You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
chore(deps): update all non-major dependencies - #525
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.21.3 removes trust in the compromised eMudhra CA (see eMudhra Compromise). The updated base images no longer include the "emSign ECC Root CA - G3" root certificate. Go 1.26.10 also makes crypto/x509 reject certificate chains that pass through the compromised intermediates (CVE-2026-111943).
It also fixes an ACME ARI renewal loop, stops the controller copying a private key from a Secret that the Certificate does not own, and quotes the proxy values in the Helm chart. It updates Go and several dependencies to fix reported security vulnerabilities.
All users should upgrade.
Changes by Kind
Bug or Regression
Added status.acme.ari.certID to track issuance of new certs and re-fetch ARI from CA. This fixes a renewal loop where a stale ARI window from the previous certificate triggered repeated re-issuance until the CA rate limit was hit. (#9292, @hjoshi123)
Helm chart: quote the http_proxy, https_proxy and no_proxy values when rendering the controller Deployment env vars, so values like *.example.com no longer break the manifest. (#9407, @pujitha24)
The requestmanager and issuing controllers now only consume the Secret named by status.nextPrivateKeySecretName when it carries the cert-manager.io/next-private-key label and is owned by the Certificate, matching the invariant the keymanager controller already enforces. Previously a principal able to write the certificates/status subresource, but not to read Secrets, could name any Secret in the namespace and have its private key copied into spec.secretName. The keymanager controller no longer creates the next private key Secret under the name in status.nextPrivateKeySecretName. It always uses a generated name, records a NotOwned Warning event when the field names a Secret it does not own, and repoints the field at the Secret it owns rather than deleting that Secret when the two disagree. The Secret named by spec.secretName is never treated as a next private key Secret, even if spec.secretTemplate labels it as one. (#9368, @wallrj)
Other (Cleanup or Flake)
Upgrade Go to 1.26.9, fixing CVEs in the crypto/tls, net/http, net/textproto and html/template packages. (#9444, @wallrj-cyberark)
Out-of-band security patch release to fix CVE-2026-111943 (golang/go#82345): upgrades Go to 1.26.10 so that the compromised eMudhra intermediate CA certificates are no longer trusted, and updates all dependencies to their latest patch versions.
Summary of Changes
Minor Changes:
alibabacloud: support RRSA (RAM Roles for Service Accounts) credentials in the IPAM allocator, alongside static AccessKeys and ECS instance RAM roles (Backport PR #49474, Upstream PR #49093, @4n4nd)
Bugfixes:
Allow wildcard CIDR selectors to match nodes when --policy-cidr-match-mode=nodes is configured (Backport PR #49474, Upstream PR #47828, @TheBeeZee)
CiliumEnvoyConfig now only redirects Services in its own namespace, as documented; service references in CiliumClusterwideEnvoyConfig without a namespace default to "default" again. (Backport PR #49474, Upstream PR #49076, @maxskokov)
Fix an issue where terminating backends were evicted from BPF maps when trafficDistribution was enabled. (Backport PR #49474, Upstream PR #48349, @taesung320)
Fix invalid L4 checksum on IPv6 ClusterIP reverse NAT for CHECKSUM_PARTIAL packets on kernels < 6.12, affecting the case when packets are bridged/tunneled from the client pod to a remote host (Backport PR #49474, Upstream PR #49204, @liuyuan10)
Fix regression in Cilium 1.20.3 where the Gateway API implementation would incorrectly handle BackendTLSPolicy configurations, leading to high Cilium CPU usage and inability to forward traffic. (Backport PR #49568, Upstream PR #49525, @youngnick)
Fixes an issue in LBIPAM where on service upsert, if IP allocations are not changed the sharing index is not updated. (Backport PR #49474, Upstream PR #48938, @0xch4z)
nodediscovery: in IPAM ENI and Azure modes the operator now treats nodes as running in multi-pool mode from the very first event. (Backport PR #49390, Upstream PR #49242, @41ks)
Reduce transient DNS SERVFAIL/REFUSED for pods that query immediately at startup by pushing/applying Standalone DNS Proxy policy snapshots more frequently (Backport PR #49474, Upstream PR #49112, @QxBytes)
Remove the unused pebble binary from the cilium image to clear its Go standard library vulnerability findings. (Backport PR #49474, Upstream PR #49380, @aanm)
kubernetes 36 ships an additional asyncio client and makes aiohttp a required dependency, although the sidecar only uses the synchronous client. As a result, the image now also contains aiohttp, multidict, yarl, frozenlist, propcache, aiosignal, aiohappyeyeballs and attrs, which you will see in SBOMs and vulnerability scans. The image grows from about 85 MB to 116 MB unpacked (25 → 29 MB compressed, amd64).
