feat(helm/external-secrets): update 2.2.0 ➼ 2.12.0 by tinfoild[bot] · Pull Request #5421 · JJGadgets/Biohazard

tinfoild · 2026-04-13T11:34:04Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change	OpenSSF
external-secrets	minor	`2.2.0` → `2.12.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

external-secrets/external-secrets (external-secrets)

`v2.12.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.12.0
Image: ghcr.io/external-secrets/external-secrets:v2.12.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.12.0-ubi-boringssl

What's Changed

General

fix: Revert breaking change to change imageRegistry by @evrardj-roche in #6996
fix: e2e test should not override default vars by @evrardj-roche in #6995
chore: release helm chart for 2.11.0 by @evrardj-roche in #6997
fix: Remove fail from templates by @evrardj-roche in #7019
docs(generators): describe UUID output as lowercase version 4 by @alekc in #7027
fix(akeyless): return esv1.NoSecretErr when a secret does not exist in GetSecret by @wankhede04 in #7013
feat(generators): add prefix and suffix to the Password generator by @alekc in #7028
fix(aws): return esv1.NoSecretErr when a certificate does not exist in Certificate Manager GetSecret by @wankhede04 in #7015
fix: use preinstalled-runtimes to match v2 bump by @evrardj-roche in #7031
chore: update dependencies by @eso-service-account-app[bot] in #7047
fix(pulumi): preserve environment definition on PushSecret by @KR-Ravindra in #6933
docs: set Orphan on ClusterExternalSecret fan-out example by @guanchzhou in #6885
feat(conjur): Cloud Authenticators support by @hdabrowski in #6729
docs: add Vault custom metadata example by @PCDattt in #6982
feat(charts): add rbac.leaderElection.create toggle by @kriszkern in #6950
feat(charts): warn when replicas > 1 without leader election by @anikievev in #7036
fix: Never template strings in errors by @evrardj-roche in #7021
fix: Validate Secret before writing by @evrardj-roche in #7065
chore: Update docs for new release by @evrardj-roche in #7085

Dependencies

chore(deps): bump ubi9/ubi from c5cc9c2 to a4b9ec0 by @dependabot[bot] in #7001
chore(deps): bump docker/setup-buildx-action from 4.3.0 to 4.4.1 by @dependabot[bot] in #7006
chore(deps): bump jlumbroso/free-disk-space from 1.3.1 to 2.0.0 by @dependabot[bot] in #7005
chore(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 by @dependabot[bot] in #7004
chore(deps): bump golang from 648f440 to 69a7b97 in /e2e by @dependabot[bot] in #7044
chore(deps): bump alpine from 3.24.1 to 3.24.2 in /e2e by @dependabot[bot] in #7043
chore(deps): bump alpine from 28bd5fe to 294b683 by @dependabot[bot] in #7042
chore(deps): bump alpine from 28bd5fe to 294b683 in /hack/api-docs by @dependabot[bot] in #7045
chore(deps): bump ubi9/ubi from a4b9ec0 to 7a38d75 by @dependabot[bot] in #7041
chore(deps): bump docker/setup-qemu-action from 4.3.0 to 4.4.0 by @dependabot[bot] in #7003
chore(deps): bump aws-actions/configure-aws-credentials from 6.2.4 to 6.3.0 by @dependabot[bot] in #7002
chore(deps): bump azure/login from 3.0.2 to 3.1.0 by @dependabot[bot] in #6959
chore(deps): bump the codeql group across 1 directory with 3 updates by @dependabot[bot] in #6958
chore(deps): bump distroless/static from f2ea270 to 5813399 by @dependabot[bot] in #6957
chore(deps): bump anchore/sbom-action/download-syft from 0.24.2 to 0.24.3 by @dependabot[bot] in #7080
chore(deps): bump ubi9/ubi from 7a38d75 to 803a35a by @dependabot[bot] in #7079

New Contributors

@wankhede04 made their first contribution in #7013
@KR-Ravindra made their first contribution in #6933
@guanchzhou made their first contribution in #6885
@PCDattt made their first contribution in #6982
@anikievev made their first contribution in #7036

Full Changelog: external-secrets/external-secrets@v2.11.0...v2.12.0

`v2.11.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.11.0
Image: ghcr.io/external-secrets/external-secrets:v2.11.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.11.0-ubi-boringssl

