feat(container): update ghcr.io/external-secrets/charts/external-secrets ( 2.8.0 ➔ 2.9.0 )

renovate-bot commented

2026-08-08 15:03:28 +02:00

Collaborator

This PR contains the following updates:

Package	Update	Change
ghcr.io/external-secrets/charts/external-secrets	minor	`2.8.0` → `2.9.0`

Release Notes

external-secrets/external-secrets (ghcr.io/external-secrets/charts/external-secrets)

`v2.9.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.9.0
Image: ghcr.io/external-secrets/external-secrets:v2.9.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.9.0-ubi-boringssl

What's Changed

General

chore: release helm chart 2.8.0 by @Skarlso in #6656
fix(conjur): add InstallTimeout to helm chart installation and pin server image version by @alekc in #6658
fix(deps): bump grpc-go for GHSA-hrxh-6v49-42gf by @evrardj-roche in #6695
feat(charts): add opt-in schedulerName and runtimeClassName to the pods by @somaz94 in #6675
fix(webhookconfig): use a constant Eventf format by @evrardj-roche in #6699
fix: bump codeqls together by @evrardj-roche in #6707
fix(security): install crane in a reliable way and fix code scanning issue by @Skarlso in #6712
chore: Fix cve-2026-56852 by bump golang.org/x/text@0.40 by @evrardj-roche in #6734
chore(fix): template abuse for secret values by @Skarlso in #6730
chore: Bump controller runtime by @evrardj-roche in #6703
chore(fix): moved the validation further up the chain by @Skarlso in #6735
fix: pin all dependencies by @evrardj-roche in #6727
feat(e2e): implement fan-out matrix validation and credential scoping by @alekc in #6660
fix(akeyless): use local errors.As target to avoid data race by @HYPERVAPOR in #6749
test(crd): add e2e suite and CI leg for the CRD provider by @alekc in #6742
docs(webhook): add debugging guide and fix stale secret-label claim by @alekc in #6746
test(e2e): skip the global addon uninstall on disposable clusters by @alekc in #6780
feat: add environments support to 1Password SDK by @Skarlso in #6318
fix(akeyless): stop reporting API failures as a missing item by @alekc in #6753
fix(makefile): harden clean worktree check by @evrardj-roche in #6702
fix: support docs builds from worktrees by @evrardj-roche in #6741
feat(cache): add atomic ContainsOrAdd by @evrardj-roche in #6706
fix: omit empty AWS secret replica regions by @goutamadwant in #6596
fix: Follow up PR6318 by @evrardj-roche in #6782
feat: Show sponsoring of Roche by @evrardj-roche in #6790
fix(e2e): make the oracle suite runnable by @alekc in #6770
chore: temporarily allow GHSA-gcjh-h69q-9w9g by @evrardj-roche in #6795
fix(api): stop defaulting optional ExternalSecret strategy fields by @alekc in #6798
chore: remove/cleanup remaining tools from tools.go. by @evrardj-roche in #6786
chore: Cleanup sponsors dead links by @evrardj-roche in #6791
fix(aws): detach replicated regions before deleting AWS SecretsManager secret by @cmoscofian in #6687
chore: fix enable cache being removed on installCRD=false by @Skarlso in #6799

