feat(container): update ghcr.io/external-secrets/charts/external-secrets ( 2.8.0 ➔ 2.10.0 ) #2006

Merged

GiorgioAresu merged 1 commit from renovate/ghcr.io-external-secrets-charts-external-secrets-2.x into main 2026-08-29 10:48:06 +02:00

Conversation 2 Commits 1 Files changed 1 +1 -1

renovate-bot commented 2026-08-10 11:00:50 +02:00

Collaborator

Copy link

This PR contains the following updates:

Package	Update	Change
ghcr.io/external-secrets/charts/external-secrets	minor	2.8.0 → 2.10.0

---

Release Notes

external-secrets/external-secrets (ghcr.io/external-secrets/charts/external-secrets)

v2.10.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.10.0
Image: ghcr.io/external-secrets/external-secrets:v2.10.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.10.0-ubi-boringssl

What's Changed

General

• chore: release helm chart for 2.9.0 by @​Skarlso in #​6808
• docs: correct the design type in the PR template by @​sanchpet in #​6813
• fix(aws): redact credentials in aws auth config logs by @​hixichen in #​6683
• fix(gcp): preserve workload identity token expiry by @​jakobtfr in #​6772
• feat(conjur): Conjur PushSecret by @​aidy in #​6272
• fix(infisical): scope dataFrom.find.path in list requests by @​thc1006 in #​6821
• chore: bump golangci-lint and fix new linting issues by @​evrardj-roche in #​6740
• feat(openbao): add auth.kubernetes auth method by @​Nerkho in #​6591
• docs: add OpenChoreo to the adopters list by @​kavishkafernando in #​6820
• feat(passbolt): add support for custom fields by @​saknopper in #​6696
• chore: update go version to 1.26.6 by @​alekc in #​6835
• feat(core): report safe reconcile errors in status conditions by @​alekc in #​6834
• fix(secretserver): missing field siteId in secret creation by @​pr0ton11 in #​6649
• fix: Reconcile sha and version by @​evrardj-roche in #​6843
• chore(deps): bump aws acm by @​evrardj-roche in #​6705
• chore(deps): update go-ntlmssp to v0.1.1 by @​evrardj-roche in #​6701
• clean: Get rid of tests importing provider deps by @​evrardj-roche in #​6846
• chore(deps): bump GitLab API client to v1.46.0 by @​evrardj-roche in #​6700
• docs(webhook): escape Go template examples with {% raw %} by @​atobaum in #​6852
• fix(ci): put CODEOWNERS at a path GitHub actually reads by @​alekc in #​6853
• feat(passbolt): PB-53915 - Surface custom field functions in SDK by @​cedricherzog-passbolt in #​6848
• design: Guarantee module import boundaries by @​evrardj-roche in #​6851
• feat(providers): Nebius MysteryBox SA token federation auth option added by @​greenmapc in #​6784
• fix: Unblock CI by @​evrardj-roche in #​6874
• fix(vault): only apply deprecated token-cache flags when explicitly set by @​markof88 in #​6827
• feat: apply TLS security profile to the external-secrets deployment by @​siddhibhor-56 in #​6617
• feat(github): support Dependabot secrets by @​SanderKnape in #​6878

Dependencies

• chore(deps): bump golang from 0178a64 to 0178a64 by @​dependabot[bot] in #​6818
• chore(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 by @​dependabot[bot] in #​6819
• chore(deps): bump setuptools from 83.0.0 to 84.0.0 in /hack/api-docs by @​dependabot[bot] in #​6826
• chore(deps): bump golang from af8d674 to 3889b42 by @​dependabot[bot] in #​6838
• chore(deps): bump step-security/harden-runner from 2.20.1 to 2.21.0 by @​dependabot[bot] in #​6840
• chore(deps): bump the codeql group across 1 directory with 3 updates by @​dependabot[bot] in #​6839
• chore(deps): bump the codeql group with 3 updates by @​dependabot[bot] in #​6867
• chore(deps): bump ubi9/ubi from 2a6bd69 to 5426a8f by @​dependabot[bot] in #​6865
• chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @​dependabot[bot] in #​6868
• chore(deps): bump golang from 1.26.6-bookworm to 1.27.0-bookworm in /e2e by @​dependabot[bot] in #​6866
• chore(deps): bump golang from 3889b42 to 4c9fe60 by @​dependabot[bot] in #​6864
• chore(deps): bump distroless/static from 9197324 to f2ea270 by @​dependabot[bot] in #​6863