What's Changed

General

chore: release helm chart for 2.10.0 by @Skarlso in #6882
docs: use --hostname all in the Bitwarden webhook example by @ggiesen in #6850
fix(ci): zizmor no-op blocks gates by @evrardj-roche in #6889
feat(barbican): Support OpenStack Barbican authentication via Application Credentials by @JaviMore in #6082
clean: replace k8s.io/utils pointer helpers with the new builtin by @alekc in #6902
feat(webhook): return not supported error for GetAllSecrets by @Abderraoufzekkour in #6817
fix(keepersecurity): return NoSecretErr for missing records by @alliasgher in #6816
fix: doc builds may set different user/group ownership on git repo objects by @evrardj-roche in #6901
fix: Use local GCP import for Vault modules by @evrardj-roche in #6904
fix: guarantee replaces by @evrardj-roche in #6905
chore: bump grpc by @evrardj-roche in #6909
fix: bump Makefile license-eye image to 0.9.0 by @dronenb in #6855
feat(infisical): add option to keep duplicate secret keys by @mathnogueira in #6908
ref: move provider constants by @evrardj-roche in #6883
feat: allow specifying namespace for grafana dashboard ConfigMap by @okwilkins in #6920
fix(keepersecurity): make folderID optional except when creating new records via push by @LGKentang in #6921
docs(templating): remove duplicate a in TemplateFrom Literal note by @mrchatam in #6953
feat(ci): close pull requests that drop a template section by @alekc in #6881
feat(charts): add global.imageRegistry to the external-secrets chart by @alekc in #6983
chore: update skywalking-eyes by @evrardj-roche in #6970
ref: fix Sonarqube linting alerts by @evrardj-roche in #6974
chore: Revert #6908 by @evrardj-roche in #6991
chore: prepare release support matrix by @evrardj-roche in #6993

Dependencies

chore(deps): bump golang from 484ef60 to ded31c6 in /e2e by @dependabot[bot] in #6892
chore(deps): bump ubi9/ubi from 5426a8f to 25a147d by @dependabot[bot] in #6890
chore(deps): bump anchore/sbom-action/download-syft from 0.24.0 to 0.24.2 by @dependabot[bot] in #6895
chore(deps): bump the codeql group across 1 directory with 3 updates by @dependabot[bot] in #6893
chore(deps): bump azure/login from 3.0.1 to 3.0.2 by @dependabot[bot] in #6896
chore(deps): bump golang from 1.27.0-bookworm to 1.27.1-bookworm in /e2e by @dependabot[bot] in #6923
chore(deps): bump aws-actions/configure-aws-credentials from 6.2.3 to 6.2.4 by @dependabot[bot] in #6925
chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 by @dependabot[bot] in #6927
chore(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3 by @dependabot[bot] in #6924
chore(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1 by @dependabot[bot] in #6926
chore(deps): bump helm/kind-action from 1.14.0 to 1.15.0 by @dependabot[bot] in #6928
chore(deps): bump docker/setup-qemu-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #6929
chore(deps): bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 by @dependabot[bot] in #6960
chore(deps): bump ubi9/ubi from 25a147d to c5cc9c2 by @dependabot[bot] in #6956

New Contributors

@ggiesen made their first contribution in #6850
@JaviMore made their first contribution in #6082
@Abderraoufzekkour made their first contribution in #6817
@okwilkins made their first contribution in #6920
@LGKentang made their first contribution in #6921
@mrchatam made their first contribution in #6953

Full Changelog: external-secrets/external-secrets@v2.10.0...v2.11.0

`v2.10.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.10.0
Image: ghcr.io/external-secrets/external-secrets:v2.10.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.10.0-ubi-boringssl

What's Changed

General

chore: release helm chart for 2.9.0 by @Skarlso in #6808
docs: correct the design type in the PR template by @sanchpet in #6813
fix(aws): redact credentials in aws auth config logs by @hixichen in #6683
fix(gcp): preserve workload identity token expiry by @jakobtfr in #6772
feat(conjur): Conjur PushSecret by @aidy in #6272
fix(infisical): scope dataFrom.find.path in list requests by @thc1006 in #6821
chore: bump golangci-lint and fix new linting issues by @evrardj-roche in #6740
feat(openbao): add auth.kubernetes auth method by @Nerkho in #6591
docs: add OpenChoreo to the adopters list by @kavishkafernando in #6820
feat(passbolt): add support for custom fields by @saknopper in #6696
chore: update go version to 1.26.6 by @alekc in #6835
feat(core): report safe reconcile errors in status conditions by @alekc in #6834
fix(secretserver): missing field siteId in secret creation by @pr0ton11 in #6649
fix: Reconcile sha and version by @evrardj-roche in #6843
chore(deps): bump aws acm by @evrardj-roche in #6705
chore(deps): update go-ntlmssp to v0.1.1 by @evrardj-roche in #6701
clean: Get rid of tests importing provider deps by @evrardj-roche in #6846
chore(deps): bump GitLab API client to v1.46.0 by @evrardj-roche in #6700
docs(webhook): escape Go template examples with {% raw %} by @atobaum in #6852
fix(ci): put CODEOWNERS at a path GitHub actually reads by @alekc in #6853
feat(passbolt): PB-53915 - Surface custom field functions in SDK by @cedricherzog-passbolt in #6848
design: Guarantee module import boundaries by @evrardj-roche in #6851
feat(providers): Nebius MysteryBox SA token federation auth option added by @greenmapc in #6784
fix: Unblock CI by @evrardj-roche in #6874
fix(vault): only apply deprecated token-cache flags when explicitly set by @markof88 in #6827
feat: apply TLS security profile to the external-secrets deployment by @siddhibhor-56 in #6617
feat(github): support Dependabot secrets by @SanderKnape in #6878