⚠️ Regression notice: 2.11.0 broke METHOD=SLEEP and single-namespace RESOURCE_NAME watches: list_resources() was called with one argument too few. 2.10.3 is the last unaffected release. Anyone on 2.11.0 should upgrade to 2.11.1 immediately. See #628 for the full analysis.
Starting with version 2.5.4, we no longer publish the :latest Docker image tag. This is part of our move towards immutable artifacts to improve deployment stability and predictability.
Please update your configurations to use a specific version tag.
kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.
What's Changed
[kube-prometheus-stack] Restore finalizer patch permissions by @jkroepke in #7346
kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.
What's Changed
[kube-prometheus-stack] use kubernetes.io/tls secret for admission webhook certificates by @jkroepke in #7373
kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.
What's Changed
[kube-prometheus-stack] Add serviceMonitor.scrapeClass to chart ServiceMonitors by @jpshields19 in #7337
kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.
What's Changed
[kube-prometheus-stack] Aggregate thanosrulers into view/edit roles by @cwrau in #7347
kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.
What's Changed
[CI] Never overwrite published chart versions on GHCR by @jkroepke in #7381
[kube-prometheus-stack] Support maps for additional monitors by @vprashar2929 in #7385
The golang image in the cli/cmd/truenas-prometheus-exporter/Dockerfile has been updated to a newer digest (972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5) which likely includes the security fix for CVE-2026-111943
Non-compliant requirements:
The PR does not explicitly verify that the updated Go version (1.27) includes the specific security mitigation for the Certificate Authority issue referenced in the ticket
Requires further human verification:
Need to confirm that the updated Go version (1.27) in the Dockerfile indeed includes the security patch for CVE-2026-111943
The golang base image has been updated to a new digest. While this may include the security fix for CVE-2026-111943, it's important to verify that the specific version of Go being used actually contains the mitigation for the described Certificate Authority security concerns. Without explicit confirmation that the new digest corresponds to a Go version with the necessary patches, there's a risk that the security vulnerability remains unaddressed.
FROM golang:1.27-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 AS build
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
jdwillmsen
added
risk/R2
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
49a7d30→251295c10.10.5→10.11.1v1.21.2→v1.21.31.20.3→1.20.4a134550→11e64e22.5.0→2.14.12.13.0→2.14.05cf287a→972b4114.5.3→4.5.592.10.1→92.13.17.3.0→7.5.011.20.0→11.20.23.2.0→3.2.1v1.0.3→v1.0.5Release Notes
argoproj/argo-helm (argo-cd)
v10.11.1Compare Source
A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.
What's Changed
Full Changelog: argoproj/argo-helm@argo-cd-10.11.0...argo-cd-10.11.1
v10.11.0Compare Source
A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.
What's Changed
New Contributors
Full Changelog: argoproj/argo-helm@argo-workflows-2.0.14...argo-cd-10.11.0
cert-manager/cert-manager (cert-manager)
v1.21.3Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.21.3 removes trust in the compromised eMudhra CA (see eMudhra Compromise). The updated base images no longer include the "emSign ECC Root CA - G3" root certificate. Go 1.26.10 also makes
crypto/x509reject certificate chains that pass through the compromised intermediates (CVE-2026-111943).It also fixes an ACME ARI renewal loop, stops the controller copying a private key from a Secret that the Certificate does not own, and quotes the proxy values in the Helm chart. It updates Go and several dependencies to fix reported security vulnerabilities.
All users should upgrade.