New Contributors

• @​sanchpet made their first contribution in #​6813
• @​hixichen made their first contribution in #​6683
• @​jakobtfr made their first contribution in #​6772
• @​aidy made their first contribution in #​6272
• @​thc1006 made their first contribution in #​6821
• @​Nerkho made their first contribution in #​6591
• @​kavishkafernando made their first contribution in #​6820
• @​saknopper made their first contribution in #​6696
• @​atobaum made their first contribution in #​6852
• @​markof88 made their first contribution in #​6827
• @​SanderKnape made their first contribution in #​6878

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.9.0...v2.10.0

v2.9.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.9.0
Image: ghcr.io/external-secrets/external-secrets:v2.9.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.9.0-ubi-boringssl

What's Changed

General

• chore: release helm chart 2.8.0 by @​Skarlso in #​6656
• fix(conjur): add InstallTimeout to helm chart installation and pin server image version by @​alekc in #​6658
• fix(deps): bump grpc-go for GHSA-hrxh-6v49-42gf by @​evrardj-roche in #​6695
• feat(charts): add opt-in schedulerName and runtimeClassName to the pods by @​somaz94 in #​6675
• fix(webhookconfig): use a constant Eventf format by @​evrardj-roche in #​6699
• fix: bump codeqls together by @​evrardj-roche in #​6707
• fix(security): install crane in a reliable way and fix code scanning issue by @​Skarlso in #​6712
• chore: Fix cve-2026-56852 by bump golang.org/x/text@​0.40 by @​evrardj-roche in #​6734
• chore(fix): template abuse for secret values by @​Skarlso in #​6730
• chore: Bump controller runtime by @​evrardj-roche in #​6703
• chore(fix): moved the validation further up the chain by @​Skarlso in #​6735
• fix: pin all dependencies by @​evrardj-roche in #​6727
• feat(e2e): implement fan-out matrix validation and credential scoping by @​alekc in #​6660
• fix(akeyless): use local errors.As target to avoid data race by @​HYPERVAPOR in #​6749
• test(crd): add e2e suite and CI leg for the CRD provider by @​alekc in #​6742
• docs(webhook): add debugging guide and fix stale secret-label claim by @​alekc in #​6746
• test(e2e): skip the global addon uninstall on disposable clusters by @​alekc in #​6780
• feat: add environments support to 1Password SDK by @​Skarlso in #​6318
• fix(akeyless): stop reporting API failures as a missing item by @​alekc in #​6753
• fix(makefile): harden clean worktree check by @​evrardj-roche in #​6702
• fix: support docs builds from worktrees by @​evrardj-roche in #​6741
• feat(cache): add atomic ContainsOrAdd by @​evrardj-roche in #​6706
• fix: omit empty AWS secret replica regions by @​goutamadwant in #​6596
• fix: Follow up PR6318 by @​evrardj-roche in #​6782
• feat: Show sponsoring of Roche by @​evrardj-roche in #​6790
• fix(e2e): make the oracle suite runnable by @​alekc in #​6770
• chore: temporarily allow GHSA-gcjh-h69q-9w9g by @​evrardj-roche in #​6795
• fix(api): stop defaulting optional ExternalSecret strategy fields by @​alekc in #​6798
• chore: remove/cleanup remaining tools from tools.go. by @​evrardj-roche in #​6786
• chore: Cleanup sponsors dead links by @​evrardj-roche in #​6791
• fix(aws): detach replicated regions before deleting AWS SecretsManager secret by @​cmoscofian in #​6687
• chore: fix enable cache being removed on installCRD=false by @​Skarlso in #​6799

