Update dependency external-secrets to v2.12.0 by vshn-renovate · Pull Request #15 · projectsyn/component-external-secrets-operator

vshn-renovate · 2026-08-08T12:58:46Z

This PR contains the following updates:

Package	Update	Change
external-secrets	minor	`2.8.0` → `2.12.0`

Release Notes

external-secrets/external-secrets (external-secrets)

`v2.12.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.12.0
Image: ghcr.io/external-secrets/external-secrets:v2.12.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.12.0-ubi-boringssl

What's Changed

General

fix: Revert breaking change to change imageRegistry by @evrardj-roche in #6996
fix: e2e test should not override default vars by @evrardj-roche in #6995
chore: release helm chart for 2.11.0 by @evrardj-roche in #6997
fix: Remove fail from templates by @evrardj-roche in #7019
docs(generators): describe UUID output as lowercase version 4 by @alekc in #7027
fix(akeyless): return esv1.NoSecretErr when a secret does not exist in GetSecret by @wankhede04 in #7013
feat(generators): add prefix and suffix to the Password generator by @alekc in #7028
fix(aws): return esv1.NoSecretErr when a certificate does not exist in Certificate Manager GetSecret by @wankhede04 in #7015
fix: use preinstalled-runtimes to match v2 bump by @evrardj-roche in #7031
chore: update dependencies by @eso-service-account-app[bot] in #7047
fix(pulumi): preserve environment definition on PushSecret by @KR-Ravindra in #6933
docs: set Orphan on ClusterExternalSecret fan-out example by @guanchzhou in #6885
feat(conjur): Cloud Authenticators support by @hdabrowski in #6729
docs: add Vault custom metadata example by @PCDattt in #6982
feat(charts): add rbac.leaderElection.create toggle by @kriszkern in #6950
feat(charts): warn when replicas > 1 without leader election by @anikievev in #7036
fix: Never template strings in errors by @evrardj-roche in #7021
fix: Validate Secret before writing by @evrardj-roche in #7065
chore: Update docs for new release by @evrardj-roche in #7085

Dependencies

chore(deps): bump ubi9/ubi from c5cc9c2 to a4b9ec0 by @dependabot[bot] in #7001
chore(deps): bump docker/setup-buildx-action from 4.3.0 to 4.4.1 by @dependabot[bot] in #7006
chore(deps): bump jlumbroso/free-disk-space from 1.3.1 to 2.0.0 by @dependabot[bot] in #7005
chore(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 by @dependabot[bot] in #7004
chore(deps): bump golang from 648f440 to 69a7b97 in /e2e by @dependabot[bot] in #7044
chore(deps): bump alpine from 3.24.1 to 3.24.2 in /e2e by @dependabot[bot] in #7043
chore(deps): bump alpine from 28bd5fe to 294b683 by @dependabot[bot] in #7042
chore(deps): bump alpine from 28bd5fe to 294b683 in /hack/api-docs by @dependabot[bot] in #7045
chore(deps): bump ubi9/ubi from a4b9ec0 to 7a38d75 by @dependabot[bot] in #7041
chore(deps): bump docker/setup-qemu-action from 4.3.0 to 4.4.0 by @dependabot[bot] in #7003
chore(deps): bump aws-actions/configure-aws-credentials from 6.2.4 to 6.3.0 by @dependabot[bot] in #7002
chore(deps): bump azure/login from 3.0.2 to 3.1.0 by @dependabot[bot] in #6959
chore(deps): bump the codeql group across 1 directory with 3 updates by @dependabot[bot] in #6958
chore(deps): bump distroless/static from f2ea270 to 5813399 by @dependabot[bot] in #6957
chore(deps): bump anchore/sbom-action/download-syft from 0.24.2 to 0.24.3 by @dependabot[bot] in #7080
chore(deps): bump ubi9/ubi from 7a38d75 to 803a35a by @dependabot[bot] in #7079

New Contributors

@wankhede04 made their first contribution in #7013
@KR-Ravindra made their first contribution in #6933
@guanchzhou made their first contribution in #6885
@PCDattt made their first contribution in #6982
@anikievev made their first contribution in #7036

Full Changelog: external-secrets/external-secrets@v2.11.0...v2.12.0

`v2.11.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.11.0
Image: ghcr.io/external-secrets/external-secrets:v2.11.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.11.0-ubi-boringssl

