[renovate]

This PR contains the following updates:

Package	Type	Update	Change
external-secrets	HelmChart	minor	2.10.0 → 2.14.0

---

Release Notes

external-secrets/external-secrets (external-secrets)

v2.14.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.14.0
Image: ghcr.io/external-secrets/external-secrets:v2.14.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.14.0-ubi-boringssl

What's Changed

General

• chore: release helm chart for version 2.13.0 by @​evrardj-roche in #​7129
• fix: keep 1password sdk errors generic by @​evrardj-roche in #​7130
• fix(ci): correct the Codecov input name and a stale version comment by @​thc1006 in #​6824
• fix(vault): strip mount prefix in buildMetadataPath like buildPath by @​pratikwayal01 in #​6999
• fix(clusterexternalsecret): make CES namespace finalizer length-safe by @​sridileep04 in #​7040
• feat: allow GithubAccessToken generator to source app and installation IDs from secrets by @​yordis in #​7038
• fix(security): Sanitize Controller Status and Event Errors by @​deepnemesis in #​7149
• fix: defense in depth against nil assignment by @​evrardj-roche in #​7132
• fix: keep go directives at a .0 patch release by @​dnwe in #​7147
• fix: Insufficient default cooldown by @​evrardj-roche in #​7152
• fix: Use new self-repository syntax by @​evrardj-roche in #​7153
• fix: Mismatch between comment and sha by @​evrardj-roche in #​7154
• chore: bump to 1.27.3 and a few required deps by @​evrardj-roche in #​7169
• fix: codeql warning by @​evrardj-roche in #​7173
• fix: remove superfluous actions by @​evrardj-roche in #​7161
• chore: use sha instead of tags and deprecate unmaintained images by @​evrardj-roche in #​7158
• chore: update docs for next release by @​evrardj-roche in #​7177

Dependencies

• chore(deps): bump step-security/harden-runner from 2.21.1 to 2.22.1 by @​dependabot[bot] in #​7112
• chore(deps): bump helm/chart-testing-action from 2.8.0 to 2.9.0 by @​dependabot[bot] in #​7113
• chore(deps): bump ubi9/ubi from 803a35a to 16e9e43 by @​dependabot[bot] in #​7108
• chore(deps): bump goreleaser/goreleaser-action from 7.2.3 to 7.3.0 by @​dependabot[bot] in #​7143
• chore(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 by @​dependabot[bot] in #​7144

New Contributors

• @​pratikwayal01 made their first contribution in #​6999
• @​sridileep04 made their first contribution in #​7040
• @​yordis made their first contribution in #​7038
• @​deepnemesis made their first contribution in #​7149
• @​dnwe made their first contribution in #​7147

Full Changelog: external-secrets/external-secrets@v2.13.0...v2.14.0

v2.13.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.13.0
Image: ghcr.io/external-secrets/external-secrets:v2.13.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.13.0-ubi-boringssl

What's Changed

General

• chore: release helm chart for version 2.12.0 by @​evrardj-roche in #​7088
• fix: validate manifest Secret candidates by @​evrardj-roche in #​7066
• chore: update go to 1.26.9 and golang.org/x/net to v0.61.0 by @​alekc in #​7116
• docs: fix duplicated word in the datafrom rewrite guide by @​alekc in #​6977
• docs: anchor namespace regex examples by @​Only-Abhiram in #​7121
• fix(dvls): bump go-dvls to v0.21.1 by @​dion-gionet in #​7058
• fix(beyondtrustworkloadcredentials): Address the API at /site/{siteID}/wlc by @​mdreyer-bt in #​7034
• chore: bump Go 1.27 by @​evrardj-roche in #​7122
• fix: Restrict v1beta1 Secret template targets by @​evrardj-roche in #​7067
• test: reconcile validates secret candidate by @​evrardj-roche in #​7068
• docs: clarify guide by @​evrardj-roche in #​7104
• chore: update docs for next release by @​evrardj-roche in #​7128

Dependencies

• chore(deps): bump golang from 1.27.1-bookworm to 1.27.2-bookworm in /e2e by @​dependabot[bot] in #​7109
• chore(deps): bump codelytv/pr-size-labeler from 1.10.4 to 1.12.0 by @​dependabot[bot] in #​7081
• chore(deps): bump helm/kind-action from 1.15.0 to 1.15.1 by @​dependabot[bot] in #​7114
• chore(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @​dependabot[bot] in #​7111
• chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @​dependabot[bot] in #​7115
• chore(deps): bump the codeql group across 1 directory with 3 updates by @​dependabot[bot] in #​7110