Changes by Kind
Bug or Regression
status.acme.ari.certIDto track issuance of new certs and re-fetch ARI from CA. This fixes a renewal loop where a stale ARI window from the previous certificate triggered repeated re-issuance until the CA rate limit was hit. (#9292, @hjoshi123)http_proxy,https_proxyandno_proxyvalues when rendering the controller Deployment env vars, so values like*.example.comno longer break the manifest. (#9407, @pujitha24)requestmanagerandissuingcontrollers now only consume the Secret named bystatus.nextPrivateKeySecretNamewhen it carries thecert-manager.io/next-private-keylabel and is owned by the Certificate, matching the invariant thekeymanagercontroller already enforces. Previously a principal able to write thecertificates/statussubresource, but not to read Secrets, could name any Secret in the namespace and have its private key copied intospec.secretName. Thekeymanagercontroller no longer creates the next private key Secret under the name instatus.nextPrivateKeySecretName. It always uses a generated name, records aNotOwnedWarning event when the field names a Secret it does not own, and repoints the field at the Secret it owns rather than deleting that Secret when the two disagree. The Secret named byspec.secretNameis never treated as a next private key Secret, even ifspec.secretTemplatelabels it as one. (#9368, @wallrj)Other (Cleanup or Flake)
golang.org/x/netto v0.60.0 to fix reported security vulnerabilities (#9451)go.opentelemetry.io/otel/exporters/otlp/otlptraceandotlptracegrpcto v1.45.0 to fix a reported security vulnerability (#9374, #9375)cilium/cilium (cilium)
v1.20.4: 1.20.4Compare Source
Security patch release
Out-of-band security patch release to fix CVE-2026-111943 (golang/go#82345): upgrades Go to 1.26.10 so that the compromised eMudhra intermediate CA certificates are no longer trusted, and updates all dependencies to their latest patch versions.
Summary of Changes
Minor Changes:
Bugfixes:
CI Changes:
Misc Changes:
Other Changes:
Docker Manifests
cilium
quay.io/cilium/cilium:v1.20.4@sha256:20fe92e4c86641233a450098c158d2d29085f3419931ab6bf681d2485dedf16equay.io/cilium/cilium:stable@sha256:20fe92e4c86641233a450098c158d2d29085f3419931ab6bf681d2485dedf16eclustermesh-apiserver
quay.io/cilium/clustermesh-apiserver:v1.20.4@sha256:aeac78ae77d166b86630310f2eb53fbc92014eda36ada8e6b2d7f2b8f2dadbfaquay.io/cilium/clustermesh-apiserver:stable@sha256:aeac78ae77d166b86630310f2eb53fbc92014eda36ada8e6b2d7f2b8f2dadbfahubble-relay
quay.io/cilium/hubble-relay:v1.20.4@sha256:cb23408209697ed30d2bc462e1f01eb622ea4423a891458f78bc88d7255bbfc1quay.io/cilium/hubble-relay:stable@sha256:cb23408209697ed30d2bc462e1f01eb622ea4423a891458f78bc88d7255bbfc1operator-alibabacloud
quay.io/cilium/operator-alibabacloud:v1.20.4@sha256:163a08ee4438780638899742e95521e1a37edeb676c6e5c924d320c4c0bd09adquay.io/cilium/operator-alibabacloud:stable@sha256:163a08ee4438780638899742e95521e1a37edeb676c6e5c924d320c4c0bd09adoperator-aws
quay.io/cilium/operator-aws:v1.20.4@sha256:caab27c6e3286a596d502f76aa6cffe2efab6e8a92234a0d10d2eed3eda85c7cquay.io/cilium/operator-aws:stable@sha256:caab27c6e3286a596d502f76aa6cffe2efab6e8a92234a0d10d2eed3eda85c7coperator-azure
quay.io/cilium/operator-azure:v1.20.4@sha256:0669c35e9f1638bbdd6cf5c64163e7ee4ea4ef440e223050e60665811369b4ecquay.io/cilium/operator-azure:stable@sha256:0669c35e9f1638bbdd6cf5c64163e7ee4ea4ef440e223050e60665811369b4ecoperator-generic
quay.io/cilium/operator-generic:v1.20.4@sha256:7a7a3489dc66ad67e420d285c8a8d2e169b0957ad15e120f593d27081bf38d82quay.io/cilium/operator-generic:stable@sha256:7a7a3489dc66ad67e420d285c8a8d2e169b0957ad15e120f593d27081bf38d82operator
quay.io/cilium/operator:v1.20.4@sha256:f94e9812f191e0c31b5cfe6cb1f38f5c349d4f159f2030e621d179d826257263quay.io/cilium/operator:stable@sha256:f94e9812f191e0c31b5cfe6cb1f38f5c349d4f159f2030e621d179d826257263kiwigrid/k8s-sidecar (docker.io/kiwigrid/k8s-sidecar)
v2.14.1Compare Source
📦 Dependencies
ℹ️ Notes
