feat(helm): update chart external-secrets (2.8.0 → 2.9.0)

[bot-akira]

This PR contains the following updates:

Package	Update	Change
external-secrets	minor	2.8.0 → 2.9.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

external-secrets/external-secrets (external-secrets)

v2.9.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.9.0
Image: ghcr.io/external-secrets/external-secrets:v2.9.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.9.0-ubi-boringssl

What's Changed

General

• chore: release helm chart 2.8.0 by @​Skarlso in #​6656
• fix(conjur): add InstallTimeout to helm chart installation and pin server image version by @​alekc in #​6658
• fix(deps): bump grpc-go for GHSA-hrxh-6v49-42gf by @​evrardj-roche in #​6695
• feat(charts): add opt-in schedulerName and runtimeClassName to the pods by @​somaz94 in #​6675
• fix(webhookconfig): use a constant Eventf format by @​evrardj-roche in #​6699
• fix: bump codeqls together by @​evrardj-roche in #​6707
• fix(security): install crane in a reliable way and fix code scanning issue by @​Skarlso in #​6712
• chore: Fix cve-2026-56852 by bump golang.org/x/text@​0.40 by @​evrardj-roche in #​6734
• chore(fix): template abuse for secret values by @​Skarlso in #​6730
• chore: Bump controller runtime by @​evrardj-roche in #​6703
• chore(fix): moved the validation further up the chain by @​Skarlso in #​6735
• fix: pin all dependencies by @​evrardj-roche in #​6727
• feat(e2e): implement fan-out matrix validation and credential scoping by @​alekc in #​6660
• fix(akeyless): use local errors.As target to avoid data race by @​HYPERVAPOR in #​6749
• test(crd): add e2e suite and CI leg for the CRD provider by @​alekc in #​6742
• docs(webhook): add debugging guide and fix stale secret-label claim by @​alekc in #​6746
• test(e2e): skip the global addon uninstall on disposable clusters by @​alekc in #​6780
• feat: add environments support to 1Password SDK by @​Skarlso in #​6318
• fix(akeyless): stop reporting API failures as a missing item by @​alekc in #​6753
• fix(makefile): harden clean worktree check by @​evrardj-roche in #​6702
• fix: support docs builds from worktrees by @​evrardj-roche in #​6741
• feat(cache): add atomic ContainsOrAdd by @​evrardj-roche in #​6706
• fix: omit empty AWS secret replica regions by @​goutamadwant in #​6596
• fix: Follow up PR6318 by @​evrardj-roche in #​6782
• feat: Show sponsoring of Roche by @​evrardj-roche in #​6790
• fix(e2e): make the oracle suite runnable by @​alekc in #​6770
• chore: temporarily allow GHSA-gcjh-h69q-9w9g by @​evrardj-roche in #​6795
• fix(api): stop defaulting optional ExternalSecret strategy fields by @​alekc in #​6798
• chore: remove/cleanup remaining tools from tools.go. by @​evrardj-roche in #​6786
• chore: Cleanup sponsors dead links by @​evrardj-roche in #​6791
• fix(aws): detach replicated regions before deleting AWS SecretsManager secret by @​cmoscofian in #​6687
• chore: fix enable cache being removed on installCRD=false by @​Skarlso in #​6799