New Contributors

• @​Only-Abhiram made their first contribution in #​7121
• @​dion-gionet made their first contribution in #​7058
• @​mdreyer-bt made their first contribution in #​7034

Full Changelog: external-secrets/external-secrets@v2.12.0...v2.13.0

v2.12.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.12.0
Image: ghcr.io/external-secrets/external-secrets:v2.12.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.12.0-ubi-boringssl

What's Changed

General

• fix: Revert breaking change to change imageRegistry by @​evrardj-roche in #​6996
• fix: e2e test should not override default vars by @​evrardj-roche in #​6995
• chore: release helm chart for 2.11.0 by @​evrardj-roche in #​6997
• fix: Remove fail from templates by @​evrardj-roche in #​7019
• docs(generators): describe UUID output as lowercase version 4 by @​alekc in #​7027
• fix(akeyless): return esv1.NoSecretErr when a secret does not exist in GetSecret by @​wankhede04 in #​7013
• feat(generators): add prefix and suffix to the Password generator by @​alekc in #​7028
• fix(aws): return esv1.NoSecretErr when a certificate does not exist in Certificate Manager GetSecret by @​wankhede04 in #​7015
• fix: use preinstalled-runtimes to match v2 bump by @​evrardj-roche in #​7031
• chore: update dependencies by @​eso-service-account-app[bot] in #​7047
• fix(pulumi): preserve environment definition on PushSecret by @​KR-Ravindra in #​6933
• docs: set Orphan on ClusterExternalSecret fan-out example by @​guanchzhou in #​6885
• feat(conjur): Cloud Authenticators support by @​hdabrowski in #​6729
• docs: add Vault custom metadata example by @​PCDattt in #​6982
• feat(charts): add rbac.leaderElection.create toggle by @​kriszkern in #​6950
• feat(charts): warn when replicas > 1 without leader election by @​anikievev in #​7036
• fix: Never template strings in errors by @​evrardj-roche in #​7021
• fix: Validate Secret before writing by @​evrardj-roche in #​7065
• chore: Update docs for new release by @​evrardj-roche in #​7085

Dependencies

• chore(deps): bump ubi9/ubi from c5cc9c2 to a4b9ec0 by @​dependabot[bot] in #​7001
• chore(deps): bump docker/setup-buildx-action from 4.3.0 to 4.4.1 by @​dependabot[bot] in #​7006
• chore(deps): bump jlumbroso/free-disk-space from 1.3.1 to 2.0.0 by @​dependabot[bot] in #​7005
• chore(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 by @​dependabot[bot] in #​7004
• chore(deps): bump golang from 648f440 to 69a7b97 in /e2e by @​dependabot[bot] in #​7044
• chore(deps): bump alpine from 3.24.1 to 3.24.2 in /e2e by @​dependabot[bot] in #​7043
• chore(deps): bump alpine from 28bd5fe to 294b683 by @​dependabot[bot] in #​7042
• chore(deps): bump alpine from 28bd5fe to 294b683 in /hack/api-docs by @​dependabot[bot] in #​7045
• chore(deps): bump ubi9/ubi from a4b9ec0 to 7a38d75 by @​dependabot[bot] in #​7041
• chore(deps): bump docker/setup-qemu-action from 4.3.0 to 4.4.0 by @​dependabot[bot] in #​7003
• chore(deps): bump aws-actions/configure-aws-credentials from 6.2.4 to 6.3.0 by @​dependabot[bot] in #​7002
• chore(deps): bump azure/login from 3.0.2 to 3.1.0 by @​dependabot[bot] in #​6959
• chore(deps): bump the codeql group across 1 directory with 3 updates by @​dependabot[bot] in #​6958
• chore(deps): bump distroless/static from f2ea270 to 5813399 by @​dependabot[bot] in #​6957
• chore(deps): bump anchore/sbom-action/download-syft from 0.24.2 to 0.24.3 by @​dependabot[bot] in #​7080
• chore(deps): bump ubi9/ubi from 7a38d75 to 803a35a by @​dependabot[bot] in #​7079