Dependencies

• chore(deps): bump golang from 0178a64 to 0178a64 by @​dependabot[bot] in #​6663
• chore(deps): bump mkdocs-material from 9.7.6 to 9.7.7 in /hack/api-docs by @​dependabot[bot] in #​6669
• chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.1 by @​dependabot[bot] in #​6674
• chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 by @​dependabot[bot] in #​6667
• chore(deps): bump fkirc/skip-duplicate-actions from 5.3.1 to 5.3.2 by @​dependabot[bot] in #​6671
• chore(deps): bump actions/stale from 10.3.0 to 10.4.0 by @​dependabot[bot] in #​6673
• chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by @​dependabot[bot] in #​6672
• chore(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 6.2.2 by @​dependabot[bot] in #​6670
• chore(deps): bump distroless/static from d5f030c to 9197324 by @​dependabot[bot] in #​6662
• chore(deps): bump ubi9/ubi from 8bf0e8f to 2a6bd69 by @​dependabot[bot] in #​6661
• chore(deps): bump actions/setup-go from 6.0.0 to 7.0.0 by @​dependabot[bot] in #​6664
• chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by @​dependabot[bot] in #​6665
• chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.3 by @​dependabot[bot] in #​6666
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​6715
• chore(deps): bump aws-actions/configure-aws-credentials from 6.2.2 to 6.2.3 by @​dependabot[bot] in #​6717
• chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @​dependabot[bot] in #​6722
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.3 in the codeql group across 1 directory by @​dependabot[bot] in #​6713
• chore(deps): bump google-github-actions/auth from fc21748 to cd3439a by @​dependabot[bot] in #​6714
• chore(deps): bump actions/cache from 4.2.4 to 6.1.0 by @​dependabot[bot] in #​6716
• chore(deps): bump actions/labeler from 6.1.0 to 7.0.0 by @​dependabot[bot] in #​6718
• chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.2.0 by @​dependabot[bot] in #​6719
• chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 by @​dependabot[bot] in #​6720
• chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0 by @​dependabot[bot] in #​6723
• chore(deps): bump docker/login-action from 4.4.0 to 4.5.2 by @​dependabot[bot] in #​6736
• chore(deps): bump actions/stale from 10.4.0 to 11.0.0 by @​dependabot[bot] in #​6738
• chore(deps): bump the codeql group with 3 updates by @​dependabot[bot] in #​6751
• chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 by @​dependabot[bot] in #​6752
• chore(deps): bump the codeql group with 3 updates by @​dependabot[bot] in #​6801
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​6802
• chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 by @​dependabot[bot] in #​6805
• chore(deps): bump azure/login from 3.0.0 to 3.0.1 by @​dependabot[bot] in #​6804
• chore(deps): bump google-github-actions/auth from cd3439a to 1206044 by @​dependabot[bot] in #​6737
• chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.1 by @​dependabot[bot] in #​6803

New Contributors

• @​HYPERVAPOR made their first contribution in #​6749
• @​goutamadwant made their first contribution in #​6596