Dependencies

• chore(deps): bump golang from 0178a64 to 0178a64 by @​dependabot[bot] in #​6663
• chore(deps): bump mkdocs-material from 9.7.6 to 9.7.7 in /hack/api-docs by @​dependabot[bot] in #​6669
• chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.1 by @​dependabot[bot] in #​6674
• chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 by @​dependabot[bot] in #​6667
• chore(deps): bump fkirc/skip-duplicate-actions from 5.3.1 to 5.3.2 by @​dependabot[bot] in #​6671
• chore(deps): bump actions/stale from 10.3.0 to 10.4.0 by @​dependabot[bot] in #​6673
• chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by @​dependabot[bot] in #​6672
• chore(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 6.2.2 by @​dependabot[bot] in #​6670
• chore(deps): bump distroless/static from d5f030c to 9197324 by @​dependabot[bot] in #​6662
• chore(deps): bump ubi9/ubi from 8bf0e8f to 2a6bd69 by @​dependabot[bot] in #​6661
• chore(deps): bump actions/setup-go from 6.0.0 to 7.0.0 by @​dependabot[bot] in #​6664
• chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by @​dependabot[bot] in #​6665
• chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.3 by @​dependabot[bot] in #​6666
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​6715
• chore(deps): bump aws-actions/configure-aws-credentials from 6.2.2 to 6.2.3 by @​dependabot[bot] in #​6717
• chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @​dependabot[bot] in #​6722
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.3 in the codeql group across 1 directory by @​dependabot[bot] in #​6713
• chore(deps): bump google-github-actions/auth from fc21748 to cd3439a by @​dependabot[bot] in #​6714
• chore(deps): bump actions/cache from 4.2.4 to 6.1.0 by @​dependabot[bot] in #​6716
• chore(deps): bump actions/labeler from 6.1.0 to 7.0.0 by @​dependabot[bot] in #​6718
• chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.2.0 by @​dependabot[bot] in #​6719
• chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 by @​dependabot[bot] in #​6720
• chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0 by @​dependabot[bot] in #​6723
• chore(deps): bump docker/login-action from 4.4.0 to 4.5.2 by @​dependabot[bot] in #​6736
• chore(deps): bump actions/stale from 10.4.0 to 11.0.0 by @​dependabot[bot] in #​6738
• chore(deps): bump the codeql group with 3 updates by @​dependabot[bot] in #​6751
• chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 by @​dependabot[bot] in #​6752
• chore(deps): bump the codeql group with 3 updates by @​dependabot[bot] in #​6801
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​6802
• chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 by @​dependabot[bot] in #​6805
• chore(deps): bump azure/login from 3.0.0 to 3.0.1 by @​dependabot[bot] in #​6804
• chore(deps): bump google-github-actions/auth from cd3439a to 1206044 by @​dependabot[bot] in #​6737
• chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.1 by @​dependabot[bot] in #​6803

New Contributors

• @​HYPERVAPOR made their first contribution in #​6749
• @​goutamadwant made their first contribution in #​6596

Full Changelog: external-secrets/external-secrets@v2.8.0...v2.9.0

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[bot-akira]

konflate — summary

Note

+0 added · 0 changed · −44 removed — 44 resources · 1 app · 25 CRDs

Blast radius

• Kustomization kube-system/external-secrets — 15 dependents (Kustomization kube-system/external-secrets-stores +14 more)

Warning

⚠ Cautions

• CustomResourceDefinition acraccesstokens.generators.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition beyondtrustworkloadcredentialsdynamicsecrets.generators.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition cloudsmithaccesstokens.generators.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition clusterexternalsecrets.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition clustergenerators.generators.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition clusterpushsecrets.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition clustersecretstores.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition ecrauthorizationtokens.generators.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition externalsecrets.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition fakes.generators.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition gcraccesstokens.generators.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition generatorstates.generators.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition githubaccesstokens.generators.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition gitlabdeploytokens.generators.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition grafanas.generators.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition mfas.generators.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition passwords.generators.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition pushsecrets.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition quayaccesstokens.generators.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition secretstores.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition sshkeys.generators.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition stssessiontokens.generators.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition uuids.generators.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition vaultdynamicsecrets.generators.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• CustomResourceDefinition webhooks.generators.external-secrets.io — removed CustomResourceDefinition — deletes all of its custom resources
• Kustomization kube-system/external-secrets — removed, but still declared in spec.dependsOn by Kustomization kube-system/external-secrets-stores — those will wedge on the missing dependency

Caution

2 render failures

• Kustomization flux-system/cluster-apps — remote resource https://raw.githubusercontent.com/dragonflydb/dragonfly-operator/v1.6.1/manifests/crd.yaml: Get "https://raw.githubusercontent.com/dragonflydb/dragonfly-operator/v1.6.1/manifests/crd.yaml": dial tcp [2606:50c0:8002::154]:443: connect: network is unreachable
• Kustomization kube-system/external-secrets — dependencies failed: Kustomization/flux-system/cluster-apps: remote resource https://raw.githubusercontent.com/dragonflydb/dragonfly-operator/v1.6.1/manifests/crd.yaml: Get "https://raw.githubusercontent.com/dragonflydb/dragonfly-operator/v1.6.1/manifests/crd.yaml": dial tcp [2606:50c0:8002::154]:443: connect: network is unreachable

Image changes

image	from	to
ghcr.io/external-secrets/external-secrets	v2.8.0	∅

View the full rendered diff →

_{konflate · rendered f52000f · advisory, not a gate}