feat(helm/external-dns): update 1.20.0 ➼ 1.23.0

[tinfoild]

This PR contains the following updates:

Package	Update	Change	OpenSSF
external-dns	minor	1.20.0 → 1.23.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone Asia/Singapore)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[cloudflare-workers-and-pages]

Deploying jjgadgets-biohazard with    Cloudflare Pages

Latest commit:	641c41d
Status:	🚫  Build failed.

View logs

[tinfoild]

kube/kustomization/out00

--- kube/deploy/core/dns/external-dns/app Kustomization: flux-system/1-core-dns-external-dns-app HelmRelease: external-dns/external-dns

+++ kube/deploy/core/dns/external-dns/app Kustomization: flux-system/1-core-dns-external-dns-app HelmRelease: external-dns/external-dns

@@ -12,13 +12,13 @@

     spec:
       chart: external-dns
       sourceRef:
         kind: HelmRepository
         name: external-dns
         namespace: flux-system
-      version: 1.20.0
+      version: 1.21.1
   driftDetection:
     ignore:
     - paths:
       - /spec/replicas
     mode: warn
   install:

[ciel-shieru]

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-24 05:44 UTC
🤖 Scanner: Ciel Security Scanner
🔗 PR: #5658 — feat(helm/external-dns): update 1.20.0 ➼ 1.21.1
📦 Packages checked: 1
🔍 Sources: NVD, OSV.dev, GHSA, GHSL, CISA KEV, FortiGuard, CVE.org, Changelog
⚠️ Vulnerabilities found: 2

---

Severity Summary

Severity	Count
CRITICAL	0
HIGH	0
MEDIUM / MODERATE	0
LOW	2
UNKNOWN / NEEDS VERIFICATION	0
Total	2

---

Results

Package: external-dns

• Ecosystem: Helm (ships ExternalDNS Go binary v0.20.0 → v0.21.0)
• Old version: 1.20.0 — LOW (2 Go toolchain CVEs)
• New version: 1.21.1 — CLEAN

Vulnerabilities in version 1.20.0

1. CVE-2025-61729 — Severity: LOW

   • Description: HostnameError.Error() quadratic string concatenation in Go crypto/x509 leads to excessive resource consumption.
   • Affected versions: Go < 1.25.7
   • Fixed in: Go 1.25.7
   • Sources: NVD, Changelog
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2025-61729
   • Status: ✅ Fixed in newer versions

2. CVE-2025-61727 — Severity: LOW

   • Description: Certificate chain excluded subdomain constraint does not restrict wildcard SAN usage in Go crypto/x509.
   • Affected versions: Go < 1.25.7
   • Fixed in: Go 1.25.7
   • Sources: NVD, Changelog
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2025-61727
   • Status: ✅ Fixed in newer versions

Vulnerabilities in version 1.21.1

No known vulnerabilities found.

Changelog Security Highlights (1.20.0 → 1.21.1)

• v0.21.0 — Go upgraded to 1.26.1; Go dep bumps from 1.25.5→1.25.7→1.25.8 for CVE fixes
• v0.21.0 — Endpoint AES-GCM encryption hardened; sensitive data removed from logs
• v0.21.0 — Multiple dependency security updates (golang.org/x/crypto, google.golang.org/grpc)
• v1.21.1 — Chart update bundles ExternalDNS v0.21.0 with all above fixes

---

Recommendations

• MERGE PRIORITY: LOW — The old version (1.20.0) is compiled with Go 1.25.x, which may contain 2 low-severity crypto/x509 CVEs. The new version (1.21.1) ships ExternalDNS v0.21.0 compiled with Go 1.26.1, fully patching all known Go toolchain CVEs. No external-dns-specific vulnerabilities found.
• No new vulnerabilities introduced by this update.
• Merge at own discretion; the update is safe and recommended.

---

⚠️ This comment was posted by an automated security scanner (Ciel).
To re-scan, trigger the renovate-security-scanner skill.

[tinfoild]

kube/helmrelease/out00

--- HelmRelease: external-dns/external-dns ClusterRole: external-dns/external-dns

+++ HelmRelease: external-dns/external-dns ClusterRole: external-dns/external-dns

@@ -58,13 +58,13 @@

   - list
 - apiGroups:
   - externaldns.k8s.io
   resources:
   - dnsendpoints/status
   verbs:
-  - '*'
+  - update
 - apiGroups:
   - gateway.networking.k8s.io
   resources:
   - gateways
   verbs:
   - get
--- HelmRelease: external-dns/external-dns Deployment: external-dns/external-dns

+++ HelmRelease: external-dns/external-dns Deployment: external-dns/external-dns

@@ -40,13 +40,13 @@

             - ALL
           privileged: false
           readOnlyRootFilesystem: true
           runAsGroup: 65532
           runAsNonRoot: true
           runAsUser: 65532
-        image: registry.k8s.io/external-dns/external-dns:v0.20.0
+        image: registry.k8s.io/external-dns/external-dns:v0.23.0
         imagePullPolicy: IfNotPresent
         env:
         - name: CF_API_TOKEN
           valueFrom:
             secretKeyRef:
               key: cloudflare-token