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.8.0...v2.9.0

---

Configuration

📅 Schedule: (in timezone Europe/Rome)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/external-secrets/charts/external-secrets](https://github.com/external-secrets/external-secrets) | minor | `2.8.0` → `2.10.0` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (ghcr.io/external-secrets/charts/external-secrets)</summary> ### [`v2.10.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.10.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.9.0...v2.10.0) Image: `ghcr.io/external-secrets/external-secrets:v2.10.0` Image: `ghcr.io/external-secrets/external-secrets:v2.10.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.10.0-ubi-boringssl` <!-- Release notes generated using configuration in .github/release.yml at main --> #### What's Changed ##### General - chore: release helm chart for 2.9.0 by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;6808](https://github.com/external-secrets/external-secrets/pull/6808) - docs: correct the design type in the PR template by [@&#8203;sanchpet](https://github.com/sanchpet) in [#&#8203;6813](https://github.com/external-secrets/external-secrets/pull/6813) - fix(aws): redact credentials in aws auth config logs by [@&#8203;hixichen](https://github.com/hixichen) in [#&#8203;6683](https://github.com/external-secrets/external-secrets/pull/6683) - fix(gcp): preserve workload identity token expiry by [@&#8203;jakobtfr](https://github.com/jakobtfr) in [#&#8203;6772](https://github.com/external-secrets/external-secrets/pull/6772) - feat(conjur): Conjur PushSecret by [@&#8203;aidy](https://github.com/aidy) in [#&#8203;6272](https://github.com/external-secrets/external-secrets/pull/6272) - fix(infisical): scope dataFrom.find.path in list requests by [@&#8203;thc1006](https://github.com/thc1006) in [#&#8203;6821](https://github.com/external-secrets/external-secrets/pull/6821) - chore: bump golangci-lint and fix new linting issues by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6740](https://github.com/external-secrets/external-secrets/pull/6740) - feat(openbao): add `auth.kubernetes` auth method by [@&#8203;Nerkho](https://github.com/Nerkho) in [#&#8203;6591](https://github.com/external-secrets/external-secrets/pull/6591) - docs: add OpenChoreo to the adopters list by [@&#8203;kavishkafernando](https://github.com/kavishkafernando) in [#&#8203;6820](https://github.com/external-secrets/external-secrets/pull/6820) - feat(passbolt): add support for custom fields by [@&#8203;saknopper](https://github.com/saknopper) in [#&#8203;6696](https://github.com/external-secrets/external-secrets/pull/6696) - chore: update go version to 1.26.6 by [@&#8203;alekc](https://github.com/alekc) in [#&#8203;6835](https://github.com/external-secrets/external-secrets/pull/6835) - feat(core): report safe reconcile errors in status conditions by [@&#8203;alekc](https://github.com/alekc) in [#&#8203;6834](https://github.com/external-secrets/external-secrets/pull/6834) - fix(secretserver): missing field siteId in secret creation by [@&#8203;pr0ton11](https://github.com/pr0ton11) in [#&#8203;6649](https://github.com/external-secrets/external-secrets/pull/6649) - fix: Reconcile sha and version by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6843](https://github.com/external-secrets/external-secrets/pull/6843) - chore(deps): bump aws acm by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6705](https://github.com/external-secrets/external-secrets/pull/6705) - chore(deps): update go-ntlmssp to v0.1.1 by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6701](https://github.com/external-secrets/external-secrets/pull/6701) - clean: Get rid of tests importing provider deps by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6846](https://github.com/external-secrets/external-secrets/pull/6846) - chore(deps): bump GitLab API client to v1.46.0 by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6700](https://github.com/external-secrets/external-secrets/pull/6700) - docs(webhook): escape Go template examples with {% raw %} by [@&#8203;atobaum](https://github.com/atobaum) in [#&#8203;6852](https://github.com/external-secrets/external-secrets/pull/6852) - fix(ci): put CODEOWNERS at a path GitHub actually reads by [@&#8203;alekc](https://github.com/alekc) in [#&#8203;6853](https://github.com/external-secrets/external-secrets/pull/6853) - feat(passbolt): PB-53915 - Surface custom field functions in SDK by [@&#8203;cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) in [#&#8203;6848](https://github.com/external-secrets/external-secrets/pull/6848) - design: Guarantee module import boundaries by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6851](https://github.com/external-secrets/external-secrets/pull/6851) - feat(providers): Nebius MysteryBox SA token federation auth option added by [@&#8203;greenmapc](https://github.com/greenmapc) in [#&#8203;6784](https://github.com/external-secrets/external-secrets/pull/6784) - fix: Unblock CI by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6874](https://github.com/external-secrets/external-secrets/pull/6874) - fix(vault): only apply deprecated token-cache flags when explicitly set by [@&#8203;markof88](https://github.com/markof88) in [#&#8203;6827](https://github.com/external-secrets/external-secrets/pull/6827) - feat: apply TLS security profile to the external-secrets deployment by [@&#8203;siddhibhor-56](https://github.com/siddhibhor-56) in [#&#8203;6617](https://github.com/external-secrets/external-secrets/pull/6617) - feat(github): support Dependabot secrets by [@&#8203;SanderKnape](https://github.com/SanderKnape) in [#&#8203;6878](https://github.com/external-secrets/external-secrets/pull/6878) ##### Dependencies - chore(deps): bump golang from `0178a64` to `0178a64` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6818](https://github.com/external-secrets/external-secrets/pull/6818) - chore(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6819](https://github.com/external-secrets/external-secrets/pull/6819) - chore(deps): bump setuptools from 83.0.0 to 84.0.0 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6826](https://github.com/external-secrets/external-secrets/pull/6826) - chore(deps): bump golang from `af8d674` to `3889b42` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6838](https://github.com/external-secrets/external-secrets/pull/6838) - chore(deps): bump step-security/harden-runner from 2.20.1 to 2.21.