What's Changed

General

chore: release helm chart for 2.10.0 by @Skarlso in #6882
docs: use --hostname all in the Bitwarden webhook example by @ggiesen in #6850
fix(ci): zizmor no-op blocks gates by @evrardj-roche in #6889
feat(barbican): Support OpenStack Barbican authentication via Application Credentials by @JaviMore in #6082
clean: replace k8s.io/utils pointer helpers with the new builtin by @alekc in #6902
feat(webhook): return not supported error for GetAllSecrets by @Abderraoufzekkour in #6817
fix(keepersecurity): return NoSecretErr for missing records by @alliasgher in #6816
fix: doc builds may set different user/group ownership on git repo objects by @evrardj-roche in #6901
fix: Use local GCP import for Vault modules by @evrardj-roche in #6904
fix: guarantee replaces by @evrardj-roche in #6905
chore: bump grpc by @evrardj-roche in #6909
fix: bump Makefile license-eye image to 0.9.0 by @dronenb in #6855
feat(infisical): add option to keep duplicate secret keys by @mathnogueira in #6908
ref: move provider constants by @evrardj-roche in #6883
feat: allow specifying namespace for grafana dashboard ConfigMap by @okwilkins in #6920
fix(keepersecurity): make folderID optional except when creating new records via push by @LGKentang in #6921
docs(templating): remove duplicate a in TemplateFrom Literal note by @mrchatam in #6953
feat(ci): close pull requests that drop a template section by @alekc in #6881
feat(charts): add global.imageRegistry to the external-secrets chart by @alekc in #6983
chore: update skywalking-eyes by @evrardj-roche in #6970
ref: fix Sonarqube linting alerts by @evrardj-roche in #6974
chore: Revert #6908 by @evrardj-roche in #6991
chore: prepare release support matrix by @evrardj-roche in #6993

Dependencies

chore(deps): bump golang from 484ef60 to ded31c6 in /e2e by @dependabot[bot] in #6892
chore(deps): bump ubi9/ubi from 5426a8f to 25a147d by @dependabot[bot] in #6890
chore(deps): bump anchore/sbom-action/download-syft from 0.24.0 to 0.24.2 by @dependabot[bot] in #6895
chore(deps): bump the codeql group across 1 directory with 3 updates by @dependabot[bot] in #6893
chore(deps): bump azure/login from 3.0.1 to 3.0.2 by @dependabot[bot] in #6896
chore(deps): bump golang from 1.27.0-bookworm to 1.27.1-bookworm in /e2e by @dependabot[bot] in #6923
chore(deps): bump aws-actions/configure-aws-credentials from 6.2.3 to 6.2.4 by @dependabot[bot] in #6925
chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 by @dependabot[bot] in #6927
chore(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3 by @dependabot[bot] in #6924
chore(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1 by @dependabot[bot] in #6926
chore(deps): bump helm/kind-action from 1.14.0 to 1.15.0 by @dependabot[bot] in #6928
chore(deps): bump docker/setup-qemu-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #6929
chore(deps): bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 by @dependabot[bot] in #6960
chore(deps): bump ubi9/ubi from 25a147d to c5cc9c2 by @dependabot[bot] in #6956

New Contributors

@ggiesen made their first contribution in #6850
@JaviMore made their first contribution in #6082
@Abderraoufzekkour made their first contribution in #6817
@okwilkins made their first contribution in #6920
@LGKentang made their first contribution in #6921
@mrchatam made their first contribution in #6953

Full Changelog: external-secrets/external-secrets@v2.10.0...v2.11.0

`v2.10.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.10.0
Image: ghcr.io/external-secrets/external-secrets:v2.10.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.10.0-ubi-boringssl

What's Changed

General

chore: release helm chart for 2.9.0 by @Skarlso in #6808
docs: correct the design type in the PR template by @sanchpet in #6813
fix(aws): redact credentials in aws auth config logs by @hixichen in #6683
fix(gcp): preserve workload identity token expiry by @jakobtfr in #6772
feat(conjur): Conjur PushSecret by @aidy in #6272
fix(infisical): scope dataFrom.find.path in list requests by @thc1006 in #6821
chore: bump golangci-lint and fix new linting issues by @evrardj-roche in #6740
feat(openbao): add auth.kubernetes auth method by @Nerkho in #6591
docs: add OpenChoreo to the adopters list by @kavishkafernando in #6820
feat(passbolt): add support for custom fields by @saknopper in #6696
chore: update go version to 1.26.6 by @alekc in #6835
feat(core): report safe reconcile errors in status conditions by @alekc in #6834
fix(secretserver): missing field siteId in secret creation by @pr0ton11 in #6649
fix: Reconcile sha and version by @evrardj-roche in #6843
chore(deps): bump aws acm by @evrardj-roche in #6705
chore(deps): update go-ntlmssp to v0.1.1 by @evrardj-roche in #6701
clean: Get rid of tests importing provider deps by @evrardj-roche in #6846
chore(deps): bump GitLab API client to v1.46.0 by @evrardj-roche in #6700
docs(webhook): escape Go template examples with {% raw %} by @atobaum in #6852
fix(ci): put CODEOWNERS at a path GitHub actually reads by @alekc in #6853
feat(passbolt): PB-53915 - Surface custom field functions in SDK by @cedricherzog-passbolt in #6848
design: Guarantee module import boundaries by @evrardj-roche in #6851
feat(providers): Nebius MysteryBox SA token federation auth option added by @greenmapc in #6784
fix: Unblock CI by @evrardj-roche in #6874
fix(vault): only apply deprecated token-cache flags when explicitly set by @markof88 in #6827
feat: apply TLS security profile to the external-secrets deployment by @siddhibhor-56 in #6617
feat(github): support Dependabot secrets by @SanderKnape in #6878