Dependencies

chore(deps): bump golang from 0178a64 to 0178a64 by @dependabot[bot] in #6818
chore(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 by @dependabot[bot] in #6819
chore(deps): bump setuptools from 83.0.0 to 84.0.0 in /hack/api-docs by @dependabot[bot] in #6826
chore(deps): bump golang from af8d674 to 3889b42 by @dependabot[bot] in #6838
chore(deps): bump step-security/harden-runner from 2.20.1 to 2.21.0 by @dependabot[bot] in #6840
chore(deps): bump the codeql group across 1 directory with 3 updates by @dependabot[bot] in #6839
chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #6867
chore(deps): bump ubi9/ubi from 2a6bd69 to 5426a8f by @dependabot[bot] in #6865
chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #6868
chore(deps): bump golang from 1.26.6-bookworm to 1.27.0-bookworm in /e2e by @dependabot[bot] in #6866
chore(deps): bump golang from 3889b42 to 4c9fe60 by @dependabot[bot] in #6864
chore(deps): bump distroless/static from 9197324 to f2ea270 by @dependabot[bot] in #6863

New Contributors

@sanchpet made their first contribution in #6813
@hixichen made their first contribution in #6683
@jakobtfr made their first contribution in #6772
@aidy made their first contribution in #6272
@thc1006 made their first contribution in #6821
@Nerkho made their first contribution in #6591
@kavishkafernando made their first contribution in #6820
@saknopper made their first contribution in #6696
@atobaum made their first contribution in #6852
@markof88 made their first contribution in #6827
@SanderKnape made their first contribution in #6878

Full Changelog: external-secrets/external-secrets@v2.9.0...v2.10.0

`v2.9.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.9.0
Image: ghcr.io/external-secrets/external-secrets:v2.9.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.9.0-ubi-boringssl

What's Changed

General

chore: release helm chart 2.8.0 by @Skarlso in #6656
fix(conjur): add InstallTimeout to helm chart installation and pin server image version by @alekc in #6658
fix(deps): bump grpc-go for GHSA-hrxh-6v49-42gf by @evrardj-roche in #6695
feat(charts): add opt-in schedulerName and runtimeClassName to the pods by @somaz94 in #6675
fix(webhookconfig): use a constant Eventf format by @evrardj-roche in #6699
fix: bump codeqls together by @evrardj-roche in #6707
fix(security): install crane in a reliable way and fix code scanning issue by @Skarlso in #6712
chore: Fix cve-2026-56852 by bump golang.org/x/text@0.40 by @evrardj-roche in #6734
chore(fix): template abuse for secret values by @Skarlso in #6730
chore: Bump controller runtime by @evrardj-roche in #6703
chore(fix): moved the validation further up the chain by @Skarlso in #6735
fix: pin all dependencies by @evrardj-roche in #6727
feat(e2e): implement fan-out matrix validation and credential scoping by @alekc in #6660
fix(akeyless): use local errors.As target to avoid data race by @HYPERVAPOR in #6749
test(crd): add e2e suite and CI leg for the CRD provider by @alekc in #6742
docs(webhook): add debugging guide and fix stale secret-label claim by @alekc in #6746
test(e2e): skip the global addon uninstall on disposable clusters by @alekc in #6780
feat: add environments support to 1Password SDK by @Skarlso in #6318
fix(akeyless): stop reporting API failures as a missing item by @alekc in #6753
fix(makefile): harden clean worktree check by @evrardj-roche in #6702
fix: support docs builds from worktrees by @evrardj-roche in #6741
feat(cache): add atomic ContainsOrAdd by @evrardj-roche in #6706
fix: omit empty AWS secret replica regions by @goutamadwant in #6596
fix: Follow up PR6318 by @evrardj-roche in #6782
feat: Show sponsoring of Roche by @evrardj-roche in #6790
fix(e2e): make the oracle suite runnable by @alekc in #6770
chore: temporarily allow GHSA-gcjh-h69q-9w9g by @evrardj-roche in #6795
fix(api): stop defaulting optional ExternalSecret strategy fields by @alekc in #6798
chore: remove/cleanup remaining tools from tools.go. by @evrardj-roche in #6786
chore: Cleanup sponsors dead links by @evrardj-roche in #6791
fix(aws): detach replicated regions before deleting AWS SecretsManager secret by @cmoscofian in #6687
chore: fix enable cache being removed on installCRD=false by @Skarlso in #6799

