build: update dependencies to supported versions

thomseddon / traefik-forward-auth

Minimal forward authentication service that provides Google/OpenID oauth based login and authentication for the traefik reverse proxy

MIT License

2.18k stars 412 forks source link

build: update dependencies to supported versions #369

Open clambin opened 8 months ago

clambin commented 8 months ago

I noticed that some of the underlying dependencies are quite old, and in some cases deprecated or had security issues.

Main updates in this PR:

Bump github.com/coreos/go-oidc to v3
Bump gopkg.in/square/go-jose.v2 (deprecated; security issues) to github.com/go-jose/go-jose/v4
Bump github.com/traefik/traefik/v2 to v2.11.0 (some changes in API needed)

Some minor updates:

Go 1.22.1
Bump github.com/sirupsen/logrus to v1.9.3
Bump github.com/stretchr/testify to v1.9.0
Bump golang.org/x/oauth2 to v0.18.0

j6b72 commented 7 months ago

Thank you for your work! I hope this gets merged soon...

clambin commented 6 months ago

@j6b72: thanks! it's not looking good though, is it? :)

tbh, running 3y old security components made me a bit nervous, so I wrote my own version of this: https://github.com/clambin/traefik-simple-auth. I only covered the things I need, and not looking to support a big user base. But if you want, feel free to give it a try.

toxic0berliner commented 6 months ago

I fear as you it's safer to turn to something else. I picked authelia and am happy with it if that helps others choose