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6840](https://github.com/external-secrets/external-secrets/pull/6840) - chore(deps): bump the codeql group across 1 directory with 3 updates by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6839](https://github.com/external-secrets/external-secrets/pull/6839) - chore(deps): bump the codeql group with 3 updates by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6867](https://github.com/external-secrets/external-secrets/pull/6867) - chore(deps): bump ubi9/ubi from `2a6bd69` to `5426a8f` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6865](https://github.com/external-secrets/external-secrets/pull/6865) - chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6868](https://github.com/external-secrets/external-secrets/pull/6868) - chore(deps): bump golang from 1.26.6-bookworm to 1.27.0-bookworm in /e2e by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6866](https://github.com/external-secrets/external-secrets/pull/6866) - chore(deps): bump golang from `3889b42` to `4c9fe60` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6864](https://github.com/external-secrets/external-secrets/pull/6864) - chore(deps): bump distroless/static from `9197324` to `f2ea270` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6863](https://github.com/external-secrets/external-secrets/pull/6863) #### New Contributors - [@&#8203;sanchpet](https://github.com/sanchpet) made their first contribution in [#&#8203;6813](https://github.com/external-secrets/external-secrets/pull/6813) - [@&#8203;hixichen](https://github.com/hixichen) made their first contribution in [#&#8203;6683](https://github.com/external-secrets/external-secrets/pull/6683) - [@&#8203;jakobtfr](https://github.com/jakobtfr) made their first contribution in [#&#8203;6772](https://github.com/external-secrets/external-secrets/pull/6772) - [@&#8203;aidy](https://github.com/aidy) made their first contribution in [#&#8203;6272](https://github.com/external-secrets/external-secrets/pull/6272) - [@&#8203;thc1006](https://github.com/thc1006) made their first contribution in [#&#8203;6821](https://github.com/external-secrets/external-secrets/pull/6821) - [@&#8203;Nerkho](https://github.com/Nerkho) made their first contribution in [#&#8203;6591](https://github.com/external-secrets/external-secrets/pull/6591) - [@&#8203;kavishkafernando](https://github.com/kavishkafernando) made their first contribution in [#&#8203;6820](https://github.com/external-secrets/external-secrets/pull/6820) - [@&#8203;saknopper](https://github.com/saknopper) made their first contribution in [#&#8203;6696](https://github.com/external-secrets/external-secrets/pull/6696) - [@&#8203;atobaum](https://github.com/atobaum) made their first contribution in [#&#8203;6852](https://github.com/external-secrets/external-secrets/pull/6852) - [@&#8203;markof88](https://github.com/markof88) made their first contribution in [#&#8203;6827](https://github.com/external-secrets/external-secrets/pull/6827) - [@&#8203;SanderKnape](https://github.com/SanderKnape) made their first contribution in [#&#8203;6878](https://github.com/external-secrets/external-secrets/pull/6878) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.9.0...v2.10.0> ### [`v2.9.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.9.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.8.0...v2.9.0) Image: `ghcr.io/external-secrets/external-secrets:v2.9.0` Image: `ghcr.io/external-secrets/external-secrets:v2.9.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.9.0-ubi-boringssl` <!-- Release notes generated using configuration in .github/release.yml at main --> #### What's Changed ##### General - chore: release helm chart 2.8.0 by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;6656](https://github.com/external-secrets/external-secrets/pull/6656) - fix(conjur): add InstallTimeout to helm chart installation and pin server image version by [@&#8203;alekc](https://github.com/alekc) in [#&#8203;6658](https://github.com/external-secrets/external-secrets/pull/6658) - fix(deps): bump grpc-go for GHSA-hrxh-6v49-42gf by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6695](https://github.com/external-secrets/external-secrets/pull/6695) - feat(charts): add opt-in schedulerName and runtimeClassName to the pods by [@&#8203;somaz94](https://github.com/somaz94) in [#&#8203;6675](https://github.com/external-secrets/external-secrets/pull/6675) - fix(webhookconfig): use a constant Eventf format by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6699](https://github.com/external-secrets/external-secrets/pull/6699) - fix: bump codeqls together by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6707](https://github.com/external-secrets/external-secrets/pull/6707) - fix(security): install crane in a reliable way and fix code scanning issue by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;6712](https://github.com/external-secrets/external-secrets/pull/6712) - chore: Fix cve-2026-56852 by bump golang.org/x/text\@&#8203;0.40 by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6734](https://github.com/external-secrets/external-secrets/pull/6734) - chore(fix): template abuse for secret values by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;6730](https://github.com/external-secrets/external-secrets/pull/6730) - chore: Bump controller runtime by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6703](https://github.com/external-secrets/external-secrets/pull/6703) - chore(fix): moved the validation further up the chain by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;6735](https://github.com/external-secrets/external-secrets/pull/6735) - fix: pin all dependencies by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6727](https://github.com/external-secrets/external-secrets/pull/6727) - feat(e2e): implement fan-out matrix validation and credential scoping by [@&#8203;alekc](https://github.com/alekc) in [#&#8203;6660](https://github.com/external-secrets/external-secrets/pull/6660) - fix(akeyless): use local errors.As target to avoid data race by [@&#8203;HYPERVAPOR](https://github.com/HYPERVAPOR) in [#&#8203;6749](https://github.com/external-secrets/external-secrets/pull/6749) - test(crd): add e2e suite and CI leg for the CRD provider by [@&#8203;alekc](https://github.com/alekc) in [#&#8203;6742](https://github.com/external-secrets/external-secrets/pull/6742) - docs(webhook): add debugging guide and fix stale secret-label claim by [@&#8203;alekc](https://github.com/alekc) in [#&#8203;6746](https://github.com/external-secrets/external-secrets/pull/6746) - test(e2e): skip the global addon uninstall on disposable clusters by [@&#8203;alekc](https://github.com/alekc) in [#&#8203;6780](https://github.com/external-secrets/external-secrets/pull/6780) - feat: add environments support to 1Password SDK by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;6318](https://github.com/external-secrets/external-secrets/pull/6318) - fix(akeyless): stop reporting API failures as a missing item by [@&#8203;alekc](https://github.com/alekc) in [#&#8203;6753](https://github.com/external-secrets/external-secrets/pull/6753) - fix(makefile): harden clean worktree check by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6702](https://github.com/external-secrets/external-secrets/pull/6702) - fix: support docs builds from worktrees by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6741](https://github.com/external-secrets/external-secrets/pull/6741) - feat(cache): add atomic ContainsOrAdd by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6706](https://github.com/external-secrets/external-secrets/pull/6706) - fix: omit empty AWS secret replica regions by [@&#8203;goutamadwant](https://github.com/goutamadwant) in [#&#8203;6596](https://github.com/external-secrets/external-secrets/pull/6596) - fix: Follow up PR6318 by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6782](https://github.com/external-secrets/external-secrets/pull/6782) - feat: Show sponsoring of Roche by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6790](https://github.com/external-secrets/external-secrets/pull/6790) - fix(e2e): make the oracle suite runnable by [@&#8203;alekc](https://github.com/alekc) in [#&#8203;6770](https://github.com/external-secrets/external-secrets/pull/6770) - chore: temporarily allow GHSA-gcjh-h69q-9w9g