Release notes from dex v2.45.0

{
  "id": "2929c855d910bdd7c10860601f0bd1175c91a0b359ef56c85bdb452674fd49ec",
  "url": "https://github.com/dexidp/dex/releases/tag/v2.45.0",
  "method": "llm",
  "payload": {
    "kind": "other",
    "title": "Release notes from dex v2.45.0",
    "summary": "The release notes disclose two known CVEs in the optional gomplate binary and say dex will update its version after upstream fixes are available. This release does not claim to fix either CVE.",
    "evidence": "There are two known CVEs in the gomplate binary - CVE-2025-68121 and CVE-2026-25934. gomplate is only used for preprocessing configuration files and is optional. Once the CVEs are fixed upstream, the version of gomplate in the dex image will be updated accordingly.",
    "products": [
      {
        "name": {
          "value": "gomplate",
          "evidence": "There are two known CVEs in the gomplate binary"
        },
        "prerequisites": [
          {
            "value": "gomplate is only used for preprocessing configuration files and is optional",
            "evidence": "gomplate is only used for preprocessing configuration files and is optional"
          }
        ],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2025-68121",
        "evidence": "There are two known CVEs in the gomplate binary - CVE-2025-68121 and CVE-2026-25934."
      },
      {
        "value": "CVE-2026-25934",
        "evidence": "There are two known CVEs in the gomplate binary - CVE-2025-68121 and CVE-2026-25934."
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-dexidp-dex",
  "document_id": 20882,
  "published_at": "2026-02-23T15:08:13+00:00"
}