Dependencies

chore(deps): bump golang from 0178a64 to 0178a64 by @dependabot[bot] in #6663
chore(deps): bump mkdocs-material from 9.7.6 to 9.7.7 in /hack/api-docs by @dependabot[bot] in #6669
chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.1 by @dependabot[bot] in #6674
chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 by @dependabot[bot] in #6667
chore(deps): bump fkirc/skip-duplicate-actions from 5.3.1 to 5.3.2 by @dependabot[bot] in #6671
chore(deps): bump actions/stale from 10.3.0 to 10.4.0 by @dependabot[bot] in #6673
chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in #6672
chore(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 6.2.2 by @dependabot[bot] in #6670
chore(deps): bump distroless/static from d5f030c to 9197324 by @dependabot[bot] in #6662
chore(deps): bump ubi9/ubi from 8bf0e8f to 2a6bd69 by @dependabot[bot] in #6661
chore(deps): bump actions/setup-go from 6.0.0 to 7.0.0 by @dependabot[bot] in #6664
chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by @dependabot[bot] in #6665
chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.3 by @dependabot[bot] in #6666
chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #6715
chore(deps): bump aws-actions/configure-aws-credentials from 6.2.2 to 6.2.3 by @dependabot[bot] in #6717
chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bot] in #6722
chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.3 in the codeql group across 1 directory by @dependabot[bot] in #6713
chore(deps): bump google-github-actions/auth from fc21748 to cd3439a by @dependabot[bot] in #6714
chore(deps): bump actions/cache from 4.2.4 to 6.1.0 by @dependabot[bot] in #6716
chore(deps): bump actions/labeler from 6.1.0 to 7.0.0 by @dependabot[bot] in #6718
chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.2.0 by @dependabot[bot] in #6719
chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 by @dependabot[bot] in #6720
chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0 by @dependabot[bot] in #6723
chore(deps): bump docker/login-action from 4.4.0 to 4.5.2 by @dependabot[bot] in #6736
chore(deps): bump actions/stale from 10.4.0 to 11.0.0 by @dependabot[bot] in #6738
chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #6751
chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 by @dependabot[bot] in #6752
chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #6801
chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #6802
chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 by @dependabot[bot] in #6805
chore(deps): bump azure/login from 3.0.0 to 3.0.1 by @dependabot[bot] in #6804
chore(deps): bump google-github-actions/auth from cd3439a to 1206044 by @dependabot[bot] in #6737
chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.1 by @dependabot[bot] in #6803

New Contributors

@HYPERVAPOR made their first contribution in #6749
@goutamadwant made their first contribution in #6596