by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6795](https://github.com/external-secrets/external-secrets/pull/6795) - fix(api): stop defaulting optional ExternalSecret strategy fields by [@&#8203;alekc](https://github.com/alekc) in [#&#8203;6798](https://github.com/external-secrets/external-secrets/pull/6798) - chore: remove/cleanup remaining tools from tools.go. by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6786](https://github.com/external-secrets/external-secrets/pull/6786) - chore: Cleanup sponsors dead links by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6791](https://github.com/external-secrets/external-secrets/pull/6791) - fix(aws): detach replicated regions before deleting AWS SecretsManager secret by [@&#8203;cmoscofian](https://github.com/cmoscofian) in [#&#8203;6687](https://github.com/external-secrets/external-secrets/pull/6687) - chore: fix enable cache being removed on installCRD=false by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;6799](https://github.com/external-secrets/external-secrets/pull/6799) ##### Dependencies - chore(deps): bump golang from `0178a64` to `0178a64` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6663](https://github.com/external-secrets/external-secrets/pull/6663) - chore(deps): bump mkdocs-material from 9.7.6 to 9.7.7 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6669](https://github.com/external-secrets/external-secrets/pull/6669) - chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6674](https://github.com/external-secrets/external-secrets/pull/6674) - chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6667](https://github.com/external-secrets/external-secrets/pull/6667) - chore(deps): bump fkirc/skip-duplicate-actions from 5.3.1 to 5.3.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6671](https://github.com/external-secrets/external-secrets/pull/6671) - chore(deps): bump actions/stale from 10.3.0 to 10.4.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6673](https://github.com/external-secrets/external-secrets/pull/6673) - chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6672](https://github.com/external-secrets/external-secrets/pull/6672) - chore(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 6.2.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6670](https://github.com/external-secrets/external-secrets/pull/6670) - chore(deps): bump distroless/static from `d5f030c` to `9197324` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6662](https://github.com/external-secrets/external-secrets/pull/6662) - chore(deps): bump ubi9/ubi from `8bf0e8f` to `2a6bd69` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6661](https://github.com/external-secrets/external-secrets/pull/6661) - chore(deps): bump actions/setup-go from 6.0.0 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6664](https://github.com/external-secrets/external-secrets/pull/6664) - chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6665](https://github.com/external-secrets/external-secrets/pull/6665) - chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6666](https://github.com/external-secrets/external-secrets/pull/6666) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6715](https://github.com/external-secrets/external-secrets/pull/6715) - chore(deps): bump aws-actions/configure-aws-credentials from 6.2.2 to 6.2.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6717](https://github.com/external-secrets/external-secrets/pull/6717) - chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6722](https://github.com/external-secrets/external-secrets/pull/6722) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.3 in the codeql group across 1 directory by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6713](https://github.com/external-secrets/external-secrets/pull/6713) - chore(deps): bump google-github-actions/auth from [`fc21748`](https://github.com/external-secrets/external-secrets/commit/fc2174804b84f912b1f6d334e9463f484f1c552d) to [`cd3439a`](https://github.com/external-secrets/external-secrets/commit/cd3439a4d2c29fd597fb063e209ee2c2d6128dcd) by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6714](https://github.com/external-secrets/external-secrets/pull/6714) - chore(deps): bump actions/cache from 4.2.4 to 6.1.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6716](https://github.com/external-secrets/external-secrets/pull/6716) - chore(deps): bump actions/labeler from 6.1.0 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6718](https://github.com/external-secrets/external-secrets/pull/6718) - chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.2.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6719](https://github.com/external-secrets/external-secrets/pull/6719) - chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6720](https://github.com/external-secrets/external-secrets/pull/6720) - chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6723](https://github.com/external-secrets/external-secrets/pull/6723) - chore(deps): bump docker/login-action from 4.4.0 to 4.5.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6736](https://github.com/external-secrets/external-secrets/pull/6736) - chore(deps): bump actions/stale from 10.4.0 to 11.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6738](https://github.com/external-secrets/external-secrets/pull/6738) - chore(deps): bump the codeql group with 3 updates by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6751](https://github.com/external-secrets/external-secrets/pull/6751) - chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6752](https://github.com/external-secrets/external-secrets/pull/6752) - chore(deps): bump the codeql group with 3 updates by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6801](https://github.com/external-secrets/external-secrets/pull/6801) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6802](https://github.com/external-secrets/external-secrets/pull/6802) - chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6805](https://github.com/external-secrets/external-secrets/pull/6805) - chore(deps): bump azure/login from 3.0.0 to 3.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6804](https://github.com/external-secrets/external-secrets/pull/6804) - chore(deps): bump google-github-actions/auth from [`cd3439a`](https://github.com/external-secrets/external-secrets/commit/cd3439a4d2c29fd597fb063e209ee2c2d6128dcd) to [`1206044`](https://github.com/external-secrets/external-secrets/commit/12060449e87204eca501a11f2f7f1483024afff0) by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6737](https://github.com/external-secrets/external-secrets/pull/6737) - chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6803](https://github.com/external-secrets/external-secrets/pull/6803) #### New Contributors - [@&#8203;HYPERVAPOR](https://github.com/HYPERVAPOR) made their first contribution in [#&#8203;6749](https://github.com/external-secrets/external-secrets/pull/6749) - [@&#8203;goutamadwant](https://github.com/goutamadwant) made their first contribution in [#&#8203;6596](https://github.com/external-secrets/external-secrets/pull/6596) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.8.0...v2.9.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Rome) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNy4xIiwidXBkYXRlZEluVmVyIjoiNDQuMTcuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUvY29udGFpbmVyIiwidHlwZS9taW5vciJdfQ==-->