Dependencies

chore(deps): bump golang from 0178a64 to 0178a64 by @dependabot[bot] in #6818
chore(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 by @dependabot[bot] in #6819
chore(deps): bump setuptools from 83.0.0 to 84.0.0 in /hack/api-docs by @dependabot[bot] in #6826
chore(deps): bump golang from af8d674 to 3889b42 by @dependabot[bot] in #6838
chore(deps): bump step-security/harden-runner from 2.20.1 to 2.21.0 by @dependabot[bot] in #6840
chore(deps): bump the codeql group across 1 directory with 3 updates by @dependabot[bot] in #6839
chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #6867
chore(deps): bump ubi9/ubi from 2a6bd69 to 5426a8f by @dependabot[bot] in #6865
chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #6868
chore(deps): bump golang from 1.26.6-bookworm to 1.27.0-bookworm in /e2e by @dependabot[bot] in #6866
chore(deps): bump golang from 3889b42 to 4c9fe60 by @dependabot[bot] in #6864
chore(deps): bump distroless/static from 9197324 to f2ea270 by @dependabot[bot] in #6863

New Contributors

@sanchpet made their first contribution in #6813
@hixichen made their first contribution in #6683
@jakobtfr made their first contribution in #6772
@aidy made their first contribution in #6272
@thc1006 made their first contribution in #6821
@Nerkho made their first contribution in #6591
@kavishkafernando made their first contribution in #6820
@saknopper made their first contribution in #6696
@atobaum made their first contribution in #6852
@markof88 made their first contribution in #6827
@SanderKnape made their first contribution in #6878

Full Changelog: external-secrets/external-secrets@v2.9.0...v2.10.0

`v2.9.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.9.0
Image: ghcr.io/external-secrets/external-secrets:v2.9.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.9.0-ubi-boringssl

What's Changed

General

chore: release helm chart 2.8.0 by @Skarlso in #6656
fix(conjur): add InstallTimeout to helm chart installation and pin server image version by @alekc in #6658
fix(deps): bump grpc-go for GHSA-hrxh-6v49-42gf by @evrardj-roche in #6695
feat(charts): add opt-in schedulerName and runtimeClassName to the pods by @somaz94 in #6675
fix(webhookconfig): use a constant Eventf format by @evrardj-roche in #6699
fix: bump codeqls together by @evrardj-roche in #6707
fix(security): install crane in a reliable way and fix code scanning issue by @Skarlso in #6712
chore: Fix cve-2026-56852 by bump golang.org/x/text@0.40 by @evrardj-roche in #6734
chore(fix): template abuse for secret values by @Skarlso in #6730
chore: Bump controller runtime by @evrardj-roche in #6703
chore(fix): moved the validation further up the chain by @Skarlso in #6735
fix: pin all dependencies by @evrardj-roche in #6727
feat(e2e): implement fan-out matrix validation and credential scoping by @alekc in #6660
fix(akeyless): use local errors.As target to avoid data race by @HYPERVAPOR in #6749
test(crd): add e2e suite and CI leg for the CRD provider by @alekc in #6742
docs(webhook): add debugging guide and fix stale secret-label claim by @alekc in #6746
test(e2e): skip the global addon uninstall on disposable clusters by @alekc in #6780
feat: add environments support to 1Password SDK by @Skarlso in #6318
fix(akeyless): stop reporting API failures as a missing item by @alekc in #6753
fix(makefile): harden clean worktree check by @evrardj-roche in #6702
fix: support docs builds from worktrees by @evrardj-roche in #6741
feat(cache): add atomic ContainsOrAdd by @evrardj-roche in #6706
fix: omit empty AWS secret replica regions by @goutamadwant in #6596
fix: Follow up PR6318 by @evrardj-roche in #6782
feat: Show sponsoring of Roche by @evrardj-roche in #6790
fix(e2e): make the oracle suite runnable by @alekc in #6770
chore: temporarily allow GHSA-gcjh-h69q-9w9g by @evrardj-roche in #6795
fix(api): stop defaulting optional ExternalSecret strategy fields by @alekc in #6798
chore: remove/cleanup remaining tools from tools.go. by @evrardj-roche in #6786
chore: Cleanup sponsors dead links by @evrardj-roche in #6791
fix(aws): detach replicated regions before deleting AWS SecretsManager secret by @cmoscofian in #6687
chore: fix enable cache being removed on installCRD=false by @Skarlso in #6799