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.8.0...v2.9.0

Configuration

📅 Schedule: (in timezone Europe/Rome)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/external-secrets/charts/external-secrets](https://github.com/external-secrets/external-secrets) | minor | `2.8.0` → `2.9.0` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (ghcr.io/external-secrets/charts/external-secrets)</summary> ### [`v2.9.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.9.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.8.0...v2.9.0) Image: `ghcr.io/external-secrets/external-secrets:v2.9.0` Image: `ghcr.io/external-secrets/external-secrets:v2.9.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.9.0-ubi-boringssl`  ##### What's Changed ##### General - chore: release helm chart 2.8.0 by [@Skarlso](https://github.com/Skarlso) in [#6656](https://github.com/external-secrets/external-secrets/pull/6656) - fix(conjur): add InstallTimeout to helm chart installation and pin server image version by [@alekc](https://github.com/alekc) in [#6658](https://github.com/external-secrets/external-secrets/pull/6658) - fix(deps): bump grpc-go for GHSA-hrxh-6v49-42gf by [@evrardj-roche](https://github.com/evrardj-roche) in [#6695](https://github.com/external-secrets/external-secrets/pull/6695) - feat(charts): add opt-in schedulerName and runtimeClassName to the pods by [@somaz94](https://github.com/somaz94) in [#6675](https://github.com/external-secrets/external-secrets/pull/6675) - fix(webhookconfig): use a constant Eventf format by [@evrardj-roche](https://github.com/evrardj-roche) in [#6699](https://github.com/external-secrets/external-secrets/pull/6699) - fix: bump codeqls together by [@evrardj-roche](https://github.com/evrardj-roche) in [#6707](https://github.com/external-secrets/external-secrets/pull/6707) - fix(security): install crane in a reliable way and fix code scanning issue by [@Skarlso](https://github.com/Skarlso) in [#6712](https://github.com/external-secrets/external-secrets/pull/6712) - chore: Fix cve-2026-56852 by bump golang.org/x/text\@0.40 by [@evrardj-roche](https://github.com/evrardj-roche) in [#6734](https://github.com/external-secrets/external-secrets/pull/6734) - chore(fix): template abuse for secret values by [@Skarlso](https://github.com/Skarlso) in [#6730](https://github.com/external-secrets/external-secrets/pull/6730) - chore: Bump controller runtime by [@evrardj-roche](https://github.com/evrardj-roche) in [#6703](https://github.com/external-secrets/external-secrets/pull/6703) - chore(fix): moved the validation further up the chain by [@Skarlso](https://github.com/Skarlso) in [#6735](https://github.com/external-secrets/external-secrets/pull/6735) - fix: pin all dependencies by [@evrardj-roche](https://github.com/evrardj-roche) in [#6727](https://github.com/external-secrets/external-secrets/pull/6727) - feat(e2e): implement fan-out matrix validation and credential scoping by [@alekc](https://github.com/alekc) in [#6660](https://github.com/external-secrets/external-secrets/pull/6660) - fix(akeyless): use local errors.As target to avoid data race by [@HYPERVAPOR](https://github.com/HYPERVAPOR) in [#6749](https://github.com/external-secrets/external-secrets/pull/6749) - test(crd): add e2e suite and CI leg for the CRD provider by [@alekc](https://github.com/alekc) in [#6742](https://github.com/external-secrets/external-secrets/pull/6742) - docs(webhook): add debugging guide and fix stale secret-label claim by [@alekc](https://github.com/alekc) in [#6746](https://github.com/external-secrets/external-secrets/pull/6746) - test(e2e): skip the global addon uninstall on disposable clusters by [@alekc](https://github.com/alekc) in [#6780](https://github.com/external-secrets/external-secrets/pull/6780) - feat: add environments support to 1Password SDK by [@Skarlso](https://github.com/Skarlso) in [#6318](https://github.com/external-secrets/external-secrets/pull/6318) - fix(akeyless): stop reporting API failures as a missing item by [@alekc](https://github.com/alekc) in [#6753](https://github.com/external-secrets/external-secrets/pull/6753) - fix(makefile): harden clean worktree check by [@evrardj-roche](https://github.com/evrardj-roche) in [#6702](https://github.com/external-secrets/external-secrets/pull/6702) - fix: support docs builds from worktrees by [@evrardj-roche](https://github.com/evrardj-roche) in [#6741](https://github.com/external-secrets/external-secrets/pull/6741) - feat(cache): add atomic ContainsOrAdd by [@evrardj-roche](https://github.com/evrardj-roche) in [#6706](https://github.com/external-secrets/external-secrets/pull/6706) - fix: omit empty AWS secret replica regions by [@goutamadwant](https://github.com/goutamadwant) in [#6596](https://github.com/external-secrets/external-secrets/pull/6596) - fix: Follow up PR6318 by [@evrardj-roche](https://github.com/evrardj-roche) in [#6782](https://github.com/external-secrets/external-secrets/pull/6782) - feat: Show sponsoring of Roche by [@evrardj-roche](https://github.com/evrardj-roche) in [#6790](https://github.com/external-secrets/external-secrets/pull/6790) - fix(e2e): make the oracle suite runnable by [@alekc](https://github.com/alekc) in [#6770](https://github.com/external-secrets/external-secrets/pull/6770) - chore: temporarily allow GHSA-gcjh-h69q-9w9g by [@evrardj-roche](https://github.com/evrardj-roche) in [#6795](https://github.com/external-secrets/external-secrets/pull/6795) - fix(api): stop defaulting optional ExternalSecret strategy fields by [@alekc](https://github.com/alekc) in [#6798](https://github.com/external-secrets/external-secrets/pull/6798) - chore: remove/cleanup remaining tools from tools.go. by [@evrardj-roche](https://github.com/evrardj-roche) in [#6786](https://github.com/external-secrets/external-secrets/pull/6786) - chore: Cleanup sponsors dead links by [@evrardj-roche](https://github.com/evrardj-roche) in [#6791](https://github.com/external-secrets/external-secrets/pull/6791) - fix(aws): detach replicated regions before deleting AWS SecretsManager secret by [@cmoscofian](https://github.com/cmoscofian) in [#6687](https://github.com/external-secrets/external-secrets/pull/6687) - chore: fix enable cache being removed on installCRD=false by [@Skarlso](https://github.com/Skarlso) in [#6799](https://github.com/external-secrets/external-secrets/pull/6799) ##### Dependencies - chore(deps): bump golang from `0178a64` to `0178a64` by [@dependabot](https://github.com/dependabot)\[bot] in [#6663](https://github.com/external-secrets/external-secrets/pull/6663) - chore(deps): bump mkdocs-material from 9.7.6 to 9.7.7 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6669](https://github.com/external-secrets/external-secrets/pull/6669) - chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6674](https://github.com/external-secrets/external-secrets/pull/6674) - chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6667](https://github.com/external-secrets/external-secrets/pull/6667) - chore(deps): bump fkirc/skip-duplicate-actions from 5.3.1 to 5.3.