHta7Y2PEIvBTwH6E2EfmYUK8pxcxEdEmaomqyp0vZZ7C+3Q== -regjsparser@^0.11.0: - version "0.11.2" - resolved "https://registry.yarnpkg.com/regjsparser/-/regjsparser-0.11.2.tgz#7404ad42be00226d72bcf1f003f1f441861913d8" - integrity sha512-3OGZZ4HoLJkkAZx/48mTXJNlmqTGOzc0o9OWQPuWpkOlXXPbyN6OafCcoXUnBqE2D3f/T5L+pWc1kdEmnfnRsA== +regjsparser@^0.12.0: + version "0.12.0" + resolved "https://registry.yarnpkg.com/regjsparser/-/regjsparser-0.12.0.tgz#0e846df6c6530586429377de56e0475583b088dc" + integrity sha512-cnE+y8bz4NhMjISKbgeVJtqNbtf5QpjZP+Bslo+UqkIt9QPnX9q095eiRRASJG1/tz6dlNr6Z5NsBiWYokp6EQ== dependencies: jsesc "~3.0.2" -regjsparser@^0.9.1: - version "0.9.1" - resolved "https://registry.yarnpkg.com/regjsparser/-/regjsparser-0.9.1.tgz#272d05aa10c7c1f67095b1ff0addae8442fc5709" - integrity sha512-dQUtn90WanSNl+7mQKcXAgZxvUe7Z0SqXlgzv0za4LwiUhyzBC58yQO3liFoUgu8GiJVInAhJjkj1N0EtQ5nkQ== - dependencies: - jsesc "~0.5.0" - rehype-raw@^7.0.0: version "7.0.0" resolved "https://registry.yarnpkg.com/rehype-raw/-/rehype-raw-7.0.0.tgz#59d7348fd5dbef3807bbaa1d443efd2dd85ecee4" @@ -10765,6 +10163,15 @@ rehype-raw@^7.0.0: hast-util-raw "^9.0.0" vfile "^6.0.0" +rehype-recma@^1.0.0: + version "1.0.0" + resolved "https://registry.yarnpkg.com/rehype-recma/-/rehype-recma-1.0.0.tgz#d68ef6344d05916bd96e25400c6261775411aa76" + integrity sha512-lqA4rGUf1JmacCNWWZx0Wv1dHqMwxzsDWYMTowuplHF3xH0N/MmrZ/G3BDZnzAkRmxDadujCjaKM2hqYdCBOGw== + dependencies: + "@types/estree" "^1.0.0" + "@types/hast" "^3.0.0" + hast-util-to-estree "^3.0.0" + relateurl@^0.2.7: version "0.2.7" resolved "https://registry.yarnpkg.com/relateurl/-/relateurl-0.2.7.tgz#54dbf377e51440aca90a4cd274600d3ff2d888a9" @@ -10814,9 +10221,9 @@ remark-gfm@^4.0.0: unified "^11.0.0" remark-mdx@^3.0.0: - version "3.0.1" - resolved "https://registry.yarnpkg.com/remark-mdx/-/remark-mdx-3.0.1.tgz#8f73dd635c1874e44426e243f72c0977cf60e212" - integrity sha512-3Pz3yPQ5Rht2pM5R+0J2MrGoBSrzf+tJG94N+t/ilfdh8YLyyKYtidAYwTveB20BoHAcwIopOUqhcmh2F7hGYA== + version "3.1.0" + resolved "https://registry.yarnpkg.com/remark-mdx/-/remark-mdx-3.1.0.tgz#f979be729ecb35318fa48e2135c1169607a78343" + integrity sha512-Ngl/H3YXyBV9RcRNdlYsZujAmhsxwzxpDzpDEhFBVAGthS4GDgnctpDjgFl/ULx5UEDzqtW1cyBSNKqYYrqLBA== dependencies: mdast-util-mdx "^3.0.0" micromark-extension-mdxjs "^3.0.0" @@ -10832,9 +10239,9 @@ remark-parse@^11.0.0: unified "^11.0.0" remark-rehype@^11.0.0: - version "11.1.0" - resolved "https://registry.yarnpkg.com/remark-rehype/-/remark-rehype-11.1.0.tgz#d5f264f42bcbd4d300f030975609d01a1697ccdc" - integrity sha512-z3tJrAs2kIs1AqIIy6pzHmAHlF1hWQ+OdY4/hv+Wxe35EhyLKcajL33iUEn3ScxtFox9nUvRufR/Zre8Q08H/g== + version "11.1.1" + resolved "https://registry.yarnpkg.com/remark-rehype/-/remark-rehype-11.1.1.tgz#f864dd2947889a11997c0a2667cd6b38f685bca7" + integrity sha512-g/osARvjkBXb6Wo0XvAeXQohVta8i84ACbenPpoSsxTOQH/Ae0/RGP4WZgnMH5pMLpsj4FG7OHmcIcXxpza8eQ== dependencies: "@types/hast" "^3.0.0" "@types/mdast" "^4.0.0" @@ -10887,10 +10294,10 @@ requires-port@^1.0.0: resolved "https://registry.yarnpkg.com/requires-port/-/requires-port-1.0.0.tgz#925d2601d39ac485e091cf0da5c6e694dc3dcaff" integrity sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ== -reselect@^4.1.8: - version "4.1.8" - resolved "https://registry.yarnpkg.com/reselect/-/reselect-4.1.8.tgz#3f5dc671ea168dccdeb3e141236f69f02eaec524" - integrity sha512-ab9EmR80F/zQTMNeneUr4cv+jSwPJgIlvEmVwLerwrWVbpLlBuls9XHzIeTFy4cegU2NHBp3va0LKOzU5qFEYQ== +reselect@^5.1.1: + version "5.1.1" + resolved "https://registry.yarnpkg.com/reselect/-/reselect-5.1.1.tgz#c766b1eb5d558291e5e550298adb0becc24bb72e" + integrity sha512-K/BG6eIky/SBpzfHZv/dd+9JBFiS4SWV7FIujVyJRux6e45+73RaUHXLmIR1f7WOMaQ0U1km6qwklRQxpJJY0w== resolve-alpn@^1.2.0: version "1.2.1" @@ -10908,11 +10315,11 @@ resolve-pathname@^3.0.0: integrity sha512-C7rARubxI8bXFNB/hqcp/4iUeIXJhJZvFPFPiSPRnhU5UPxzMFIl+2E6yY6c4k9giDJAhtV+enfA+G89N6Csng== resolve@^1.1.6, resolve@^1.14.2, resolve@^1.19.0: - version "1.22.8" - resolved "https://registry.yarnpkg.com/resolve/-/resolve-1.22.8.tgz#b6c87a9f2aa06dfab52e3d70ac8cde321fa5a48d" - integrity sha512-oKWePCxqpd6FlLvGV1VU0x7bkPmmCNolxzjMf4NczoDnQcIWrAF+cPtZn5i6n+RfD2d9i0tzpKnG6Yk168yIyw== + version "1.22.10" + resolved "https://registry.yarnpkg.com/resolve/-/resolve-1.22.10.tgz#b663e83ffb09bbf2386944736baae803029b8b39" + integrity sha512-NPRy+/ncIMeDlTAsuqwKIiferiawhefFJtkNSW0qZJEqMEb+qBt/77B/jGeeek+F0uOeN05CDa6HXbbIgtVX4w== dependencies: - is-core-module "^2.13.0" + is-core-module "^2.16.0" path-parse "^1.0.7" supports-preserve-symlinks-flag "^1.0.0" @@ -10933,7 +10340,7 @@ reusify@^1.0.4: resolved "https://registry.yarnpkg.com/reusify/-/reusify-1.0.4.tgz#90da382b1e126efc02146e90845a88db12925d76" integrity sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw== -rimraf@3.0.2, rimraf@^3.0.2: +rimraf@^3.0.2: version "3.0.2" resolved "https://registry.yarnpkg.com/rimraf/-/rimraf-3.0.2.tgz#f1a5402ba6220ad52cc1282bac1ae3aa49fd061a" integrity sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA== @@ -10955,15 +10362,10 @@ roughjs@^4.6.6: points-on-curve "^0.2.0" points-on-path "^0.2.1" -rtl-detect@^1.0.4: - version "1.1.2" - resolved "https://registry.yarnpkg.com/rtl-detect/-/rtl-detect-1.1.2.tgz#ca7f0330af5c6bb626c15675c642ba85ad6273c6" - integrity sha512-PGMBq03+TTG/p/cRB7HCLKJ1MgDIi07+QU1faSjiYRfmY5UsAttV9Hs08jDAHVwcOwmVLcSJkpwyfXszVjWfIQ== - rtlcss@^4.1.0: - version "4.1.1" - resolved "https://registry.yarnpkg.com/rtlcss/-/rtlcss-4.1.1.tgz#f20409fcc197e47d1925996372be196fee900c0c" - integrity sha512-/oVHgBtnPNcggP2aVXQjSy6N1mMAfHg4GSag0QtZBlD5bdDgAHwr4pydqJGd+SUCu9260+Pjqbjwtvu7EMH1KQ== + version "4.3.0" + resolved "https://registry.yarnpkg.com/rtlcss/-/rtlcss-4.3.0.tgz#f8efd4d5b64f640ec4af8fa25b65bacd9e07cc97" + integrity sha512-FI+pHEn7Wc4NqKXMXFM+VAYKEj/mRIcW4h24YVwVtyjI+EqGrLc2Hx/Ny0lrZ21cBWU2goLy36eqMcNj3AQJig== dependencies: escalade "^3.1.1" picocolors "^1.0.0" @@ -10989,34 +10391,15 @@ sade@^1.7.3: dependencies: mri "^1.1.0" -safe-array-concat@^1.1.2: - version "1.1.2" - resolved "https://registry.yarnpkg.com/safe-array-concat/-/safe-array-concat-1.1.2.tgz#81d77ee0c4e8b863635227c721278dd524c20edb" - integrity sha512-vj6RsCsWBCf19jIeHEfkRMw8DPiBb+DMXklQ/1SGDHOMlHdPUkZXFQ2YdplS23zESTijAcurb1aSgJA3AgMu1Q== - dependencies: - call-bind "^1.0.7" - get-intrinsic "^1.2.4" - has-symbols "^1.0.3" - isarray "^2.0.5" - -safe-buffer@5.1.2, safe-buffer@~5.1.0, safe-buffer@~5.1.1: - version "5.1.2" - resolved "https://registry.yarnpkg.com/safe-buffer/-/safe-buffer-5.1.2.tgz#991ec69d296e0313747d59bdfd2b745c35f8828d" - integrity sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g== - safe-buffer@5.2.1, safe-buffer@>=5.1.0, safe-buffer@^5.1.0, safe-buffer@~5.2.0: version "5.2.1" resolved "https://registry.yarnpkg.com/safe-buffer/-/safe-buffer-5.2.1.tgz#1eaf9fa9bdb1fdd4ec75f58f9cdb4e6b7827eec6" integrity sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ== -safe-regex-test@^1.0.3: - version "1.0.3" - resolved "https://registry.yarnpkg.com/safe-regex-test/-/safe-regex-test-1.0.3.tgz#a5b4c0f06e0ab50ea2c395c14d8371232924c377" - integrity sha512-CdASjNJPvRa7roO6Ra/gLYBTzYzzPyyBXxIMdGW3USQLyjWEls2RgW5UBTXaQVp+OrpeCK3bLem8smtmheoRuw== - dependencies: - call-bind "^1.0.6" - es-errors "^1.3.0" - is-regex "^1.1.4" +safe-buffer@~5.1.0, safe-buffer@~5.1.1: + version "5.1.2" + resolved "https://registry.yarnpkg.com/safe-buffer/-/safe-buffer-5.1.2.tgz#991ec69d296e0313747d59bdfd2b745c35f8828d" + integrity sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g== "safer-buffer@>= 2.1.2 < 3", "safer-buffer@>= 2.1.2 < 3.0.0": version "2.1.2" @@ -11044,7 +10427,7 @@ schema-utils@2.7.0: ajv "^6.12.2" ajv-keywords "^3.4.1" -schema-utils@^3.0.0, schema-utils@^3.1.1, schema-utils@^3.2.0: +schema-utils@^3.0.0, schema-utils@^3.2.0: version "3.3.0" resolved "https://registry.yarnpkg.com/schema-utils/-/schema-utils-3.3.0.tgz#f50a88877c3c01652a15b622ae9e9795df7a60fe" integrity sha512-pN/yOAvcC+5rQ5nERGuwrjLlYvLTbCibnZ1I7B1LaiAz9BRBlE9GMgE/eqV30P7aJQUf7Ddimy/RsbYO/GrVGg== @@ -11053,10 +10436,10 @@ schema-utils@^3.0.0, schema-utils@^3.1.1, schema-utils@^3.2.0: ajv "^6.12.5" ajv-keywords "^3.5.2" -schema-utils@^4.0.0, schema-utils@^4.0.1: - version "4.2.0" - resolved "https://registry.yarnpkg.com/schema-utils/-/schema-utils-4.2.0.tgz#70d7c93e153a273a805801882ebd3bff20d89c8b" - integrity sha512-L0jRsrPpjdckP3oPug3/VxNKt2trR8TcabrM6FOAAlvC/9Phcmm+cuAgTlxBqdBR1WJx7Naj9WHw+aOmheSVbw== +schema-utils@^4.0.0, schema-utils@^4.0.1, schema-utils@^4.3.0: + version "4.3.0" + resolved "https://registry.yarnpkg.com/schema-utils/-/schema-utils-4.3.0.tgz#3b669f04f71ff2dfb5aba7ce2d5a9d79b35622c0" + integrity sha512-Gf9qqc58SpCA/xdziiHz35F4GNIWYWZrEshUc/G/r5BnLph6xpKuLeoJoQuj5WfBIx/eQLf+hmVPYHaxJu7V2g== dependencies: "@types/json-schema" "^7.0.9" ajv "^8.9.0" @@ -11096,10 +10479,10 @@ semver@^6.3.1: resolved "https://registry.yarnpkg.com/semver/-/semver-6.3.1.tgz#556d2ef8689146e46dcea4bfdd095f3434dffcb4" integrity sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA== -semver@^7.3.2, semver@^7.3.5, semver@^7.3.7, semver@^7.5.4: - version "7.6.2" - resolved "https://registry.yarnpkg.com/semver/-/semver-7.6.2.tgz#1e3b34759f896e8f14d6134732ce798aeb0c6e13" - integrity sha512-FNAIBWCx9qcRhoHcgcJ0gvU7SN1lYU2ZXuSfl04bSC5OpvDHFyJCjdNHomPXxjQlCBU67YW64PzY7/VIEH7F2w== +semver@^7.3.2, semver@^7.3.5, semver@^7.3.7, semver@^7.5.4, semver@^7.6.3: + version "7.6.3" + resolved "https://registry.yarnpkg.com/semver/-/semver-7.6.3.tgz#980f7b5550bc175fb4dc09403085627f9eb33143" + integrity sha512-oVekP1cKtI+CTDvHWYFUcMtsK/00wmAEfyqKfNdARm8u1wNVhSgaX7A8d4UuIlUI5e84iEwOhs7ZPYRmzU9U6A== send@0.19.0: version "0.19.0" @@ -11120,7 +10503,7 @@ send@0.19.0: range-parser "~1.2.1" statuses "2.0.1" -serialize-javascript@^6.0.0, serialize-javascript@^6.0.1: +serialize-javascript@^6.0.0, serialize-javascript@^6.0.1, serialize-javascript@^6.0.2: version "6.0.2" resolved "https://registry.yarnpkg.com/serialize-javascript/-/serialize-javascript-6.0.2.tgz#defa1e055c83bf6d59ea805d8da862254eb6a6c2" integrity sha512-Saa1xPByTTq2gdeFZYLLo+RFE35NHZkAbqZeWNd3BpzppeVisAqpDjcp8dyf6uIvEqJRd46jemmyA4iFIeVk8g== @@ -11163,7 +10546,7 @@ serve-static@1.16.2: parseurl "~1.3.3" send "0.19.0" -set-function-length@^1.2.1: +set-function-length@^1.2.2: version "1.2.2" resolved "https://registry.yarnpkg.com/set-function-length/-/set-function-length-1.2.2.tgz#aac72314198eaed975cf77b2c3b6b880695e5449" integrity sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg== @@ -11175,16 +10558,6 @@ set-function-length@^1.2.1: gopd "^1.0.1" has-property-descriptors "^1.0.2" -set-function-name@^2.0.1: - version "2.0.2" - resolved "https://registry.yarnpkg.com/set-function-name/-/set-function-name-2.0.2.tgz#16a705c5a0dc2f5e638ca96d8a8cd4e1c2b90985" - integrity sha512-7PGFlmtwsEADb0WYyvCMa1t+yke6daIG4Wirafur5kcf+MhUnPms1UeR0CKQdTZD81yESwMHbtn+TR+dMviakQ== - dependencies: - define-data-property "^1.1.4" - es-errors "^1.3.0" - functions-have-names "^1.2.3" - has-property-descriptors "^1.0.2" - setprototypeof@1.1.0: version "1.1.0" resolved "https://registry.yarnpkg.com/setprototypeof/-/setprototypeof-1.1.0.tgz#d0bd85536887b6fe7c0d818cb962d9d91c54e656" @@ -11220,9 +10593,9 @@ shebang-regex@^3.0.0: integrity sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A== shell-quote@^1.7.3, shell-quote@^1.8.1: - version "1.8.1" - resolved "https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.8.1.tgz#6dbf4db75515ad5bac63b4f1894c3a154c766680" - integrity sha512-6j1W9l1iAs/4xYBI1SYOVZyFcCis9b4KCLQ8fgAGG07QvzaRLVVRQvAy85yNmmZSjYjg4MWh4gNvlPujU/5LpA== + version "1.8.2" + resolved "https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.8.2.tgz#d2d83e057959d53ec261311e9e9b8f51dcb2934a" + integrity sha512-AzqKpGKjrj7EM6rKVQEPpB288oCfnrEIuyoT9cyF4nmGa7V8Zk6f7RRqYisX8X9m+Q7bd632aZW4ky7EhbQztA== shelljs@^0.8.5: version "0.8.5" @@ -11277,15 +10650,45 @@ should@^13.2.1: should-type-adaptors "^1.0.1" should-util "^1.0.0" -side-channel@^1.0.4, side-channel@^1.0.6: - version "1.0.6" - resolved "https://registry.yarnpkg.com/side-channel/-/side-channel-1.0.6.tgz#abd25fb7cd24baf45466406b1096b7831c9215f2" - integrity sha512-fDW/EZ6Q9RiO8eFG8Hj+7u/oW+XrPTIChwCOM2+th2A6OblDtYYIpve9m+KvI9Z4C9qSEXlaGR6bTEYHReuglA== +side-channel-list@^1.0.0: + version "1.0.0" + resolved "https://registry.yarnpkg.com/side-channel-list/-/side-channel-list-1.0.0.tgz#10cb5984263115d3b7a0e336591e290a830af8ad" + integrity sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA== dependencies: - call-bind "^1.0.7" es-errors "^1.3.0" - get-intrinsic "^1.2.4" - object-inspect "^1.13.1" + object-inspect "^1.13.3" + +side-channel-map@^1.0.1: + version "1.0.1" + resolved "https://registry.yarnpkg.com/side-channel-map/-/side-channel-map-1.0.1.tgz#d6bb6b37902c6fef5174e5f533fab4c732a26f42" + integrity sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA== + dependencies: + call-bound "^1.0.2" + es-errors "^1.3.0" + get-intrinsic "^1.2.5" + object-inspect "^1.13.3" + +side-channel-weakmap@^1.0.2: + version "1.0.2" + resolved "https://registry.yarnpkg.com/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz#11dda19d5368e40ce9ec2bdc1fb0ecbc0790ecea" + integrity sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A== + dependencies: + call-bound "^1.0.2" + es-errors "^1.3.0" + get-intrinsic "^1.2.5" + object-inspect "^1.13.3" + side-channel-map "^1.0.1" + +side-channel@^1.0.6: + version "1.1.0" + resolved "https://registry.yarnpkg.com/side-channel/-/side-channel-1.1.0.tgz#c3fcff9c4da932784873335ec9765fa94ff66bc9" + integrity sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw== + dependencies: + es-errors "^1.3.0" + object-inspect "^1.13.3" + side-channel-list "^1.0.0" + side-channel-map "^1.0.1" + side-channel-weakmap "^1.0.2" signal-exit@^3.0.2, signal-exit@^3.0.3: version "3.0.7" @@ -11338,6 +10741,11 @@ slugify@~1.4.7: resolved "https://registry.yarnpkg.com/slugify/-/slugify-1.4.7.tgz#e42359d505afd84a44513280868e31202a79a628" integrity sha512-tf+h5W1IrjNm/9rKKj0JU2MDMruiopx0jjVA5zCdBtcGjfp0+c5rHw/zADLC3IeKlGHtVbHtpfzvYA0OYT+HKg== +smart-buffer@^4.2.0: + version "4.2.0" + resolved "https://registry.yarnpkg.com/smart-buffer/-/smart-buffer-4.2.0.tgz#6e1d71fa4f18c05f7d0ff216dd16a481d0e8d9ae" + integrity sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg== + snake-case@^3.0.4: version "3.0.4" resolved "https://registry.yarnpkg.com/snake-case/-/snake-case-3.0.4.tgz#4f2bbd568e9935abdfd593f34c691dadb49c452c" @@ -11355,12 +10763,34 @@ sockjs@^0.3.24: uuid "^8.3.2" websocket-driver "^0.7.4" +socks-proxy-agent@^8.0.5: + version "8.0.5" + resolved "https://registry.yarnpkg.com/socks-proxy-agent/-/socks-proxy-agent-8.0.5.tgz#b9cdb4e7e998509d7659d689ce7697ac21645bee" + integrity sha512-HehCEsotFqbPW9sJ8WVYB6UbmIMv7kUUORIF2Nncq4VQvBfNBLibW9YZR5dlYCSUhwcD628pRllm7n+E+YTzJw== + dependencies: + agent-base "^7.1.2" + debug "^4.3.4" + socks "^2.8.3" + +socks@^2.8.3: + version "2.8.3" + resolved "https://registry.yarnpkg.com/socks/-/socks-2.8.3.tgz#1ebd0f09c52ba95a09750afe3f3f9f724a800cb5" + integrity sha512-l5x7VUUWbjVFbafGLxPWkYsHIhEvmF85tbIeFZWc8ZPtoMyybuEhL7Jye/ooC4/d48FgOjSJXgsF/AJPYCW8Zw== + dependencies: + ip-address "^9.0.5" + smart-buffer "^4.2.0" + sort-css-media-queries@2.2.0: version "2.2.0" resolved "https://registry.yarnpkg.com/sort-css-media-queries/-/sort-css-media-queries-2.2.0.tgz#aa33cf4a08e0225059448b6c40eddbf9f1c8334c" integrity sha512-0xtkGhWCC9MGt/EzgnvbbbKhqWjl1+/rncmhTh5qCpbYguXh6S/qwePfv/JQ8jePXXmqingylxoC49pCkSPIbA== -source-map-js@^1.0.1, source-map-js@^1.2.0: +source-map-js@^1.0.1, source-map-js@^1.2.1: + version "1.2.1" + resolved "https://registry.yarnpkg.com/source-map-js/-/source-map-js-1.2.1.tgz#1ce5650fddd87abc099eda37dcff024c2667ae46" + integrity sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA== + +source-map-js@^1.2.0: version "1.2.0" resolved "https://registry.yarnpkg.com/source-map-js/-/source-map-js-1.2.0.tgz#16b809c162517b5b8c3e7dcd315a2a5c2612b2af" integrity sha512-itJW8lvSA0TXEphiRoawsCksnlf8SyvmFzIhltqAHluXd88pkCd+cXJVHTDwdCr0IzwptSm035IHQktUu1QUMg== @@ -11378,7 +10808,7 @@ source-map@^0.5.7: resolved "https://registry.yarnpkg.com/source-map/-/source-map-0.5.7.tgz#8a039d2d1021d22d1ea14c80d8ea468ba2ef3fcc" integrity sha512-LbrmJOMUSdEVxIKvdcJzQC+nQhe8FUZQTXQy6+I75skNgn3OoQ0DZA8YnFa7gp8tqtL3KPf1kmo0R5DoApeSGQ== -source-map@^0.6.0, source-map@~0.6.0: +source-map@^0.6.0, source-map@~0.6.0, source-map@~0.6.1: version "0.6.1" resolved "https://registry.yarnpkg.com/source-map/-/source-map-0.6.1.tgz#74722af32e9614e9c287a8d0bbde48b5e2f1a263" integrity sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g== @@ -11416,6 +10846,11 @@ spdy@^4.0.2: select-hose "^2.0.0" spdy-transport "^3.0.0" +sprintf-js@^1.1.3: + version "1.1.3" + resolved "https://registry.yarnpkg.com/sprintf-js/-/sprintf-js-1.1.3.tgz#4914b903a2f8b685d17fdf78a70e917e872e444a" + integrity sha512-Oo+0REFV59/rz3gfJNKQiBlwfHaSESl1pcGyABQsnnIfWOFt6JNj5gCog2U6MLZ//IGYD+nA8nI+mTShREReaA== + sprintf-js@~1.0.2: version "1.0.3" resolved "https://registry.yarnpkg.com/sprintf-js/-/sprintf-js-1.0.3.tgz#04e6926f662895354f3dd015203633b857297e2c" @@ -11437,15 +10872,26 @@ statuses@2.0.1: integrity sha512-OpZ3zP+jT1PI7I8nemJX4AKmAX070ZkYPVWV/AaKTJl+tXCTGyVdC1a4SL8RUQYEwk/f34ZX8UTykN68FwrqAA== std-env@^3.7.0: - version "3.7.0" - resolved "https://registry.yarnpkg.com/std-env/-/std-env-3.7.0.tgz#c9f7386ced6ecf13360b6c6c55b8aaa4ef7481d2" - integrity sha512-JPbdCEQLj1w5GilpiHAx3qJvFndqybBysA3qUOnznweH4QbNYUsW/ea8QzSrnh0vNsezMMw5bcVool8lM0gwzg== + version "3.8.0" + resolved "https://registry.yarnpkg.com/std-env/-/std-env-3.8.0.tgz#b56ffc1baf1a29dcc80a3bdf11d7fca7c315e7d5" + integrity sha512-Bc3YwwCB+OzldMxOXJIIvC6cPRWr/LxOp48CdQTOkPyk/t4JWWJbrilwBd7RJzKV8QW7tJkcgAmeuLLJugl5/w== stickyfill@^1.1.1: version "1.1.1" resolved "https://registry.yarnpkg.com/stickyfill/-/stickyfill-1.1.1.tgz#39413fee9d025c74a7e59ceecb23784cc0f17f02" integrity sha512-GCp7vHAfpao+Qh/3Flh9DXEJ/qSi0KJwJw6zYlZOtRYXWUIpMM6mC2rIep/dK8RQqwW0KxGJIllmjPIBOGN8AA== +streamx@^2.15.0, streamx@^2.21.0: + version "2.21.1" + resolved "https://registry.yarnpkg.com/streamx/-/streamx-2.21.1.tgz#f02979d8395b6b637d08a589fb514498bed55845" + integrity sha512-PhP9wUnFLa+91CPy3N6tiQsK+gnYyUNuk15S3YG/zjYE7RuPeCjJngqnzpC31ow0lzBHQ+QGO4cNJnd0djYUsw== + dependencies: + fast-fifo "^1.3.2" + queue-tick "^1.0.1" + text-decoder "^1.1.0" + optionalDependencies: + bare-events "^2.2.0" + string-width@^4.1.0, string-width@^4.2.0, string-width@^4.2.3: version "4.2.3" resolved "https://registry.yarnpkg.com/string-width/-/string-width-4.2.3.tgz#269c7117d27b05ad2e536830a8ec895ef9c6d010" @@ -11464,34 +10910,6 @@ string-width@^5.0.1, string-width@^5.1.2: emoji-regex "^9.2.2" strip-ansi "^7.0.1" -string.prototype.trim@^1.2.9: - version "1.2.9" - resolved "https://registry.yarnpkg.com/string.prototype.trim/-/string.prototype.trim-1.2.9.tgz#b6fa326d72d2c78b6df02f7759c73f8f6274faa4" - integrity sha512-klHuCNxiMZ8MlsOihJhJEBJAiMVqU3Z2nEXWfWnIqjN0gEFS9J9+IxKozWWtQGcgoa1WUZzLjKPTr4ZHNFTFxw== - dependencies: - call-bind "^1.0.7" - define-properties "^1.2.1" - es-abstract "^1.23.0" - es-object-atoms "^1.0.0" - -string.prototype.trimend@^1.0.8: - version "1.0.8" - resolved "https://registry.yarnpkg.com/string.prototype.trimend/-/string.prototype.trimend-1.0.8.tgz#3651b8513719e8a9f48de7f2f77640b26652b229" - integrity sha512-p73uL5VCHCO2BZZ6krwwQE3kCzM7NKmis8S//xEC6fQonchbum4eP6kR4DLEjQFO3Wnj3Fuo8NM0kOSjVdHjZQ== - dependencies: - call-bind "^1.0.7" - define-properties "^1.2.1" - es-object-atoms "^1.0.0" - -string.prototype.trimstart@^1.0.8: - version "1.0.8" - resolved "https://registry.yarnpkg.com/string.prototype.trimstart/-/string.prototype.trimstart-1.0.8.tgz#7ee834dda8c7c17eff3118472bb35bfedaa34dde" - integrity sha512-UXSH262CSZY1tfu3G3Secr6uGLCFVPMhIqHjlgCUtCCcgihYc/xKs9djMTMUOb2j1mVSeU8EU6NWc/iQKU6Gfg== - dependencies: - call-bind "^1.0.7" - define-properties "^1.2.1" - es-object-atoms "^1.0.0" - string_decoder@^1.1.1: version "1.3.0" resolved "https://registry.yarnpkg.com/string_decoder/-/string_decoder-1.3.0.tgz#42f114594a46cf1a8e30b0a84f56c78c3edac21e" @@ -11557,7 +10975,12 @@ strip-json-comments@~2.0.1: resolved "https://registry.yarnpkg.com/strip-json-comments/-/strip-json-comments-2.0.1.tgz#3c531942e908c2697c0ec344858c286c7ca0a60a" integrity sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ== -style-to-object@^0.4.0, style-to-object@^0.4.1: +strnum@^1.0.5: + version "1.0.5" + resolved "https://registry.yarnpkg.com/strnum/-/strnum-1.0.5.tgz#5c4e829fe15ad4ff0d20c3db5ac97b73c9b072db" + integrity sha512-J8bbNyKKXl5qYcR36TIO8W3mVGVHrmmxsd5PAItGkmyzwJvybiw2IVq5nqd0i4LSNSkB/sx9VHllbfFdr9k1JA== + +style-to-object@^0.4.1: version "0.4.4" resolved "https://registry.yarnpkg.com/style-to-object/-/style-to-object-0.4.4.tgz#266e3dfd56391a7eefb7770423612d043c3f33ec" integrity sha512-HYNoHZa2GorYNyqiCaBgsxvcJIn7OHq6inEga+E6Ke3m5JkoqpQbnFssk4jwe+K7AhGa2fcha4wSOf1Kn01dMg== @@ -11565,11 +10988,11 @@ style-to-object@^0.4.0, style-to-object@^0.4.1: inline-style-parser "0.1.1" style-to-object@^1.0.0: - version "1.0.6" - resolved "https://registry.yarnpkg.com/style-to-object/-/style-to-object-1.0.6.tgz#0c28aed8be1813d166c60d962719b2907c26547b" - integrity sha512-khxq+Qm3xEyZfKd/y9L3oIWQimxuc4STrQKtQn8aSDRHb8mFgpukgX1hdzfrMEW6JCjyJ8p89x+IUMVnCBI1PA== + version "1.0.8" + resolved "https://registry.yarnpkg.com/style-to-object/-/style-to-object-1.0.8.tgz#67a29bca47eaa587db18118d68f9d95955e81292" + integrity sha512-xT47I/Eo0rwJmaXC4oilDGDWLohVhR6o/xAQcPQN8q6QBuZVL8qMYL85kLmST5cPjAorwvqIA4qXTRQoYHaL6g== dependencies: - inline-style-parser "0.2.3" + inline-style-parser "0.2.4" styled-components@^6.1.11: version "6.1.11" @@ -11599,22 +11022,15 @@ stylis@4.2.0: resolved "https://registry.yarnpkg.com/stylis/-/stylis-4.2.0.tgz#79daee0208964c8fe695a42fcffcac633a211a51" integrity sha512-Orov6g6BB1sDfYgzWfTHDOxamtX1bE/zo104Dh9e6fqJ3PooipYyfJ0pUmrZO2wAvO8YbEyeFrkV91XTsGMSrw== -stylis@4.3.2, stylis@^4.1.3: +stylis@4.3.2: version "4.3.2" resolved "https://registry.yarnpkg.com/stylis/-/stylis-4.3.2.tgz#8f76b70777dd53eb669c6f58c997bf0a9972e444" integrity sha512-bhtUjWd/z6ltJiQwg0dUfxEJ+W+jdqQd8TbWLWyeIJHlnsqmGLRFFd8e5mA0AZi/zx90smXRlN66YMTcaSFifg== stylis@^4.3.1: - version "4.3.4" - resolved "https://registry.yarnpkg.com/stylis/-/stylis-4.3.4.tgz#ca5c6c4a35c4784e4e93a2a24dc4e9fa075250a4" - integrity sha512-osIBl6BGUmSfDkyH2mB7EFvCJntXDrLhKjHTRj/rK6xLH0yuPrHULDRQzKokSOD4VoorhtKpfcfW1GAntu8now== - -supports-color@^5.3.0: - version "5.5.0" - resolved "https://registry.yarnpkg.com/supports-color/-/supports-color-5.5.0.tgz#e2e69a44ac8772f78a1ec0b35b689df6530efc8f" - integrity sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow== - dependencies: - has-flag "^3.0.0" + version "4.3.5" + resolved "https://registry.yarnpkg.com/stylis/-/stylis-4.3.5.tgz#432cc99c81e28d7062c88d979d2163891e860489" + integrity sha512-K7npNOKGRYuhAFFzkzMGfxFDpN6gDwf8hcMiE+uveTVbBgm93HrNP3ZDUpKqzZ4pG7TP6fmb+EMAQPjq9FqqvA== supports-color@^7.1.0: version "7.2.0" @@ -11680,48 +11096,54 @@ tapable@^2.0.0, tapable@^2.1.1, tapable@^2.2.0, tapable@^2.2.1: resolved "https://registry.yarnpkg.com/tapable/-/tapable-2.2.1.tgz#1967a73ef4060a82f12ab96af86d52fdb76eeca0" integrity sha512-GNzQvQTOIP6RyTfE2Qxb8ZVlNmw0n88vp1szwWRimP02mnTsx3Wtn5qRdqY9w2XduFNUgvOwhNnQsjwCp+kqaQ== -tar-fs@2.1.1: - version "2.1.1" - resolved "https://registry.yarnpkg.com/tar-fs/-/tar-fs-2.1.1.tgz#489a15ab85f1f0befabb370b7de4f9eb5cbe8784" - integrity sha512-V0r2Y9scmbDRLCNex/+hYzvp/zyYjvFbHPNgVTKfQvVrb6guiE/fxP+XblDNR011utopbkex2nM4dHNV6GDsng== +tar-fs@^3.0.6: + version "3.0.8" + resolved "https://registry.yarnpkg.com/tar-fs/-/tar-fs-3.0.8.tgz#8f62012537d5ff89252d01e48690dc4ebed33ab7" + integrity sha512-ZoROL70jptorGAlgAYiLoBLItEKw/fUxg9BSYK/dF/GAGYFJOJJJMvjPAKDJraCXFwadD456FCuvLWgfhMsPwg== dependencies: - chownr "^1.1.1" - mkdirp-classic "^0.5.2" pump "^3.0.0" - tar-stream "^2.1.4" + tar-stream "^3.1.5" + optionalDependencies: + bare-fs "^4.0.1" + bare-path "^3.0.0" -tar-stream@^2.1.4: - version "2.2.0" - resolved "https://registry.yarnpkg.com/tar-stream/-/tar-stream-2.2.0.tgz#acad84c284136b060dc3faa64474aa9aebd77287" - integrity sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ== +tar-stream@^3.1.5: + version "3.1.7" + resolved "https://registry.yarnpkg.com/tar-stream/-/tar-stream-3.1.7.tgz#24b3fb5eabada19fe7338ed6d26e5f7c482e792b" + integrity sha512-qJj60CXt7IU1Ffyc3NJMjh6EkuCFej46zUqJ4J7pqYlThyd9bO0XBTmcOIhSzZJVWfsLks0+nle/j538YAW9RQ== dependencies: - bl "^4.0.3" - end-of-stream "^1.4.1" - fs-constants "^1.0.0" - inherits "^2.0.3" - readable-stream "^3.1.1" + b4a "^1.6.4" + fast-fifo "^1.2.0" + streamx "^2.15.0" terser-webpack-plugin@^5.3.10, terser-webpack-plugin@^5.3.9: - version "5.3.10" - resolved "https://registry.yarnpkg.com/terser-webpack-plugin/-/terser-webpack-plugin-5.3.10.tgz#904f4c9193c6fd2a03f693a2150c62a92f40d199" - integrity sha512-BKFPWlPDndPs+NGGCr1U59t0XScL5317Y0UReNrHaw9/FwhPENlq6bfgs+4yPfyP51vqC1bQ4rp1EfXW5ZSH9w== + version "5.3.11" + resolved "https://registry.yarnpkg.com/terser-webpack-plugin/-/terser-webpack-plugin-5.3.11.tgz#93c21f44ca86634257cac176f884f942b7ba3832" + integrity sha512-RVCsMfuD0+cTt3EwX8hSl2Ks56EbFHWmhluwcqoPKtBnfjiT6olaq7PRIRfhyU8nnC2MrnDrBLfrD/RGE+cVXQ== dependencies: - "@jridgewell/trace-mapping" "^0.3.20" + "@jridgewell/trace-mapping" "^0.3.25" jest-worker "^27.4.5" - schema-utils "^3.1.1" - serialize-javascript "^6.0.1" - terser "^5.26.0" + schema-utils "^4.3.0" + serialize-javascript "^6.0.2" + terser "^5.31.1" -terser@^5.10.0, terser@^5.15.1, terser@^5.26.0: - version "5.31.2" - resolved "https://registry.yarnpkg.com/terser/-/terser-5.31.2.tgz#b5ca188107b706084dca82f988089fa6102eba11" - integrity sha512-LGyRZVFm/QElZHy/CPr/O4eNZOZIzsrQ92y4v9UJe/pFJjypje2yI3C2FmPtvUEnhadlSbmG2nXtdcjHOjCfxw== +terser@^5.10.0, terser@^5.15.1, terser@^5.31.1: + version "5.37.0" + resolved "https://registry.yarnpkg.com/terser/-/terser-5.37.0.tgz#38aa66d1cfc43d0638fab54e43ff8a4f72a21ba3" + integrity sha512-B8wRRkmre4ERucLM/uXx4MOV5cbnOlVAqUst+1+iLKPI0dOgFO28f84ptoQt9HEI537PMzfYa/d+GEPKTRXmYA== dependencies: "@jridgewell/source-map" "^0.3.3" acorn "^8.8.2" commander "^2.20.0" source-map-support "~0.5.20" +text-decoder@^1.1.0: + version "1.2.3" + resolved "https://registry.yarnpkg.com/text-decoder/-/text-decoder-1.2.3.tgz#b19da364d981b2326d5f43099c310cc80d770c65" + integrity sha512-3/o9z3X0X0fTupwsYvR03pJ/DjWuqqrfwBgTQzdWDiQSm9KitAyz/9WqsT2JQW7KV2m+bC2ol/zqpW37NHxLaA== + dependencies: + b4a "^1.6.4" + text-table@^0.2.0: version "0.2.0" resolved "https://registry.yarnpkg.com/text-table/-/text-table-0.2.0.tgz#7f5ee823ae805207c00af2df4a84ec3fcfa570b4" @@ -11748,14 +11170,9 @@ tiny-warning@^1.0.0: integrity sha512-lBN9zLN/oAf68o3zNXYrdCt1kP8WsiGW8Oo2ka41b2IM5JL/S1CTyX1rW0mb/zSuJun0ZUrDxx4sqvYS2FWzPA== tinyexec@^0.3.0: - version "0.3.1" - resolved "https://registry.yarnpkg.com/tinyexec/-/tinyexec-0.3.1.tgz#0ab0daf93b43e2c211212396bdb836b468c97c98" - integrity sha512-WiCJLEECkO18gwqIp6+hJg0//p23HXp4S+gGtAKu3mI2F2/sXC4FvHvXvB0zJVVaTPhx1/tOwdbRsa1sOBIKqQ== - -to-fast-properties@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/to-fast-properties/-/to-fast-properties-2.0.0.tgz#dc5e698cbd079265bc73e0377681a4e4e83f616e" - integrity sha512-/OaKK0xYrs3DmxRYqL/yDc+FxFUVYhDlXMhRmv3z915w2HF1tnN1omB354j8VUGO/hbRzyD6Y3sA7v7GS/ceog== + version "0.3.2" + resolved "https://registry.yarnpkg.com/tinyexec/-/tinyexec-0.3.2.tgz#941794e657a85e496577995c6eef66f53f42b3d2" + integrity sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA== to-querystring@^1.0.4: version "1.2.0" @@ -11804,10 +11221,10 @@ tslib@2.6.2: resolved "https://registry.yarnpkg.com/tslib/-/tslib-2.6.2.tgz#703ac29425e7b37cd6fd456e92404d46d1f3e4ae" integrity sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q== -tslib@^2.0.3, tslib@^2.6.0: - version "2.6.3" - resolved "https://registry.yarnpkg.com/tslib/-/tslib-2.6.3.tgz#0438f810ad7a9edcde7a241c3d80db693c8cbfe0" - integrity sha512-xNvxJEOUiWPGhUuUdQgAJPKOOJfGnIyKySOc09XkKsgdUV/3E2zvwZYdejjmRgPCgcym1juLH3226yA7sEFJKQ== +tslib@^2.0.1, tslib@^2.0.3, tslib@^2.6.0: + version "2.8.1" + resolved "https://registry.yarnpkg.com/tslib/-/tslib-2.8.1.tgz#612efe4ed235d567e8aba5f2a5fab70280ade83f" + integrity sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w== type-fest@^0.21.3: version "0.21.3" @@ -11832,50 +11249,6 @@ type-is@~1.6.18: media-typer "0.3.0" mime-types "~2.1.24" -typed-array-buffer@^1.0.2: - version "1.0.2" - resolved "https://registry.yarnpkg.com/typed-array-buffer/-/typed-array-buffer-1.0.2.tgz#1867c5d83b20fcb5ccf32649e5e2fc7424474ff3" - integrity sha512-gEymJYKZtKXzzBzM4jqa9w6Q1Jjm7x2d+sh19AdsD4wqnMPDYyvwpsIc2Q/835kHuo3BEQ7CjelGhfTsoBb2MQ== - dependencies: - call-bind "^1.0.7" - es-errors "^1.3.0" - is-typed-array "^1.1.13" - -typed-array-byte-length@^1.0.1: - version "1.0.1" - resolved "https://registry.yarnpkg.com/typed-array-byte-length/-/typed-array-byte-length-1.0.1.tgz#d92972d3cff99a3fa2e765a28fcdc0f1d89dec67" - integrity sha512-3iMJ9q0ao7WE9tWcaYKIptkNBuOIcZCCT0d4MRvuuH88fEoEH62IuQe0OtraD3ebQEoTRk8XCBoknUNc1Y67pw== - dependencies: - call-bind "^1.0.7" - for-each "^0.3.3" - gopd "^1.0.1" - has-proto "^1.0.3" - is-typed-array "^1.1.13" - -typed-array-byte-offset@^1.0.2: - version "1.0.2" - resolved "https://registry.yarnpkg.com/typed-array-byte-offset/-/typed-array-byte-offset-1.0.2.tgz#f9ec1acb9259f395093e4567eb3c28a580d02063" - integrity sha512-Ous0vodHa56FviZucS2E63zkgtgrACj7omjwd/8lTEMEPFFyjfixMZ1ZXenpgCFBBt4EC1J2XsyVS2gkG0eTFA== - dependencies: - available-typed-arrays "^1.0.7" - call-bind "^1.0.7" - for-each "^0.3.3" - gopd "^1.0.1" - has-proto "^1.0.3" - is-typed-array "^1.1.13" - -typed-array-length@^1.0.6: - version "1.0.6" - resolved "https://registry.yarnpkg.com/typed-array-length/-/typed-array-length-1.0.6.tgz#57155207c76e64a3457482dfdc1c9d1d3c4c73a3" - integrity sha512-/OxDN6OtAk5KBpGb28T+HZc2M+ADtvRxXrKKbUwtsLgdoxgX13hyy7ek6bFRl5+aBs2yZzB0c4CnQfAtVypW/g== - dependencies: - call-bind "^1.0.7" - for-each "^0.3.3" - gopd "^1.0.1" - has-proto "^1.0.3" - is-typed-array "^1.1.13" - possible-typed-array-names "^1.0.0" - typedarray-to-buffer@^3.1.5: version "3.1.5" resolved "https://registry.yarnpkg.com/typedarray-to-buffer/-/typedarray-to-buffer-3.1.5.tgz#a97ee7a9ff42691b9f783ff1bc5112fe3fca9080" @@ -11888,17 +11261,7 @@ ufo@^1.5.4: resolved "https://registry.yarnpkg.com/ufo/-/ufo-1.5.4.tgz#16d6949674ca0c9e0fbbae1fa20a71d7b1ded754" integrity sha512-UsUk3byDzKd04EyoZ7U4DOlxQaD14JUKQl6/P7wiX4FNvUfm3XL246n9W5AmqwW5RSFJ27NAuM0iLscAOYUiGQ== -unbox-primitive@^1.0.2: - version "1.0.2" - resolved "https://registry.yarnpkg.com/unbox-primitive/-/unbox-primitive-1.0.2.tgz#29032021057d5e6cdbd08c5129c226dff8ed6f9e" - integrity sha512-61pPlCD9h51VoreyJ0BReideM3MDKMKnh6+V9L08331ipq6Q8OFXZYiqP6n/tbHx4s5I9uRhcye6BrbkizkBDw== - dependencies: - call-bind "^1.0.2" - has-bigints "^1.0.2" - has-symbols "^1.0.3" - which-boxed-primitive "^1.0.2" - -unbzip2-stream@1.4.3: +unbzip2-stream@^1.4.3: version "1.4.3" resolved "https://registry.yarnpkg.com/unbzip2-stream/-/unbzip2-stream-1.4.3.tgz#b0da04c4371311df771cdc215e87f2130991ace7" integrity sha512-mlExGW4w71ebDJviH16lQLtZS32VKqsSfk80GCfUlwT/4/hNRFsoscrF/c++9xinkMzECL1uL9DDwXqFWkruPg== @@ -11906,15 +11269,15 @@ unbzip2-stream@1.4.3: buffer "^5.2.1" through "^2.3.8" -undici-types@~5.26.4: - version "5.26.5" - resolved "https://registry.yarnpkg.com/undici-types/-/undici-types-5.26.5.tgz#bcd539893d00b56e964fd2657a4866b221a65617" - integrity sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA== +undici-types@~6.20.0: + version "6.20.0" + resolved "https://registry.yarnpkg.com/undici-types/-/undici-types-6.20.0.tgz#8171bf22c1f588d1554d55bf204bc624af388433" + integrity sha512-Ny6QZ2Nju20vw1SRHe3d9jVu6gJ+4e3+MMpqu7pqE5HT6WsTSlce++GQmK5UXS8mzV8DSYHrQH+Xrf2jVcuKNg== unicode-canonical-property-names-ecmascript@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/unicode-canonical-property-names-ecmascript/-/unicode-canonical-property-names-ecmascript-2.0.0.tgz#301acdc525631670d39f6146e0e77ff6bbdebddc" - integrity sha512-yY5PpDlfVIU5+y/BSCxAJRBIS1Zc2dDG3Ujq+sR0U+JjUevW2JhocOF+soROYDSaAezOzOKuyyixhD6mBknSmQ== + version "2.0.1" + resolved "https://registry.yarnpkg.com/unicode-canonical-property-names-ecmascript/-/unicode-canonical-property-names-ecmascript-2.0.1.tgz#cb3173fe47ca743e228216e4a3ddc4c84d628cc2" + integrity sha512-dA8WbNeb2a6oQzAQ55YlT5vQAWGV9WXOsi3SskE3bcCdM0P4SDd+24zS/OCacdRq5BkdsRj9q3Pg6YyQoxIGqg== unicode-emoji-modifier-base@^1.0.0: version "1.0.0" @@ -11930,9 +11293,9 @@ unicode-match-property-ecmascript@^2.0.0: unicode-property-aliases-ecmascript "^2.0.0" unicode-match-property-value-ecmascript@^2.1.0: - version "2.1.0" - resolved "https://registry.yarnpkg.com/unicode-match-property-value-ecmascript/-/unicode-match-property-value-ecmascript-2.1.0.tgz#cb5fffdcd16a05124f5a4b0bf7c3770208acbbe0" - integrity sha512-qxkjQt6qjg/mYscYMC0XKRn3Rh0wFPlfxB0xkt9CfyTvpX1Ra0+rAmdX2QyAobptSEvuy4RtpPRui6XkV+8wjA== + version "2.2.0" + resolved "https://registry.yarnpkg.com/unicode-match-property-value-ecmascript/-/unicode-match-property-value-ecmascript-2.2.0.tgz#a0401aee72714598f739b68b104e4fe3a0cb3c71" + integrity sha512-4IehN3V/+kkr5YeSSDDQG8QLqO26XpL2XP3GQtqwlT/QYSECAwFztxVHjlbh0+gjJ3XmNLS0zDsbgs9jWKExLg== unicode-property-aliases-ecmascript@^2.0.0: version "2.1.0" @@ -12009,14 +11372,6 @@ unist-util-remove-position@^4.0.0: "@types/unist" "^2.0.0" unist-util-visit "^4.0.0" -unist-util-remove-position@^5.0.0: - version "5.0.0" - resolved "https://registry.yarnpkg.com/unist-util-remove-position/-/unist-util-remove-position-5.0.0.tgz#fea68a25658409c9460408bc6b4991b965b52163" - integrity sha512-Hp5Kh3wLxv0PHj9m2yZhhLt58KzPtEYKQQ4yxfYFEO7EvHwzyDYnduhHnY1mDxoqr7VUwVuHXk9RXKIiYS1N8Q== - dependencies: - "@types/unist" "^3.0.0" - unist-util-visit "^5.0.0" - unist-util-stringify-position@^3.0.0: version "3.0.3" resolved "https://registry.yarnpkg.com/unist-util-stringify-position/-/unist-util-stringify-position-3.0.3.tgz#03ad3348210c2d930772d64b489580c13a7db39d" @@ -12075,21 +11430,13 @@ unpipe@1.0.0, unpipe@~1.0.0: resolved "https://registry.yarnpkg.com/unpipe/-/unpipe-1.0.0.tgz#b2bf4ee8514aae6165b4817829d21b2ef49904ec" integrity sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ== -update-browserslist-db@^1.1.0: - version "1.1.0" - resolved "https://registry.yarnpkg.com/update-browserslist-db/-/update-browserslist-db-1.1.0.tgz#7ca61c0d8650766090728046e416a8cde682859e" - integrity sha512-EdRAaAyk2cUE1wOf2DkEhzxqOQvFOoRJFNS6NeyJ01Gp2beMRpBAINjM2iDXE3KCuKhwnvHIQCJm6ThL2Z+HzQ== - dependencies: - escalade "^3.1.2" - picocolors "^1.0.1" - update-browserslist-db@^1.1.1: - version "1.1.1" - resolved "https://registry.yarnpkg.com/update-browserslist-db/-/update-browserslist-db-1.1.1.tgz#80846fba1d79e82547fb661f8d141e0945755fe5" - integrity sha512-R8UzCaa9Az+38REPiJ1tXlImTJXlVfgHZsglwBD/k6nj76ctsH1E3q4doGrukiLQd3sGQYu56r5+lo5r94l29A== + version "1.1.2" + resolved "https://registry.yarnpkg.com/update-browserslist-db/-/update-browserslist-db-1.1.2.tgz#97e9c96ab0ae7bcac08e9ae5151d26e6bc6b5580" + integrity sha512-PPypAm5qvlD7XMZC3BujecnaOxwhrtoFR+Dqkk5Aa/6DssiH0ibKoketaj9w8LP7Bont1rYeoV5plxD7RTEPRg== dependencies: escalade "^3.2.0" - picocolors "^1.1.0" + picocolors "^1.1.1" update-notifier@^6.0.2: version "6.0.2" @@ -12111,7 +11458,12 @@ update-notifier@^6.0.2: semver-diff "^4.0.0" xdg-basedir "^5.1.0" -uri-js@^4.2.2, uri-js@^4.4.1: +uri-js-replace@^1.0.1: + version "1.0.1" + resolved "https://registry.yarnpkg.com/uri-js-replace/-/uri-js-replace-1.0.1.tgz#c285bb352b701c9dfdaeffc4da5be77f936c9048" + integrity sha512-W+C9NWNLFOoBI2QWDp4UT9pv65r2w5Cx+3sTYFvtMdDBxkKt1syCqsUdSFAChbEe1uK5TfS04wt/nGwmaeIQ0g== + +uri-js@^4.2.2: version "4.4.1" resolved "https://registry.yarnpkg.com/uri-js/-/uri-js-4.4.1.tgz#9b1a52595225859e55f669d928f88c6c57f2a77e" integrity sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg== @@ -12132,10 +11484,15 @@ url-template@^2.0.8: resolved "https://registry.yarnpkg.com/url-template/-/url-template-2.0.8.tgz#fc565a3cccbff7730c775f5641f9555791439f21" integrity sha512-XdVKMF4SJ0nP/O7XIPB0JwAEuT9lDIYnNsK8yGVe43y0AWoKeJNdv3ZNWh7ksJ6KqQFjOO6ox/VEitLnaVNufw== -use-sync-external-store@^1.2.0: - version "1.2.2" - resolved "https://registry.yarnpkg.com/use-sync-external-store/-/use-sync-external-store-1.2.2.tgz#c3b6390f3a30eba13200d2302dcdf1e7b57b2ef9" - integrity sha512-PElTlVMwpblvbNqQ82d2n6RjStvdSoNe9FG28kNfz3WiXilJm4DdNkEzRhCZuIDwY8U08WVihhGR5iRqAwfDiw== +urlpattern-polyfill@10.0.0: + version "10.0.0" + resolved "https://registry.yarnpkg.com/urlpattern-polyfill/-/urlpattern-polyfill-10.0.0.tgz#f0a03a97bfb03cdf33553e5e79a2aadd22cac8ec" + integrity sha512-H/A06tKD7sS1O1X2SshBVeA5FLycRpjqiBeqGKmBwBDBy28EnRjORxTNe269KSSr5un5qyWi1iL61wLxpd+ZOg== + +use-sync-external-store@^1.4.0: + version "1.4.0" + resolved "https://registry.yarnpkg.com/use-sync-external-store/-/use-sync-external-store-1.4.0.tgz#adbc795d8eeb47029963016cefdf89dc799fcebc" + integrity sha512-9WXSPC5fMv61vaupRkCKCxsPxBocVnwakBEkMIHHpkTTg6icbJtg6jzgtLDm4bl3cSHAca52rYWih0k4K3PfHw== util-deprecate@^1.0.1, util-deprecate@^1.0.2, util-deprecate@~1.0.1: version "1.0.2" @@ -12162,7 +11519,7 @@ uuid@^8.3.2: resolved "https://registry.yarnpkg.com/uuid/-/uuid-8.3.2.tgz#80d5b5ced271bb9af6c445f21a1a04c606cefbe2" integrity sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg== -uuid@^9.0.0, uuid@^9.0.1: +uuid@^9.0.1: version "9.0.1" resolved "https://registry.yarnpkg.com/uuid/-/uuid-9.0.1.tgz#e188d4c8853cc722220392c424cd637f32293f30" integrity sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA== @@ -12196,9 +11553,9 @@ vfile-location@^4.0.0: vfile "^5.0.0" vfile-location@^5.0.0: - version "5.0.2" - resolved "https://registry.yarnpkg.com/vfile-location/-/vfile-location-5.0.2.tgz#220d9ca1ab6f8b2504a4db398f7ebc149f9cb464" - integrity sha512-NXPYyxyBSH7zB5U6+3uDdd6Nybz6o6/od9rk8bp9H8GR3L+cm/fC0uUTbqBmUTnMCUDslAGBOIKNfvvb+gGlDg== + version "5.0.3" + resolved "https://registry.yarnpkg.com/vfile-location/-/vfile-location-5.0.3.tgz#cb9eacd20f2b6426d19451e0eafa3d0a846225c3" + integrity sha512-5yXvWDEgqeiYiBe1lbxYF7UMAIm/IcopxMHrMQDq3nvKcjPKIhZklUKL+AE7J7uApI4kwe2snsK+eI6UTj9EHg== dependencies: "@types/unist" "^3.0.0" vfile "^6.0.0" @@ -12230,12 +11587,11 @@ vfile@^5.0.0: vfile-message "^3.0.0" vfile@^6.0.0, vfile@^6.0.1: - version "6.0.1" - resolved "https://registry.yarnpkg.com/vfile/-/vfile-6.0.1.tgz#1e8327f41eac91947d4fe9d237a2dd9209762536" - integrity sha512-1bYqc7pt6NIADBJ98UiG0Bn/CHIVOoZ/IyEkqIruLg0mE1BKzkOXY2D6CSqQIcKqgadppE5lrxgWXJmXd7zZJw== + version "6.0.3" + resolved "https://registry.yarnpkg.com/vfile/-/vfile-6.0.3.tgz#3652ab1c496531852bf55a6bac57af981ebc38ab" + integrity sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q== dependencies: "@types/unist" "^3.0.0" - unist-util-stringify-position "^4.0.0" vfile-message "^4.0.0" vscode-jsonrpc@8.2.0: @@ -12274,9 +11630,9 @@ vscode-uri@~3.0.8: integrity sha512-AyFQ0EVmsOZOlAnxoFOGOq1SQDWAB7C6aqMGS23svWAllfOaxbuFvcT8D1i8z3Gyn8fraVeZNNmN6e9bxxXkKw== watchpack@^2.4.1: - version "2.4.1" - resolved "https://registry.yarnpkg.com/watchpack/-/watchpack-2.4.1.tgz#29308f2cac150fa8e4c92f90e0ec954a9fed7fff" - integrity sha512-8wrBCMtVhqcXP2Sup1ctSkga6uc2Bx0IIvKyT7yTFier5AXHooSI+QyQQAtTb7+E0IUCCKyTFmXqdqgum2XWGg== + version "2.4.2" + resolved "https://registry.yarnpkg.com/watchpack/-/watchpack-2.4.2.tgz#2feeaed67412e7c33184e5a79ca738fbd38564da" + integrity sha512-TnbFSbcOCcDgjZ4piURLCbJ3nJhznVh9kw6F6iokjiFPl8ONxe9A6nMDVXDiNbrSfLILs6vB07F7wLBrwPYzJw== dependencies: glob-to-regexp "^0.4.1" graceful-fs "^4.1.2" @@ -12293,11 +11649,6 @@ web-namespaces@^2.0.0: resolved "https://registry.yarnpkg.com/web-namespaces/-/web-namespaces-2.0.1.tgz#1010ff7c650eccb2592cebeeaf9a1b253fd40692" integrity