renovate-bot added the

renovate/container

type/minor

labels 2026-08-10 11:00:50 +02:00

forgejo-actions added the

area/bootstrap

area/kubernetes

labels 2026-08-10 11:02:44 +02:00

lab-assistant-bot commented 2026-08-10 11:02:47 +02:00

Collaborator

Copy link

✅ Automated recommendation: APPROVE

Analysis engine: minimax/MiniMax-M2-7-anthropic@http://litellm.ai.svc.cluster.local:4000/v1 (anthropic)

Recommendation: Approve

Change summary: Update external-secrets Helm chart from 2.8.0 to 2.10.0 in kubernetes/bootstrap/helmfile.d/01-apps.yaml.

This is a standard Renovate helm chart minor version upgrade (skipping 2.9.0). The diff is minimal — a single version field change on an OCI-based HelmRelease. The konflate-rendered diff found no issues, confirming the manifests apply cleanly.

Notable changes in external-secrets 2.9.0 → 2.10.0 (per release notes):

• Conjur PushSecret support
• OpenBao auth.kubernetes auth method
• Passbolt custom fields support
• Safe reconcile errors reporting in status conditions
• Various bug fixes (AWS/GCP credential handling, Infisical scoping, SecretServer, version reconciliation)

No blockers identified. Repository conventions are followed: OCI artifacts are pinned by version tag per AGENTS.md (not SHA digest), which is correct here.

