v7.15.1

tremorlabs/tremorv7.15.1Mar 23, 2026by github-actions[bot]

AI Summary

A patch release squashing various bugs and addressing vulnerabilities, specifically verifying that CVE-2026-33186 does not impact the proxy execution path.

Key Highlights

Squashed bugs and addressed vulnerabilities
CVE-2026-33186 verification (not impacted)
Updated gomod and golangci-lint dependencies

New Features

Handle Unix socket RemoteAddr in IP resolution
Do not log error for backend logout 204
Improve logging when session refresh token is missing
Propagate errors during route building

Full Release Notes

## Release Highlights

- 🐛 Squashed some bugs
-  🕵️‍♀️ Vulnerabilities have been addressed
    - [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186)
      OAuth2 Proxy was not impacted by this vulnerability as it isn't in the path of execution

## Important Notes

## Breaking Changes

## Changes since v7.15.0

- [#3382](https://github.com/oauth2-proxy/oauth2-proxy/pull/3382) chore(deps): update gomod and golangci/golangci-lint to v2.11.4 (@tuunit)
- [#3374](https://github.com/oauth2-proxy/oauth2-proxy/pull/3374) fix: handle Unix socket RemoteAddr in IP resolution (@H1net)
- [#3381](https://github.com/oauth2-proxy/oauth2-proxy/pull/3381) fix: do not log error for backend logout 204 (@artificiosus)
- [#3327](https://github.com/oauth2-proxy/oauth2-proxy/pull/3327) fix: improve logging when session refresh token is missing (@yosri-brh)
- [#2767](https://github.com/oauth2-proxy/oauth2-proxy/pull/2767) fix: propagate errors during route building (@sybereal)