Dependencies

chore(deps): bump golang from 0178a64 to 0178a64 by @dependabot[bot] in #6663
chore(deps): bump mkdocs-material from 9.7.6 to 9.7.7 in /hack/api-docs by @dependabot[bot] in #6669
chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.1 by @dependabot[bot] in #6674
chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 by @dependabot[bot] in #6667
chore(deps): bump fkirc/skip-duplicate-actions from 5.3.1 to 5.3.2 by @dependabot[bot] in #6671
chore(deps): bump actions/stale from 10.3.0 to 10.4.0 by @dependabot[bot] in #6673
chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in #6672
chore(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 6.2.2 by @dependabot[bot] in #6670
chore(deps): bump distroless/static from d5f030c to 9197324 by @dependabot[bot] in #6662
chore(deps): bump ubi9/ubi from 8bf0e8f to 2a6bd69 by @dependabot[bot] in #6661
chore(deps): bump actions/setup-go from 6.0.0 to 7.0.0 by @dependabot[bot] in #6664
chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by @dependabot[bot] in #6665
chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.3 by @dependabot[bot] in #6666
chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #6715
chore(deps): bump aws-actions/configure-aws-credentials from 6.2.2 to 6.2.3 by @dependabot[bot] in #6717
chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bot] in #6722
chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.3 in the codeql group across 1 directory by @dependabot[bot] in #6713
chore(deps): bump google-github-actions/auth from fc21748 to cd3439a by @dependabot[bot] in #6714
chore(deps): bump actions/cache from 4.2.4 to 6.1.0 by @dependabot[bot] in #6716
chore(deps): bump actions/labeler from 6.1.0 to 7.0.0 by @dependabot[bot] in #6718
chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.2.0 by @dependabot[bot] in #6719
chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 by @dependabot[bot] in #6720
chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0 by @dependabot[bot] in #6723
chore(deps): bump docker/login-action from 4.4.0 to 4.5.2 by @dependabot[bot] in #6736
chore(deps): bump actions/stale from 10.4.0 to 11.0.0 by @dependabot[bot] in #6738
chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #6751
chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 by @dependabot[bot] in #6752
chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #6801
chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #6802
chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 by @dependabot[bot] in #6805
chore(deps): bump azure/login from 3.0.0 to 3.0.1 by @dependabot[bot] in #6804
chore(deps): bump google-github-actions/auth from cd3439a to 1206044 by @dependabot[bot] in #6737
chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.1 by @dependabot[bot] in #6803

New Contributors

@HYPERVAPOR made their first contribution in #6749
@goutamadwant made their first contribution in #6596

Full Changelog: external-secrets/external-secrets@v2.8.0...v2.9.0

`v2.8.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.8.0
Image: ghcr.io/external-secrets/external-secrets:v2.8.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.8.0-ubi-boringssl

