[dependabot]

Bumps github.com/brancz/kube-rbac-proxy from 0.22.1 to 0.23.0.

Release notes

Sourced from github.com/brancz/kube-rbac-proxy's releases.

v0.23.0

Changelog

• [FEATURE] Add --tls-curve-preferences to restrict the TLS key exchange mechanisms (curves) the server accepts; values are numeric Go tls.CurveIDs
• [ENHANCEMENT] Bump dependencies
• [ENHANCEMENT] Update Kubernetes dependencies to 1.37
• [ENHANCEMENT] Strip debug symbols from binaries, reducing their size by about 32%
• [BUGFIX] Update Go to 1.27.1 (fixes 6 reachable stdlib vulnerabilities: GO-2026-6089 net/http ReadHeaderTimeout on unencrypted HTTP/2 check, GO-2026-6090 crypto/tls post-handshake message limit, GO-2026-6091 html/template JS regexp context tracking, GO-2026-6218 net/url quadratic path resolution, GO-2026-5972 encoding/asn1 recursion depth, GO-2026-5026 IDNA Punycode validation in net/http)
• [BUGFIX] Update google.golang.org/grpc to v1.83.2 (fixes GO-2026-6348 HTTP/2 DATA frame memory exhaustion, GO-2026-6061)
• [BUGFIX] Update golang.org/x/text to v0.42.0 (fixes GO-2026-5970 infinite loop on invalid input)
• [BUGFIX] Add a 30s dial timeout to --upstream-force-h2c upstream connections (previously none); TCP keep-alive now starts after 30s instead of 15s
• [BUGFIX] Fix graceful shutdown hanging with --proxy-endpoints-port and HTTP/2 (secure-port connections never got GOAWAY); also fixes a startup panic when built with Go 1.27

Container Images

This release is available from:

• quay.io/brancz/kube-rbac-proxy:v0.23.0
• ghcr.io/kube-rbac-proxy/kube-rbac-proxy:v0.23.0

See CHANGELOG.md for details.

Changelog

Sourced from github.com/brancz/kube-rbac-proxy's changelog.

0.23.0 / 2026-09-23

• [FEATURE] Add --tls-curve-preferences to restrict the TLS key exchange mechanisms (curves) the server accepts; values are numeric Go tls.CurveIDs
• [ENHANCEMENT] Bump dependencies
• [ENHANCEMENT] Update Kubernetes dependencies to 1.37
• [ENHANCEMENT] Strip debug symbols from binaries, reducing their size by about 32%
• [BUGFIX] Update Go to 1.27.1 (fixes 6 reachable stdlib vulnerabilities: GO-2026-6089 net/http ReadHeaderTimeout on unencrypted HTTP/2 check, GO-2026-6090 crypto/tls post-handshake message limit, GO-2026-6091 html/template JS regexp context tracking, GO-2026-6218 net/url quadratic path resolution, GO-2026-5972 encoding/asn1 recursion depth, GO-2026-5026 IDNA Punycode validation in net/http)
• [BUGFIX] Update google.golang.org/grpc to v1.83.2 (fixes GO-2026-6348 HTTP/2 DATA frame memory exhaustion, GO-2026-6061)
• [BUGFIX] Update golang.org/x/text to v0.42.0 (fixes GO-2026-5970 infinite loop on invalid input)
• [BUGFIX] Add a 30s dial timeout to --upstream-force-h2c upstream connections (previously none); TCP keep-alive now starts after 30s instead of 15s
• [BUGFIX] Fix graceful shutdown hanging with --proxy-endpoints-port and HTTP/2 (secure-port connections never got GOAWAY); also fixes a startup panic when built with Go 1.27

Commits

• f39a3bc Merge pull request #460 from ibihim/rc-0.23.0
• 4be908b RELEASE.md: drop the extra v from the tag recipe
• 5502741 *: cut v0.23.0 release
• edf9236 *: bump k8s.io dependencies to v0.37.0
• ae98979 go*: update dependencies
• d42c59a Merge pull request #456 from ibihim/issue-450-http2-configure-once
• d950ce1 cmd/kube-rbac-proxy: configure proxyEndpointsSrv, not srv
• a40f0bc cmd/kube-rbac-proxy: don't share http2.Server across servers
• 63cc787 Merge pull request #452 from damdo/tls-curve-preferences
• d38a47c docs: document TLS curve preferences flag
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.27%. Comparing base (ca3bf6a) to head (c33547b).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #602   +/-   ##
=======================================
  Coverage   73.27%   73.27%           
=======================================
  Files          28       28           
  Lines        1474     1474           
=======================================
  Hits         1080     1080           
  Misses        324      324           
  Partials       70       70           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.