Dependencies

chore(deps): bump golang from 0178a64 to 0178a64 by @dependabot[bot] in #6663
chore(deps): bump mkdocs-material from 9.7.6 to 9.7.7 in /hack/api-docs by @dependabot[bot] in #6669
chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.1 by @dependabot[bot] in #6674
chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 by @dependabot[bot] in #6667
chore(deps): bump fkirc/skip-duplicate-actions from 5.3.1 to 5.3.2 by @dependabot[bot] in #6671
chore(deps): bump actions/stale from 10.3.0 to 10.4.0 by @dependabot[bot] in #6673
chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in #6672
chore(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 6.2.2 by @dependabot[bot] in #6670
chore(deps): bump distroless/static from d5f030c to 9197324 by @dependabot[bot] in #6662
chore(deps): bump ubi9/ubi from 8bf0e8f to 2a6bd69 by @dependabot[bot] in #6661
chore(deps): bump actions/setup-go from 6.0.0 to 7.0.0 by @dependabot[bot] in #6664
chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by @dependabot[bot] in #6665
chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.3 by @dependabot[bot] in #6666
chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #6715
chore(deps): bump aws-actions/configure-aws-credentials from 6.2.2 to 6.2.3 by @dependabot[bot] in #6717
chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bot] in #6722
chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.3 in the codeql group across 1 directory by @dependabot[bot] in #6713
chore(deps): bump google-github-actions/auth from fc21748 to cd3439a by @dependabot[bot] in #6714
chore(deps): bump actions/cache from 4.2.4 to 6.1.0 by @dependabot[bot] in #6716
chore(deps): bump actions/labeler from 6.1.0 to 7.0.0 by @dependabot[bot] in #6718
chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.2.0 by @dependabot[bot] in #6719
chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 by @dependabot[bot] in #6720
chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0 by @dependabot[bot] in #6723
chore(deps): bump docker/login-action from 4.4.0 to 4.5.2 by @dependabot[bot] in #6736
chore(deps): bump actions/stale from 10.4.0 to 11.0.0 by @dependabot[bot] in #6738
chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #6751
chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 by @dependabot[bot] in #6752
chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #6801
chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #6802
chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 by @dependabot[bot] in #6805
chore(deps): bump azure/login from 3.0.0 to 3.0.1 by @dependabot[bot] in #6804
chore(deps): bump google-github-actions/auth from cd3439a to 1206044 by @dependabot[bot] in #6737
chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.1 by @dependabot[bot] in #6803

New Contributors

@HYPERVAPOR made their first contribution in #6749
@goutamadwant made their first contribution in #6596

Full Changelog: external-secrets/external-secrets@v2.8.0...v2.9.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

Signed-off-by: Renovate Bot <tech+renovate@vshn.ch>

vshn-renovate added the dependency label Aug 8, 2026

vshn-renovate force-pushed the commodore-renovate/dependency-external-secrets branch from c5065ef to 6ddcd8d Compare August 28, 2026 13:20

vshn-renovate changed the title ~~Update dependency external-secrets to v2.9.0~~ Update dependency external-secrets to v2.10.0 Aug 28, 2026

vshn-renovate force-pushed the commodore-renovate/dependency-external-secrets branch from 6ddcd8d to aa5229d Compare September 21, 2026 14:20

vshn-renovate changed the title ~~Update dependency external-secrets to v2.10.0~~ Update dependency external-secrets to v2.11.0 Sep 21, 2026

Update dependency external-secrets to v2.12.0

27917a4

Signed-off-by: Renovate Bot <tech+renovate@vshn.ch>

vshn-renovate force-pushed the commodore-renovate/dependency-external-secrets branch from aa5229d to 27917a4 Compare October 6, 2026 12:03

vshn-renovate changed the title ~~Update dependency external-secrets to v2.11.0~~ Update dependency external-secrets to v2.12.0 Oct 6, 2026

Navigation Menu

Repository navigation

Update dependency external-secrets to v2.12.0 - #15

Update dependency external-secrets to v2.12.0#15
vshn-renovate wants to merge 1 commit into
masterfrom
commodore-renovate/dependency-external-secrets

vshn-renovate commented Aug 8, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

vshn-renovate commented Aug 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2.12.0

What's Changed

General

Dependencies

New Contributors

v2.11.0

What's Changed

General

Dependencies

New Contributors

v2.10.0

What's Changed

General

Dependencies

New Contributors

v2.9.0

What's Changed

General

Dependencies

New Contributors

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vshn-renovate commented Aug 8, 2026 •

edited

Loading

`v2.12.0`

`v2.11.0`

`v2.10.0`

`v2.9.0`