<!-- ai-pr-reviewer --> <!-- ai-pr-reviewer:{"version":1,"head_sha":"7f73bc63630bd9ab070d915a06ef329b03bb5074","base_sha":"6711c1db03737852f71823643df9cfd1cd29b032","review_scope":"full","review_result":"clean"} --> <!-- ai-pr-review-sha:7f73bc63630bd9ab070d915a06ef329b03bb5074 --> <!-- ai-pr-review-fingerprint:bfc56a3d2949af5eb897b3ea4ec7cb1ac63a2b43|cfg:79332b18ceb4a39dfadfdbf642ce48bab94d2787e9924d2c56b8195d38d30ab7 --> ✅ **Automated recommendation: APPROVE** _Analysis engine: minimax/MiniMax-M2-7-anthropic@http://litellm.ai.svc.cluster.local:4000/v1 (anthropic)_ ## Recommendation: Approve **Change summary**: Update external-secrets Helm chart from `2.8.0` to `2.10.0` in `kubernetes/bootstrap/helmfile.d/01-apps.yaml`. This is a standard Renovate helm chart minor version upgrade (skipping 2.9.0). The diff is minimal — a single version field change on an OCI-based HelmRelease. The konflate-rendered diff found no issues, confirming the manifests apply cleanly. **Notable changes in external-secrets 2.9.0 → 2.10.0** (per release notes): - Conjur PushSecret support - OpenBao `auth.kubernetes` auth method - Passbolt custom fields support - Safe reconcile errors reporting in status conditions - Various bug fixes (AWS/GCP credential handling, Infisical scoping, SecretServer, version reconciliation) No blockers identified. Repository conventions are followed: OCI artifacts are pinned by version tag per AGENTS.md (not SHA digest), which is correct here.

lab-assistant-bot commented 2026-08-10 11:11:04 +02:00

Collaborator

Copy link

konflate — summary

✅ No rendered changes.

View the full rendered diff →

_{konflate · rendered 217eb7d · advisory, not a gate}

<!-- konflate:pr-2006 --> ### konflate — summary ✅ No rendered changes. [View the full rendered diff →](https://konflate.aresu.eu/#/pr/2006) _{konflate · rendered `217eb7d` · advisory, not a gate}

renovate-bot force-pushed renovate/ghcr.io-external-secrets-charts-external-secrets-2.x from f8f4d70d80 to 7f73bc6363 2026-08-28 16:00:38 +02:00 Compare

renovate-bot changed title from feat(container): update ghcr.io/external-secrets/charts/external-secrets ( 2.8.0 ➔ 2.9.0 ) to feat(container): update ghcr.io/external-secrets/charts/external-secrets ( 2.8.0 ➔ 2.10.0 ) 2026-08-28 16:00:44 +02:00

renovate-bot force-pushed renovate/ghcr.io-external-secrets-charts-external-secrets-2.x from 7f73bc6363 to 217eb7df1f 2026-08-29 10:40:00 +02:00 Compare

GiorgioAresu merged commit 658d3fb8de into main 2026-08-29 10:48:06 +02:00

GiorgioAresu deleted branch renovate/ghcr.io-external-secrets-charts-external-secrets-2.x 2026-08-29 10:48:06 +02:00

GiorgioAresu referenced this pull request from a commit 2026-08-29 10:48:07 +02:00

Merge pull request 'feat(container): update ghcr.io/external-secrets/charts/external-secrets ( 2.8.0 ➔ 2.10.0 )' (#2006) from renovate/ghcr.io-external-secrets-charts-external-secrets-2.x into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

area/bootstrap

  

area/ci

  

area/kubernetes

  

bug

Something isn't working

  

documentation

Improvements or additions to documentation

  

duplicate

This issue or pull request already exists

  

enhancement

New feature or request

  

good first issue

Good for newcomers

  

help wanted

Extra attention is needed

  

invalid

This doesn't seem right

  

question

Further information is requested

  

renovate/container

  

renovate/github-action

  

renovate/github-release

  

renovate/grafana-dashboard

  

renovate/helm

  

renovate/terraform

  

type/digest

  

type/major

  

type/minor

  

type/patch

  

wontfix

This will not be worked on

No labels

area/bootstrap

area/ci

area/kubernetes

bug

documentation

duplicate

enhancement

good first issue

help wanted

invalid

question

renovate/container

renovate/github-action

renovate/github-release

renovate/grafana-dashboard

renovate/helm

renovate/terraform

type/digest

type/major

type/minor

type/patch

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

GiorgioAresu/home-ops!2006

No description provided.