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6671](https://github.com/external-secrets/external-secrets/pull/6671) - chore(deps): bump actions/stale from 10.3.0 to 10.4.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6673](https://github.com/external-secrets/external-secrets/pull/6673) - chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6672](https://github.com/external-secrets/external-secrets/pull/6672) - chore(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 6.2.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6670](https://github.com/external-secrets/external-secrets/pull/6670) - chore(deps): bump distroless/static from `d5f030c` to `9197324` by [@dependabot](https://github.com/dependabot)\[bot] in [#6662](https://github.com/external-secrets/external-secrets/pull/6662) - chore(deps): bump ubi9/ubi from `8bf0e8f` to `2a6bd69` by [@dependabot](https://github.com/dependabot)\[bot] in [#6661](https://github.com/external-secrets/external-secrets/pull/6661) - chore(deps): bump actions/setup-go from 6.0.0 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6664](https://github.com/external-secrets/external-secrets/pull/6664) - chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6665](https://github.com/external-secrets/external-secrets/pull/6665) - chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#6666](https://github.com/external-secrets/external-secrets/pull/6666) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6715](https://github.com/external-secrets/external-secrets/pull/6715) - chore(deps): bump aws-actions/configure-aws-credentials from 6.2.2 to 6.2.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#6717](https://github.com/external-secrets/external-secrets/pull/6717) - chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#6722](https://github.com/external-secrets/external-secrets/pull/6722) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.3 in the codeql group across 1 directory by [@dependabot](https://github.com/dependabot)\[bot] in [#6713](https://github.com/external-secrets/external-secrets/pull/6713) - chore(deps): bump google-github-actions/auth from [`fc21748`](https://github.com/external-secrets/external-secrets/commit/fc2174804b84f912b1f6d334e9463f484f1c552d) to [`cd3439a`](https://github.com/external-secrets/external-secrets/commit/cd3439a4d2c29fd597fb063e209ee2c2d6128dcd) by [@dependabot](https://github.com/dependabot)\[bot] in [#6714](https://github.com/external-secrets/external-secrets/pull/6714) - chore(deps): bump actions/cache from 4.2.4 to 6.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6716](https://github.com/external-secrets/external-secrets/pull/6716) - chore(deps): bump actions/labeler from 6.1.0 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6718](https://github.com/external-secrets/external-secrets/pull/6718) - chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6719](https://github.com/external-secrets/external-secrets/pull/6719) - chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6720](https://github.com/external-secrets/external-secrets/pull/6720) - chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6723](https://github.com/external-secrets/external-secrets/pull/6723) - chore(deps): bump docker/login-action from 4.4.0 to 4.5.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6736](https://github.com/external-secrets/external-secrets/pull/6736) - chore(deps): bump actions/stale from 10.4.0 to 11.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6738](https://github.com/external-secrets/external-secrets/pull/6738) - chore(deps): bump the codeql group with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#6751](https://github.com/external-secrets/external-secrets/pull/6751) - chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6752](https://github.com/external-secrets/external-secrets/pull/6752) - chore(deps): bump the codeql group with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#6801](https://github.com/external-secrets/external-secrets/pull/6801) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6802](https://github.com/external-secrets/external-secrets/pull/6802) - chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6805](https://github.com/external-secrets/external-secrets/pull/6805) - chore(deps): bump azure/login from 3.0.0 to 3.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6804](https://github.com/external-secrets/external-secrets/pull/6804) - chore(deps): bump google-github-actions/auth from [`cd3439a`](https://github.com/external-secrets/external-secrets/commit/cd3439a4d2c29fd597fb063e209ee2c2d6128dcd) to [`1206044`](https://github.com/external-secrets/external-secrets/commit/12060449e87204eca501a11f2f7f1483024afff0) by [@dependabot](https://github.com/dependabot)\[bot] in [#6737](https://github.com/external-secrets/external-secrets/pull/6737) - chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6803](https://github.com/external-secrets/external-secrets/pull/6803) ##### New Contributors - [@HYPERVAPOR](https://github.com/HYPERVAPOR) made their first contribution in [#6749](https://github.com/external-secrets/external-secrets/pull/6749) - [@goutamadwant](https://github.com/goutamadwant) made their first contribution in [#6596](https://github.com/external-secrets/external-secrets/pull/6596) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.8.0...v2.9.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Rome) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-bot added the

