# Dex v2.46.0 corresponding source and rebuild recipe

Image identity: `oci.thepeoples.io/hardened/dex:v2.46.0-tpio.3` at
`sha256:caaddf94e72b5b3cec4ca35c6120398f83b155baf43b3c1f2952a702a90b1b74`.

This source offer names the exact Go 1.27.3 candidate built by harden run 732
(CVE-2026-111943 / GO-2026-6809). Publishing this source offer does not publish
the image tag. Never retag `v2.46.0-tpio.2`. Consult the catalog for
publication and validation status; a source offer alone is not a release
approval.

The upstream source archives and exact packaging/rebuild recipes are provided
here. Verify SHA256SUMS before rebuilding. Build-records contain the recorded
dependency bumps and installed-package manifest from this candidate. Use the
pinned inputs in Containerfile and the included helper. Archives retain their
upstream licences.