What's Changed

General

chore: release helm chart 2.7.0 by @Skarlso in #6529
docs(barbican): correct find semantics and document property/extract by @alekc in #6531
docs(gcp): use external-secrets.io/v1 in SecretStore examples by @alekc in #6563
feat(generators): add GitLab deploy token generator by @alekc in #6493
fix(barbican): validate store config and fix SecretExists error message by @alekc in #6534
docs(beyondtrust): fix capability matrix and document decrypt/separator by @alekc in #6535
feat: Make SecondsToLive optional for Grafana generator by @jaruwat-panturat in #6479
docs: add missing generators to ClusterGenerator spec snippet by @jaruwat-panturat in #6590
docs(doppler): fix download format list and heading levels by @alekc in #6559
docs(fortanix): add to support matrix and tidy provider page by @alekc in #6562
docs(yandex): fix Lockbox referent cell and add Certificate Manager rows by @alekc in #6585
docs(volcengine): mark referent authentication as supported by @alekc in #6584
docs(senhasegura): mark deletion + referent in matrix and fix title by @alekc in #6583
docs(scaleway): mark referent auth in matrix and fix headings by @alekc in #6581
docs(pulumi): correct find/referent matrix cells and fix headings by @alekc in #6578
docs(previder): correct find/referent matrix cells and fix headings by @alekc in #6577
docs(1password): mark SDK find support in matrix and promote titles by @alekc in #6568
feat(charts): Add aggregateToAdmin toggle by @illrill in #6586
docs(providers): consolidate 11 conflicting provider-doc PRs by @alekc in #6592
feat(charts): add startupProbe support to webhook deployment by @alpcanaydin in #6612
feat(akeyless): support azure_ad Workload Identity via serviceAccountRef by @baraka-akeyless in #6530
docs(kubernetes): fix invalid tab indentation and heading levels by @alekc in #6565
docs(dvls): mark DeletionPolicy supported and fix page title by @alekc in #6557
docs(bitwarden): fix find behaviour, find-by-name rules, and admonitions by @alekc in #6551
docs(github): add to support matrix, fix auth field, tidy page by @alekc in #6564
docs: Improve explanations of pem_chain by @evrardjp in #6623
feat: Make our stance regarding AI usage more explicit. by @evrardj-roche in #6621
fix(barbican): treat find.name.regexp as a regexp, not an exact match by @arpitjain099 in #6614
chore: update go version 1.26.5 - Fix CVE-2026-39822 by @alekc in #6631
ref(testing): change the e2e workflow to separate building stage from e2e stage (and free up resources) by @alekc in #6634
chore: updating ok-to-test to allow interim maintainers by @gusfcarvalho in #6638
fix(onepassword): support PushSecret IfNotExists by @civilizedBaboon in #6646
fix(testing): check out PR head in fork e2e instead of main by @alekc in #6647
fix(secretserver): validate store and map fields correctly by @dbinger in #6616
feat(charts): Add optional networkPolicy by @jcpunk in #5779
feat(akeyless): add SecretStore ignoreCache to bypass Gateway cache by @baraka-akeyless in #6507
feat(provider): implement AWS Certificate Manager provider by @dsp0x4 in #6117
feat: expose more values for custom metadata for vault v2 by @Skarlso in #6652
clean: Remove duplicate code by @evrardj-roche in #6629
feat: configurable leader election lease timings by @izz-linux in #6644
fix(akeyless): support dataFrom.extract.property for nested JSON by @baraka-akeyless in #6633
feat(conjur): Certificate Auth support by @hdabrowski in #6393
docs(aws): restore dropped access section and document missing fields by @alekc in #6517
feat(secretserver): support authentication via access token by @sumanpal97 in #6597
docs(secretserver): document authentication, key formats, property behavior, and limitations by @dbinger in #6619
feat(release): Support reading values from kubernetes CRD by @alekc in #6211
clean: Standardize and friendly name for validations policies by @evrardj-roche in #6630
feat: add CreateOrMerge creation policy for ExternalSecrets by @alekc in #6641
feat(core): accept duration string for SecretStore refreshInterval by [@alekc](htt

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Singapore)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

cloudflare-workers-and-pages · 2026-04-13T11:35:09Z

Deploying jjgadgets-biohazard with Cloudflare Pages

Latest commit:	`73d4792`
Status:	🚫 Build failed.

View logs

tinfoild · 2026-04-13T11:35:46Z

kube/helmrelease/out00

--- HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-cert-controller

+++ HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-cert-controller

@@ -13,12 +13,21 @@

   resources:
   - customresourcedefinitions
   verbs:
   - get
   - list
   - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  resourceNames:
+  - externalsecrets.external-secrets.io
+  - secretstores.external-secrets.io
+  - clustersecretstores.external-secrets.io
+  verbs:
   - update
   - patch
 - apiGroups:
   - admissionregistration.k8s.io
   resources:
   - validatingwebhookconfigurations
@@ -64,12 +73,19 @@

   resources:
   - secrets
   verbs:
   - get
   - list
   - watch
+- apiGroups:
+  - ''
+  resources:
+  - secrets
+  resourceNames:
+  - external-secrets-webhook
+  verbs:
   - update
   - patch
 - apiGroups:
   - coordination.k8s.io
   resources:
   - leases
--- HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-controller

+++ HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-controller

@@ -66,21 +66,23 @@

   - cloudsmithaccesstokens
   - clustergenerators
   - ecrauthorizationtokens
   - fakes
   - gcraccesstokens
   - githubaccesstokens
+  - gitlabdeploytokens
   - quayaccesstokens
   - passwords
   - sshkeys
   - stssessiontokens
   - uuids
   - vaultdynamicsecrets
   - webhooks
   - grafanas
   - mfas
+  - beyondtrustworkloadcredentialsdynamicsecrets
   verbs:
   - get
   - list
   - watch
 - apiGroups:
   - ''
--- HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-view

+++ HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-view

@@ -24,18 +24,20 @@

   - watch
   - list
 - apiGroups:
   - generators.external-secrets.io
   resources:
   - acraccesstokens
+  - beyondtrustworkloadcredentialsdynamicsecrets
   - cloudsmithaccesstokens
   - clustergenerators
   - ecrauthorizationtokens
   - fakes
   - gcraccesstokens
   - githubaccesstokens
+  - gitlabdeploytokens
   - quayaccesstokens
   - passwords
   - sshkeys
   - vaultdynamicsecrets
   - webhooks
   - grafanas
--- HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-edit