sha512-bKr1DkiNa2krS7qxNtdrtHAmzuYGFQLiQ13TsorsdT6ULTkPLKuu5+GsFpDlg6JFjUTwX2DyhMPG2be8uPrqsQ== -web-worker@^1.2.0: - version "1.3.0" - resolved "https://registry.yarnpkg.com/web-worker/-/web-worker-1.3.0.tgz#e5f2df5c7fe356755a5fb8f8410d4312627e6776" - integrity sha512-BSR9wyRsy/KOValMgd5kMyr3JzpdeoR9KVId8u5GVlTTAtNChlsE4yTxeY7zMdNSyOmoKBv8NH2qeRY9Tg+IaA== - webidl-conversions@^3.0.0: version "3.0.1" resolved "https://registry.yarnpkg.com/webidl-conversions/-/webidl-conversions-3.0.1.tgz#24534275e2a7bc6be7bc86611cc16ae0a5654871" @@ -12391,45 +11742,16 @@ webpack-sources@^3.2.3: resolved "https://registry.yarnpkg.com/webpack-sources/-/webpack-sources-3.2.3.tgz#2d4daab8451fd4b240cc27055ff6a0c2ccea0cde" integrity sha512-/DyMEOrDgLKKIG0fmvtz+4dUX/3Ghozwgm6iPp8KRhvn+eQf9+Q7GWxVNMk3+uCPWfdXYC4ExGBckIXdFEfH1w== -webpack@^5.88.1: - version "5.94.0" - resolved "https://registry.yarnpkg.com/webpack/-/webpack-5.94.0.tgz#77a6089c716e7ab90c1c67574a28da518a20970f" - integrity sha512-KcsGn50VT+06JH/iunZJedYGUJS5FGjow8wb9c0v5n1Om8O1g4L6LjtfxwlXIATopoQu+vOXXa7gYisWxCoPyg== - dependencies: - "@types/estree" "^1.0.5" - "@webassemblyjs/ast" "^1.12.1" - "@webassemblyjs/wasm-edit" "^1.12.1" - "@webassemblyjs/wasm-parser" "^1.12.1" - acorn "^8.7.1" - acorn-import-attributes "^1.9.5" - browserslist "^4.21.10" - chrome-trace-event "^1.0.2" - enhanced-resolve "^5.17.1" - es-module-lexer "^1.2.1" - eslint-scope "5.1.1" - events "^3.2.0" - glob-to-regexp "^0.4.1" - graceful-fs "^4.2.11" - json-parse-even-better-errors "^2.3.1" - loader-runner "^4.2.0" - mime-types "^2.1.27" - neo-async "^2.6.2" - schema-utils "^3.2.0" - tapable "^2.1.1" - terser-webpack-plugin "^5.3.10" - watchpack "^2.4.1" - webpack-sources "^3.2.3" - -webpack@^5.95.0: - version "5.96.1" - resolved "https://registry.yarnpkg.com/webpack/-/webpack-5.96.1.tgz#3676d1626d8312b6b10d0c18cc049fba7ac01f0c" - integrity sha512-l2LlBSvVZGhL4ZrPwyr8+37AunkcYj5qh8o6u2/2rzoPc8gxFJkLj1WxNgooi9pnoc06jh0BjuXnamM4qlujZA== +webpack@^5.88.1, webpack@^5.95.0: + version "5.97.1" + resolved "https://registry.yarnpkg.com/webpack/-/webpack-5.97.1.tgz#972a8320a438b56ff0f1d94ade9e82eac155fa58" + integrity sha512-EksG6gFY3L1eFMROS/7Wzgrii5mBAFe4rIr3r2BTfo7bcc+DWwFZ4OJ/miOuHJO/A85HwyI4eQ0F6IKXesO7Fg== dependencies: "@types/eslint-scope" "^3.7.7" "@types/estree" "^1.0.6" - "@webassemblyjs/ast" "^1.12.1" - "@webassemblyjs/wasm-edit" "^1.12.1" - "@webassemblyjs/wasm-parser" "^1.12.1" + "@webassemblyjs/ast" "^1.14.1" + "@webassemblyjs/wasm-edit" "^1.14.1" + "@webassemblyjs/wasm-parser" "^1.14.1" acorn "^8.14.0" browserslist "^4.24.0" chrome-trace-event "^1.0.2" @@ -12485,28 +11807,6 @@ whatwg-url@^5.0.0: tr46 "~0.0.3" webidl-conversions "^3.0.0" -which-boxed-primitive@^1.0.2: - version "1.0.2" - resolved "https://registry.yarnpkg.com/which-boxed-primitive/-/which-boxed-primitive-1.0.2.tgz#13757bc89b209b049fe5d86430e21cf40a89a8e6" - integrity sha512-bwZdv0AKLpplFY2KZRX6TvyuN7ojjr7lwkg6ml0roIy9YeuSr7JS372qlNW18UQYzgYK9ziGcerWqZOmEn9VNg== - dependencies: - is-bigint "^1.0.1" - is-boolean-object "^1.1.0" - is-number-object "^1.0.4" - is-string "^1.0.5" - is-symbol "^1.0.3" - -which-typed-array@^1.1.14, which-typed-array@^1.1.15: - version "1.1.15" - resolved "https://registry.yarnpkg.com/which-typed-array/-/which-typed-array-1.1.15.tgz#264859e9b11a649b388bfaaf4f767df1f779b38d" - integrity sha512-oV0jmFtUky6CXfkqehVvBP/LSWJ2sy4vWMioiENyJLePrBO/yKyV9OyJySfAKosh+RYkIl5zJCNZ8/4JncrpdA== - dependencies: - available-typed-arrays "^1.0.7" - call-bind "^1.0.7" - for-each "^0.3.3" - gopd "^1.0.1" - has-tostringtag "^1.0.2" - which@^1.3.1: version "1.3.1" resolved "https://registry.yarnpkg.com/which/-/which-1.3.1.tgz#a45043d54f5805316da8d62f9f50918d3da70b0a" @@ -12566,17 +11866,12 @@ write-file-atomic@^3.0.3: signal-exit "^3.0.2" typedarray-to-buffer "^3.1.5" -ws@8.9.0: - version "8.9.0" - resolved "https://registry.yarnpkg.com/ws/-/ws-8.9.0.tgz#2a994bb67144be1b53fe2d23c53c028adeb7f45e" - integrity sha512-Ja7nszREasGaYUYCI2k4lCKIRTt+y7XuqVoHR44YpI49TtryyqbqvDMn5eqfW7e6HzTukDRIsXqzVHScqRcafg== - ws@^7.3.1: version "7.5.10" resolved "https://registry.yarnpkg.com/ws/-/ws-7.5.10.tgz#58b5c20dc281633f6c19113f39b349bd8bd558d9" integrity sha512-+dbF1tHwZpXcbOJdVOkzLDxZP1ailvSxM6ZweXTegylPny803bFhA+vqBYw4s31NSAk4S2Qz+AKXK9a4wkdjcQ== -ws@^8.13.0: +ws@^8.13.0, ws@^8.18.0: version "8.18.0" resolved "https://registry.yarnpkg.com/ws/-/ws-8.18.0.tgz#0d7505a6eafe2b0e712d232b42279f53bc289bbc" integrity sha512-8VbfWfHLbbwu3+N6OKsOMpBdT4kXPDDB9cJk2bJ6mh9ucxdlnNvH1e+roYkKmN9Nxw2yjz7VzeO9oOz2zJ04Pw== @@ -12618,7 +11913,7 @@ yargs-parser@^21.1.1: resolved "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-21.1.1.tgz#9096bceebf990d21bb31fa9516e0ede294a77d35" integrity sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw== -yargs@^17.0.1: +yargs@^17.0.1, yargs@^17.7.2: version "17.7.2" resolved "https://registry.yarnpkg.com/yargs/-/yargs-17.7.2.tgz#991df39aca675a192b816e1e0363f9d75d2aa269" integrity sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w== @@ -12649,6 +11944,11 @@ yocto-queue@^1.0.0: resolved "https://registry.yarnpkg.com/yocto-queue/-/yocto-queue-1.1.1.tgz#fef65ce3ac9f8a32ceac5a634f74e17e5b232110" integrity sha512-b4JR1PFR10y1mKjhHY9LaGo6tmrgjit7hxVIeAmyMw3jegXR4dhYqLaQF5zMXZxY7tLpMyJeLjr1C4rLmkVe8g== +zod@3.23.8: + version "3.23.8" + resolved "https://registry.yarnpkg.com/zod/-/zod-3.23.8.tgz#e37b957b5d52079769fb8097099b592f0ef4067d" + integrity sha512-XBx9AXhXktjUqnepgTiE5flcKIYWi/rme0Eaj+5Y0lftuGBq+jyRu/md4WnuxqgP1ubdpNCsYEYPxrzVHD8d6g== + zwitch@^2.0.0: version "2.0.4" resolved "https://registry.yarnpkg.com/zwitch/-/zwitch-2.0.4.tgz#c827d4b0acb76fc3e685a4c6ec2902d51070e9d7"