ci: update core to latest commit in main (#1249)

This PR updates the Pomerium Core to the latest commit in main

---------

Co-authored-by: GitHub Actions <apparitor@users.noreply.github.com>
Co-authored-by: Caleb Doxsey <caleb@doxsey.net>

Author: apparitor

apis/ingress/v1/pomerium_types.go

@@ -154,14 +154,6 @@ type Authenticate struct {
 	// +kubebuilder:validation:Format=uri
 	// +kubebuilder:validation:Pattern=`^https://`
 	URL string `json:"url"`
-	// CallbackPath sets the path at which the authenticate service receives callback responses
-	// from your identity provider. The value must exactly match one of the authorized redirect URIs for the OAuth 2.0 client.
-	//
-	// <p>This value is referred to as the redirect_url in the OpenIDConnect and OAuth2 specs.</p>
-	// <p>Defaults to <code>/oauth2/callback</code></p>
-	//
-	// +optional
-	CallbackPath *string `json:"callbackPath,omitempty"`
 }
 
 // Cookie customizes HTTP cookie set by Pomerium.

apis/ingress/v1/zz_generated.deepcopy.go

@@ -52,14 +52,6 @@ spec:
                   Authenticate sets authenticate service parameters.
                   If not specified, a Pomerium-hosted authenticate service would be used.
                 properties:
-                  callbackPath:
-                    description: |-
-                      CallbackPath sets the path at which the authenticate service receives callback responses
-                      from your identity provider. The value must exactly match one of the authorized redirect URIs for the OAuth 2.0 client.
-
-                      <p>This value is referred to as the redirect_url in the OpenIDConnect and OAuth2 specs.</p>
-                      <p>Defaults to <code>/oauth2/callback</code></p>
-                    type: string
                   url:
                     description: "AuthenticateURL is a dedicated domain URL\nthe non-authenticated
                       persons would be referred to.\n\n<p><ul>\n <li>You do not need

config/crd/bases/ingress.pomerium.io_pomerium.yaml

@@ -194,14 +194,6 @@ spec:
                   Authenticate sets authenticate service parameters.
                   If not specified, a Pomerium-hosted authenticate service would be used.
                 properties:
-                  callbackPath:
-                    description: |-
-                      CallbackPath sets the path at which the authenticate service receives callback responses
-                      from your identity provider. The value must exactly match one of the authorized redirect URIs for the OAuth 2.0 client.
-
-                      <p>This value is referred to as the redirect_url in the OpenIDConnect and OAuth2 specs.</p>
-                      <p>Defaults to <code>/oauth2/callback</code></p>
-                    type: string
                   url:
                     description: "AuthenticateURL is a dedicated domain URL\nthe non-authenticated
                       persons would be referred to.\n\n<p><ul>\n <li>You do not need

deployment.yaml

@@ -16,7 +16,7 @@ require (
 	github.com/iancoleman/strcase v0.3.0
 	github.com/martinlindhe/base36 v1.1.1
 	github.com/open-policy-agent/opa v1.9.0
-	github.com/pomerium/pomerium v0.28.1-0.20251007155422-042219ff894b
+	github.com/pomerium/pomerium v0.28.1-0.20251010012545-df8c257314b1
 	github.com/rs/zerolog v1.34.0
 	github.com/sergi/go-diff v1.4.0
 	github.com/spf13/cobra v1.10.1

go.mod

@@ -693,8 +693,8 @@ github.com/pomerium/datasource v0.18.2-0.20221108160055-c6134b5ed524 h1:3YQY1sb5
 github.com/pomerium/datasource v0.18.2-0.20221108160055-c6134b5ed524/go.mod h1:7fGbUYJnU8RcxZJvUvhukOIBv1G7LWDAHMfDxAf5+Y0=
 github.com/pomerium/envoy-custom v1.35.3-rc3 h1:9K4+Wc5bGbFfqTi+hB1zYj3fRUVokEXg8KjZWuUVtes=
 github.com/pomerium/envoy-custom v1.35.3-rc3/go.mod h1:+wpbZvum83bq/OD4cp9/8IZiMV6boBkwDhlFPLOoWoI=
-github.com/pomerium/pomerium v0.28.1-0.20251007155422-042219ff894b h1:9nOfbtaGvSLDsdmBQ0d2+cEgCaUcZ33oRmg2CXX2bI0=
-github.com/pomerium/pomerium v0.28.1-0.20251007155422-042219ff894b/go.mod h1:AWEpe+2WpneQDxxA84/Aw+v47bOJkZJjBFVJ4U/OQSU=
+github.com/pomerium/pomerium v0.28.1-0.20251010012545-df8c257314b1 h1:0PUGuqfN2EA054elebAchVVizySvlg4I8Ol792Ad4io=
+github.com/pomerium/pomerium v0.28.1-0.20251010012545-df8c257314b1/go.mod h1:AWEpe+2WpneQDxxA84/Aw+v47bOJkZJjBFVJ4U/OQSU=
 github.com/pomerium/protoutil v0.0.0-20240813175624-47b7ac43ff46 h1:NRTg8JOXCxcIA1lAgD74iYud0rbshbWOB3Ou4+Huil8=
 github.com/pomerium/protoutil v0.0.0-20240813175624-47b7ac43ff46/go.mod h1:QqZmx6ZgPxz18va7kqoT4t/0yJtP7YFIDiT/W2n2fZ4=
 github.com/pomerium/webauthn v0.0.0-20240603205124-0428df511172 h1:TqoPqRgXSHpn+tEJq6H72iCS5pv66j3rPprThUEZg0E=

go.sum

@@ -266,7 +266,6 @@ func applyCerts(_ context.Context, p *pb.Config, c *model.Config) error {
 func applyAuthenticate(_ context.Context, p *pb.Config, c *model.Config) error {
 	if c.Spec.Authenticate == nil {
 		p.Settings.AuthenticateServiceUrl = proto.String("https://authenticate.pomerium.app")
-		p.Settings.AuthenticateCallbackPath = proto.String("/oauth2/callback")
 		return nil
 	}
 
@@ -275,7 +274,6 @@ func applyAuthenticate(_ context.Context, p *pb.Config, c *model.Config) error {
 		return fmt.Errorf("parsing %s: %w", c.Spec.Authenticate.URL, err)
 	}
 	p.Settings.AuthenticateServiceUrl = &c.Spec.Authenticate.URL
-	p.Settings.AuthenticateCallbackPath = c.Spec.Authenticate.CallbackPath
 
 	return nil
 }

pomerium/config.go

@@ -454,22 +454,6 @@ Authenticate sets authenticate service parameters. If not specified, a Pomerium-
     </thead>
     <tbody>
 
-        <tr>
-            <td>
-                <p>
-                <code>callbackPath</code>&#160;&#160;
-
-                    <strong>string</strong>&#160;
-
-                </p>
-                <p>
-
-                    CallbackPath sets the path at which the authenticate service receives callback responses from your identity provider. The value must exactly match one of the authorized redirect URIs for the OAuth 2.0 client. <p>This value is referred to as the redirect_url in the OpenIDConnect and OAuth2 specs.</p> <p>Defaults to <code>/oauth2/callback</code></p>
-                </p>
-
-            </td>
-        </tr>
-
         <tr>
             <td>
                 <p>