+++ HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-edit

@@ -31,20 +31,22 @@

   - cloudsmithaccesstokens
   - clustergenerators
   - ecrauthorizationtokens
   - fakes
   - gcraccesstokens
   - githubaccesstokens
+  - gitlabdeploytokens
   - quayaccesstokens
   - passwords
   - sshkeys
   - vaultdynamicsecrets
   - webhooks
   - grafanas
   - generatorstates
   - mfas
+  - beyondtrustworkloadcredentialsdynamicsecrets
   - uuids
   verbs:
   - create
   - delete
   - deletecollection
   - patch
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-cert-controller

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-cert-controller

@@ -36,13 +36,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v2.2.0
+        image: ghcr.io/external-secrets/external-secrets:v2.12.0
         imagePullPolicy: IfNotPresent
         args:
         - certcontroller
         - --crd-requeue-interval=5m
         - --service-name=external-secrets-webhook
         - --service-namespace=external-secrets
@@ -64,12 +64,15 @@

         readinessProbe:
           httpGet:
             port: ready
             path: /readyz
           initialDelaySeconds: 20
           periodSeconds: 5
+          timeoutSeconds: 5
+          failureThreshold: 3
+          successThreshold: 1
         resources:
           limits:
             cpu: '1'
             memory: 200Mi
           requests:
             cpu: 2m
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets

@@ -40,13 +40,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v2.2.0
+        image: ghcr.io/external-secrets/external-secrets:v2.12.0
         imagePullPolicy: IfNotPresent
         args:
         - --enable-leader-election=true
         - --concurrent=1
         - --metrics-addr=:8080
         - --loglevel=info
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-webhook

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-webhook

@@ -36,13 +36,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v2.2.0
+        image: ghcr.io/external-secrets/external-secrets:v2.12.0
         imagePullPolicy: IfNotPresent
         args:
         - webhook
         - --port=10250
         - --dns-name=external-secrets-webhook.external-secrets.svc
         - --cert-dir=/tmp/certs
@@ -64,12 +64,15 @@

         readinessProbe:
           httpGet:
             port: ready
             path: /readyz
           initialDelaySeconds: 20
           periodSeconds: 5
+          timeoutSeconds: 5
+          failureThreshold: 3
+          successThreshold: 1
         resources:
           limits:
             cpu: '1'
             memory: 200Mi
           requests:
             cpu: 2m
--- HelmRelease: external-secrets/external-secrets ValidatingWebhookConfiguration: external-secrets/secretstore-validate

+++ HelmRelease: external-secrets/external-secrets ValidatingWebhookConfiguration: external-secrets/secretstore-validate

@@ -53,7 +53,8 @@

       path: /validate-external-secrets-io-v1-clustersecretstore
   admissionReviewVersions:
   - v1
   - v1beta1
   sideEffects: None
   timeoutSeconds: 5
+  failurePolicy: Fail

tinfoild · 2026-04-13T11:35:46Z

kube/helmrelease/out00

--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-cert-controller

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-cert-controller

@@ -36,13 +36,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v2.2.0
+        image: ghcr.io/external-secrets/external-secrets:v2.3.0
         imagePullPolicy: IfNotPresent
         args:
         - certcontroller
         - --crd-requeue-interval=5m
         - --service-name=external-secrets-webhook
         - --service-namespace=external-secrets
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets

@@ -40,13 +40,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v2.2.0
+        image: ghcr.io/external-secrets/external-secrets:v2.3.0
         imagePullPolicy: IfNotPresent
         args:
         - --enable-leader-election=true
         - --concurrent=1
         - --metrics-addr=:8080
         - --loglevel=info
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-webhook

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-webhook

@@ -36,13 +36,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v2.2.0
+        image: ghcr.io/external-secrets/external-secrets:v2.3.0
         imagePullPolicy: IfNotPresent
         args:
         - webhook
         - --port=10250
         - --dns-name=external-secrets-webhook.external-secrets.svc
         - --cert-dir=/tmp/certs

tinfoild · 2026-04-24T19:31:48Z

kube/kustomization/out00

--- kube/deploy/core/secrets/external-secrets/app Kustomization: flux-system/1-core-secrets-external-secrets-app HelmRelease: external-secrets/external-secrets

+++ kube/deploy/core/secrets/external-secrets/app Kustomization: flux-system/1-core-secrets-external-secrets-app HelmRelease: external-secrets/external-secrets

@@ -13,13 +13,13 @@

     spec:
       chart: external-secrets
       sourceRef:
         kind: HelmRepository
         name: external-secrets
         namespace: flux-system
-      version: 2.2.0
+      version: 2.11.0
   driftDetection:
     ignore:
     - paths:
       - /spec/replicas
     mode: warn
   install:

ciel-shieru · 2026-07-24T00:48:03Z

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-24 10:01 SGT
🤖 Scanner: Ciel Security Scanner
🔗 PR: #5421 — feat(helm/external-secrets): update 2.2.0 ➼ 2.8.0
📦 Packages checked: 1
🔍 Sources: NVD, OSV.dev, GHSA, GHSL, CISA KEV, FortiGuard, CVE.org, Changelog
⚠️ Vulnerabilities found: 2