renovate/container

type/minor

labels

2026-08-08 15:03:28 +02:00

renovate-bot added 1 commit

2026-08-08 15:03:28 +02:00

feat(container): update ghcr.io/external-secrets/charts/external-secrets ( 2.8.0 ➔ 2.9.0 )

Labeler / Labeler (pull_request) Successful in 4s

Details

Lint / actionlint (pull_request) Successful in 6s

Details

Lint / yamllint (pull_request) Successful in 12s

Details

AI PR Review / AI PR Review (pull_request) Successful in 39s

Details

Konflate 10 resources changed

Details

476b4e1888

| datasource | package                                          | from  | to    |
| ---------- | ------------------------------------------------ | ----- | ----- |
| docker     | ghcr.io/external-secrets/charts/external-secrets | 2.8.0 | 2.9.0 |

forgejo-actions added the

area/bootstrap

area/kubernetes

labels

2026-08-08 15:03:33 +02:00

lab-assistant-bot commented

2026-08-08 15:04:06 +02:00

Collaborator

✅ Automated recommendation: APPROVE

Analysis engine: minimax/MiniMax-M2-7-anthropic@http://litellm.ai.svc.cluster.local:4000/v1 (anthropic)

Review: Update external-secrets Helm chart 2.8.0 → 2.9.0

Recommendation: Approve

This is a straightforward Renovate-managed minor version upgrade of the external-secrets Helm chart.

Changes Summary

File	Change
`ocirepository.yaml`	`ref.tag`: 2.8.0 → 2.9.0
`helmfile.d/01-apps.yaml`	`version`: 2.8.0 → 2.9.0

What This Upgrades

The v2.9.0 release includes:

Security fix: CVE-2026-56852 via golang.org/x/text bump
Security: grpc-go bump for GHSA-hrxh-6v49-42gf
New features: schedulerName and runtimeClassName opt-in for pods
Bug fixes: Various chart and webhook config improvements

Verification

✅ Both files updated consistently with the same version
✅ OCI artifact pinned by tag (not SHA digest) per repository convention
✅ No metadata.namespace on OCIRepository (injected at build time per convention)
✅ Konflate rendered-diff: no concerns, clean render
✅ No image digest changes in this PR

Non-blocking Caveat

The GitHub releases/compare metadata fetch failed, but the PR body provides sufficient release notes from the upstream repository, and the version change pattern is consistent with a legitimate upstream release.

✅ **Automated recommendation: APPROVE** _Analysis engine: minimax/MiniMax-M2-7-anthropic@http://litellm.ai.svc.cluster.local:4000/v1 (anthropic)_ ## Review: Update external-secrets Helm chart 2.8.0 → 2.9.0 **Recommendation: Approve** This is a straightforward Renovate-managed minor version upgrade of the external-secrets Helm chart. ### Changes Summary | File | Change | |------|--------| | `ocirepository.yaml` | `ref.tag`: 2.8.0 → 2.9.0 | | `helmfile.d/01-apps.yaml` | `version`: 2.8.0 → 2.9.0 | ### What This Upgrades The v2.9.0 release includes: - **Security fix**: CVE-2026-56852 via `golang.org/x/text` bump - **Security**: `grpc-go` bump for GHSA-hrxh-6v49-42gf - **New features**: `schedulerName` and `runtimeClassName` opt-in for pods - **Bug fixes**: Various chart and webhook config improvements ### Verification - ✅ Both files updated consistently with the same version - ✅ OCI artifact pinned by tag (not SHA digest) per repository convention - ✅ No `metadata.namespace` on OCIRepository (injected at build time per convention) - ✅ Konflate rendered-diff: no concerns, clean render - ✅ No image digest changes in this PR ### Non-blocking Caveat The GitHub releases/compare metadata fetch failed, but the PR body provides sufficient release notes from the upstream repository, and the version change pattern is consistent with a legitimate upstream release.

lab-assistant-bot commented

2026-08-08 15:30:13 +02:00

Collaborator

konflate — summary

+0 added · 10 changed · −0 removed — 10 resources · 2 apps · 6 CRDs

Blast radius

Kustomization external-secrets/external-secrets — 1 dependent (Kustomization external-secrets/onepassword-connect)

Image changes

image	from	to
`ghcr.io/external-secrets/external-secrets`	`v2.8.0`	`v2.9.0`

View the full rendered diff →

_{konflate · rendered 476b4e1 · advisory, not a gate}

### konflate — summary **+0 added · 10 changed · −0 removed** — 10 resources · 2 apps · 6 CRDs **Blast radius** - `Kustomization external-secrets/external-secrets` — 1 dependent (`Kustomization external-secrets/onepassword-connect`) **Image changes** | image | from | to | |---|---|---| | `ghcr.io/external-secrets/external-secrets` | `v2.8.0` | `v2.9.0` | [View the full rendered diff →](https://konflate.aresu.eu/#/pr/1998) <sub>konflate · rendered `476b4e1` · advisory, not a gate</sub>