New Contributors

• @​wankhede04 made their first contribution in #​7013
• @​KR-Ravindra made their first contribution in #​6933
• @​guanchzhou made their first contribution in #​6885
• @​PCDattt made their first contribution in #​6982
• @​anikievev made their first contribution in #​7036

Full Changelog: external-secrets/external-secrets@v2.11.0...v2.12.0

v2.11.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.11.0
Image: ghcr.io/external-secrets/external-secrets:v2.11.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.11.0-ubi-boringssl

What's Changed

General

• chore: release helm chart for 2.10.0 by @​Skarlso in #​6882
• docs: use --hostname all in the Bitwarden webhook example by @​ggiesen in #​6850
• fix(ci): zizmor no-op blocks gates by @​evrardj-roche in #​6889
• feat(barbican): Support OpenStack Barbican authentication via Application Credentials by @​JaviMore in #​6082
• clean: replace k8s.io/utils pointer helpers with the new builtin by @​alekc in #​6902
• feat(webhook): return not supported error for GetAllSecrets by @​Abderraoufzekkour in #​6817
• fix(keepersecurity): return NoSecretErr for missing records by @​alliasgher in #​6816
• fix: doc builds may set different user/group ownership on git repo objects by @​evrardj-roche in #​6901
• fix: Use local GCP import for Vault modules by @​evrardj-roche in #​6904
• fix: guarantee replaces by @​evrardj-roche in #​6905
• chore: bump grpc by @​evrardj-roche in #​6909
• fix: bump Makefile license-eye image to 0.9.0 by @​dronenb in #​6855
• feat(infisical): add option to keep duplicate secret keys by @​mathnogueira in #​6908
• ref: move provider constants by @​evrardj-roche in #​6883
• feat: allow specifying namespace for grafana dashboard ConfigMap by @​okwilkins in #​6920
• fix(keepersecurity): make folderID optional except when creating new records via push by @​LGKentang in #​6921
• docs(templating): remove duplicate a in TemplateFrom Literal note by @​mrchatam in #​6953
• feat(ci): close pull requests that drop a template section by @​alekc in #​6881
• feat(charts): add global.imageRegistry to the external-secrets chart by @​alekc in #​6983
• chore: update skywalking-eyes by @​evrardj-roche in #​6970
• ref: fix Sonarqube linting alerts by @​evrardj-roche in #​6974
• chore: Revert #​6908 by @​evrardj-roche in #​6991
• chore: prepare release support matrix by @​evrardj-roche in #​6993

Dependencies

• chore(deps): bump golang from 484ef60 to ded31c6 in /e2e by @​dependabot[bot] in #​6892
• chore(deps): bump ubi9/ubi from 5426a8f to 25a147d by @​dependabot[bot] in #​6890
• chore(deps): bump anchore/sbom-action/download-syft from 0.24.0 to 0.24.2 by @​dependabot[bot] in #​6895
• chore(deps): bump the codeql group across 1 directory with 3 updates by @​dependabot[bot] in #​6893
• chore(deps): bump azure/login from 3.0.1 to 3.0.2 by @​dependabot[bot] in #​6896
• chore(deps): bump golang from 1.27.0-bookworm to 1.27.1-bookworm in /e2e by @​dependabot[bot] in #​6923
• chore(deps): bump aws-actions/configure-aws-credentials from 6.2.3 to 6.2.4 by @​dependabot[bot] in #​6925
• chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 by @​dependabot[bot] in #​6927
• chore(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3 by @​dependabot[bot] in #​6924
• chore(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1 by @​dependabot[bot] in #​6926
• chore(deps): bump helm/kind-action from 1.14.0 to 1.15.0 by @​dependabot[bot] in #​6928
• chore(deps): bump docker/setup-qemu-action from 4.2.0 to 4.3.0 by @​dependabot[bot] in #​6929
• chore(deps): bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 by @​dependabot[bot] in #​6960
• chore(deps): bump ubi9/ubi from 25a147d to c5cc9c2 by @​dependabot[bot] in #​6956

New Contributors

• @​ggiesen made their first contribution in #​6850
• @​JaviMore made their first contribution in #​6082
• @​Abderraoufzekkour made their first contribution in #​6817
• @​okwilkins made their first contribution in #​6920
• @​LGKentang made their first contribution in #​6921
• @​mrchatam made their first contribution in #​6953

Full Changelog: external-secrets/external-secrets@v2.10.0...v2.11.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.