Severity Summary

Severity	Count
CRITICAL	0
HIGH	1
MEDIUM / MODERATE	1
LOW	0
UNKNOWN / NEEDS VERIFICATION	0
Total	2

Results

Package: external-secrets

Ecosystem: Docker / Helm (Go module: github.com/external-secrets/external-secrets)
Old version: 2.2.0 — VULNERABLE (2 CVEs)
New version: 2.8.0 — CLEAN

Vulnerabilities in version 2.2.0

CVE-2026-34984 / GHSA-r2pg-r6h7-crf3 — Severity: HIGH (CVSS 6.5)
- Description: DNS-based secret exfiltration via getHostByName in v2 template engine.
- Affected versions: >= 2.0.0, <= 2.2.0
- Fixed in: 2.3.0
- Sources: NVD, GHSA, OSV
- Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-34984 | GHSA-r2pg-r6h7-crf3
- Status: ✅ Fixed in newer versions
CVE-2026-42875 / GHSA-wv26-88m5-6h59 — Severity: MEDIUM
- Description: Namespace isolation bypass in CAProvider ConfigMap resolution for SecretStore.
- Affected versions: < 2.4.0
- Fixed in: 2.4.0
- Sources: NVD, GHSA, OSV
- Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-42875 | GHSA-wv26-88m5-6h59
- Status: ✅ Fixed in newer versions

Vulnerabilities in version 2.8.0

No known vulnerabilities found.

Non-applicable findings (verified and excluded)

Finding	Severity	Reason not applicable
CVE-2024-36540	CRITICAL	Affects v0.9.16 only; both versions are much later
CVE-2024-45041	HIGH	Fixed in 0.10.2; both versions are much later
CVE-2026-22822	HIGH	Affects < 1.2.0; both versions >= 2.x
+N more	—	All patched in versions before 2.0.0

Changelog Security Highlights (2.2.0 → 2.8.0)

v2.3.0 — Security fix for DNS-based secret exfiltration (CVE-2026-34984 / GHSA-r2pg-r6h7-crf3)
v2.4.0 — Namespace isolation bypass fix (CVE-2026-42875 / GHSA-wv26-88m5-6h59)
v2.8.0 — Go 1.26.5 bump to fix CVE-2026-39822; dependency security updates

Recommendations

MERGE PRIORITY: HIGH — The old version (2.2.0) has 1 HIGH-severity vulnerability (CVE-2026-34984) and 1 MEDIUM-severity vulnerability (CVE-2026-42875), both remediated in 2.8.0. No new vulnerabilities introduced.
Review backward compatibility and API changes between 2.2.0 and 2.8.0 before merging.
Merge this PR promptly to remediate the exposed vulnerabilities.

⚠️ This comment was posted by an automated security scanner (Ciel).
To re-scan, trigger the renovate-security-scanner skill.

tinfoild Bot added kube/deploy/core renovate/datasource/helm renovate/type/minor labels Apr 13, 2026

tinfoild Bot force-pushed the renovate/external-secrets-2.x branch from 31264a7 to 2aeefdc Compare April 24, 2026 19:30

tinfoild Bot changed the title ~~feat(helm/external-secrets): update 2.2.0 ➼ 2.3.0~~ feat(helm/external-secrets): update 2.2.0 ➼ 2.4.0 Apr 24, 2026

tinfoild Bot force-pushed the renovate/external-secrets-2.x branch 2 times, most recently from 29df47e to ae15e26 Compare April 28, 2026 11:38

tinfoild Bot changed the title ~~feat(helm/external-secrets): update 2.2.0 ➼ 2.4.0~~ feat(helm/external-secrets): update 2.2.0 ➼ 2.4.1 Apr 28, 2026

tinfoild Bot force-pushed the renovate/external-secrets-2.x branch from ae15e26 to f109a62 Compare May 15, 2026 13:39

tinfoild Bot changed the title ~~feat(helm/external-secrets): update 2.2.0 ➼ 2.4.1~~ feat(helm/external-secrets): update 2.2.0 ➼ 2.5.0 May 15, 2026

tinfoild Bot force-pushed the renovate/external-secrets-2.x branch from f109a62 to f64da2f Compare May 15, 2026 18:39

tinfoild Bot force-pushed the renovate/external-secrets-2.x branch from f64da2f to 6fc57ae Compare June 7, 2026 07:35

tinfoild Bot changed the title ~~feat(helm/external-secrets): update 2.2.0 ➼ 2.5.0~~ feat(helm/external-secrets): update 2.2.0 ➼ 2.6.0 Jun 7, 2026