kubernetes36 ships an additional asyncio client and makesaiohttpa required dependency, although the sidecar only uses the synchronous client. As a result, the image now also containsaiohttp,multidict,yarl,frozenlist,propcache,aiosignal,aiohappyeyeballsandattrs, which you will see in SBOMs and vulnerability scans. The image grows from about 85 MB to 116 MB unpacked (25 → 29 MB compressed, amd64).v2.14.0Compare Source
🚀 Features
🐛 Fixes
v2.13.4Compare Source
🚀 Features
v2.13.3Compare Source
📦 Dependencies
v2.13.2Compare Source
🐛 Fixes
💬 Other
📦 Dependencies
v2.13.1Compare Source
📦 Dependencies
v2.13.0Compare Source
📦 Dependencies
v2.12.0Compare Source
🐛 Fixes
📦 Dependencies
v2.11.2Compare Source
🐛 Fixes
v2.11.1Compare Source
🐛 Fixes
2.11.0 broke
METHOD=SLEEPand single-namespaceRESOURCE_NAMEwatches:list_resources()was called with one argument too few. 2.10.3 is the last unaffected release. Anyone on 2.11.0 should upgrade to 2.11.1 immediately. See #628 for the full analysis.v2.11.0Compare Source
🚀 Features
📦 Dependencies
v2.10.3Compare Source
📦 Dependencies
🐛 Fixes
v2.10.1Compare Source
🚀 Features
v2.10.0Compare Source
🐛 Fixes
🧪 Tests
📦 Dependencies
v2.9.0Compare Source
🚀 Features
v2.8.2Compare Source
📦 Dependencies
v2.8.1Compare Source
🐛 Fixes
📦 Dependencies
v2.8.0Compare Source
🚀 Features
📦 Dependencies
v2.7.4Compare Source
📦 Dependencies
v2.7.3Compare Source
v2.7.1Compare Source
🐛 Fixes
📦 Dependencies
v2.7.0Compare Source
v2.6.1Compare Source
🐛 Fixes
📦 Dependencies
v2.6.0Compare Source
📦 Dependencies
v2.5.5Compare Source
📦 Dependencies
v2.5.4Compare Source
Breaking Change: Removal of
:latestTagStarting with version 2.5.4, we no longer publish the
:latestDocker image tag. This is part of our move towards immutable artifacts to improve deployment stability and predictability.Please update your configurations to use a specific version tag.
v2.5.3Compare Source
📦 Dependencies
v2.5.2Compare Source
📦 Dependencies
external-secrets/external-secrets (external-secrets)
v2.14.0Compare Source
Image:
ghcr.io/external-secrets/external-secrets:v2.14.0Image:
ghcr.io/external-secrets/external-secrets:v2.14.0-ubiImage:
ghcr.io/external-secrets/external-secrets:v2.14.0-ubi-boringsslWhat's Changed
General
Dependencies
803a35ato16e9e43by @dependabot[bot] in #7108New Contributors
Full Changelog: external-secrets/external-secrets@v2.13.0...v2.14.0
grafana/helm-charts (k8s-monitoring)
v4.5.5Compare Source
Capture all telemetry data from your Kubernetes cluster.
Source commit: grafana/k8s-monitoring-helm@
720b8cdTag on source: https://github.com/grafana/k8s-monitoring-helm/releases/tag/k8s-monitoring-4.5.5
v4.5.4Compare Source
Capture all telemetry data from your Kubernetes cluster.
Source commit: grafana/k8s-monitoring-helm@
d0bf216Tag on source: https://github.com/grafana/k8s-monitoring-helm/releases/tag/k8s-monitoring-4.5.4
prometheus-community/helm-charts (kube-prometheus-stack)
v92.13.1Compare Source
kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.
What's Changed
Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-92.13.0...kube-prometheus-stack-92.13.1
v92.13.0Compare Source
kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.
What's Changed
Full Changelog: prometheus-community/helm-charts@prometheus-couchdb-exporter-1.2.0...kube-prometheus-stack-92.13.0
v92.12.0Compare Source
kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.
What's Changed
New Contributors
Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-92.11.1...kube-prometheus-stack-92.12.0
v92.11.1Compare Source
kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.
What's Changed
Full Changelog: prometheus-community/helm-charts@prometheus-29.38.0...kube-prometheus-stack-92.11.1
v92.11.0Compare Source
kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.
What's Changed
New Contributors
Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-92.10.1...kube-prometheus-stack-92.11.0
grafana-community/helm-charts (tempo)
v3.2.1Compare Source
Grafana Tempo Single Binary Mode
What's Changed
Full Changelog: grafana-community/helm-charts@loki-19.0.3...tempo-3.2.1
redhat-cop/vault-config-operator (vault-config-operator)
v1.0.5Compare Source
What's Changed
Full Changelog: redhat-cop/vault-config-operator@v1.0.4...v1.0.5
v1.0.4Compare Source
What's Changed
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.