tinfoild Bot force-pushed the renovate/external-secrets-2.x branch from 6fc57ae to 5a5bbb6 Compare June 8, 2026 20:58

tinfoild Bot force-pushed the renovate/external-secrets-2.x branch from 5a5bbb6 to 406eea3 Compare June 19, 2026 12:31

tinfoild Bot force-pushed the renovate/external-secrets-2.x branch from 406eea3 to fc23c1a Compare June 26, 2026 13:51

tinfoild Bot changed the title ~~feat(helm/external-secrets): update 2.2.0 ➼ 2.6.0~~ feat(helm/external-secrets): update 2.2.0 ➼ 2.7.0 Jun 26, 2026

tinfoild Bot force-pushed the renovate/external-secrets-2.x branch from fc23c1a to f83618b Compare July 18, 2026 16:59

tinfoild Bot changed the title ~~feat(helm/external-secrets): update 2.2.0 ➼ 2.7.0~~ feat(helm/external-secrets): update 2.2.0 ➼ 2.8.0 Jul 18, 2026

tinfoild Bot force-pushed the renovate/external-secrets-2.x branch from f83618b to 30aff1b Compare July 20, 2026 10:11

tinfoild Bot force-pushed the renovate/external-secrets-2.x branch from 30aff1b to e6d10ee Compare August 8, 2026 13:47

tinfoild Bot changed the title ~~feat(helm/external-secrets): update 2.2.0 ➼ 2.8.0~~ feat(helm/external-secrets): update 2.2.0 ➼ 2.9.0 Aug 8, 2026

tinfoild Bot force-pushed the renovate/external-secrets-2.x branch from e6d10ee to aef3ef8 Compare August 28, 2026 21:15

tinfoild Bot changed the title ~~feat(helm/external-secrets): update 2.2.0 ➼ 2.9.0~~ feat(helm/external-secrets): update 2.2.0 ➼ 2.10.0 Aug 28, 2026

tinfoild Bot force-pushed the renovate/external-secrets-2.x branch from aef3ef8 to da3b8ef Compare September 21, 2026 14:31

tinfoild Bot changed the title ~~feat(helm/external-secrets): update 2.2.0 ➼ 2.10.0~~ feat(helm/external-secrets): update 2.2.0 ➼ 2.11.0 Sep 21, 2026

feat(helm/external-secrets): update 2.2.0 ➼ 2.12.0

73d4792

tinfoild Bot force-pushed the renovate/external-secrets-2.x branch from da3b8ef to 73d4792 Compare October 6, 2026 17:29

tinfoild Bot changed the title ~~feat(helm/external-secrets): update 2.2.0 ➼ 2.11.0~~ feat(helm/external-secrets): update 2.2.0 ➼ 2.12.0 Oct 6, 2026

Navigation Menu

Repository navigation

feat(helm/external-secrets): update 2.2.0 ➼ 2.12.0 - #5421

feat(helm/external-secrets): update 2.2.0 ➼ 2.12.0#5421
tinfoild[bot] wants to merge 1 commit into
mainfrom
renovate/external-secrets-2.x

tinfoild Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

tinfoild Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

tinfoild Bot commented Apr 13, 2026

Uh oh!

tinfoild Bot commented Apr 24, 2026 •

edited

Loading

Uh oh!

ciel-shieru commented Jul 24, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

tinfoild Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2.12.0

What's Changed

General

Dependencies

New Contributors

v2.11.0

What's Changed

General

Dependencies

New Contributors

v2.10.0

What's Changed

General

Dependencies

New Contributors

v2.9.0

What's Changed

General

Dependencies

New Contributors

v2.8.0

What's Changed

General

Configuration

Uh oh!

cloudflare-workers-and-pages Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying jjgadgets-biohazard with Cloudflare Pages

Uh oh!

tinfoild Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

kube/helmrelease/out00

Uh oh!

tinfoild Bot commented Apr 13, 2026

kube/helmrelease/out00

Uh oh!

tinfoild Bot commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

kube/kustomization/out00

Uh oh!

ciel-shieru commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Severity Summary

Results

Package: external-secrets

Vulnerabilities in version 2.2.0

Vulnerabilities in version 2.8.0

Non-applicable findings (verified and excluded)

Changelog Security Highlights (2.2.0 → 2.8.0)

Recommendations

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

tinfoild Bot commented Apr 13, 2026 •

edited

Loading

`v2.12.0`

`v2.11.0`

`v2.10.0`

`v2.9.0`

`v2.8.0`

cloudflare-workers-and-pages Bot commented Apr 13, 2026 •

edited

Loading

tinfoild Bot commented Apr 13, 2026 •

edited

Loading

tinfoild Bot commented Apr 24, 2026 •

edited

Loading

ciel-shieru commented Jul 24, 2026 •

edited

Loading