feat(github/external-snapshotter): update v8.5.0 ➼ v8.6.0

[tinfoild]

This PR contains the following updates:

Package	Update	Change	OpenSSF
external-snapshotter	minor	v8.5.0 → v8.6.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

kubernetes-csi/external-snapshotter (external-snapshotter)

v8.6.0

Compare Source

Overall Status

Volume snapshotting has been a GA feature since Kubernetes v1.20.

Supported CSI Spec Versions

1.0-1.12

• VolumeGroupSnapshot moves to GA in CSI spec v1.11.0.

Minimum Kubernetes version

1.25

Recommended Minimum Kubernetes version

1.25

Container

To be released

Changes by Kind

Feature

• Promoted VolumeGroupSnapshot API to GA (v1). Updated controllers to use v1 VolumeGroupSnapshot APIs and set v1beta2 as the stored version during migration. (#​1368, @​xing-yang)

Full Changelog

https://github.com/kubernetes-csi/external-snapshotter/blob/v8.6.0/CHANGELOG/CHANGELOG-8.6.md

---

Configuration

📅 Schedule: (in timezone Asia/Singapore)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[cloudflare-workers-and-pages]

Deploying jjgadgets-biohazard with    Cloudflare Pages

Latest commit:	4c836d1
Status:	🚫  Build failed.

View logs

[tinfoild]

kube/helmrelease/out00

[ciel-shieru]

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-24 08:58 UTC
🤖 Scanner: Ciel Security Scanner
🔗 PR: #5888 — feat(github/external-snapshotter): update v8.5.0 ➼ v8.6.0
📦 Packages checked: 1
🔍 Sources: NVD, OSV.dev, GHSA, GHSL, CISA KEV, FortiGuard, CVE.org, Changelog
⚠️ Vulnerabilities found: 0

---

Severity Summary

Severity	Count
CRITICAL	0
HIGH	0
MEDIUM / MODERATE	0
LOW	0
UNKNOWN / NEEDS VERIFICATION	0
Total	0

---

Results

Package: external-snapshotter

• Ecosystem: Go (Kubernetes CSI)
• Old version: v8.5.0 — CLEAN
• New version: v8.6.0 — CLEAN

Vulnerabilities in version v8.5.0

No known vulnerabilities found.

Vulnerabilities in version v8.6.0

No known vulnerabilities found.

Source scan summary

Source	Status	Notes
OSV.dev	✅ Scanned	No results for this package (tried Go, any, Docker ecosystems)
NVD	✅ Scanned	CVE-2019-11255 found but affects versions <1.2.2 — not applicable to v8.x
GHSA	✅ Scanned	No advisories for this package (go ecosystem)
GHSL	✅ Scanned	No publications found for external-snapshotter
CISA KEV	✅ Scanned	No entries for this product
FortiGuard	✅ Scanned	No advisories found (Fortinet product advisories only)
CVE.org	✅ Scanned	No CVEs found for this exact package
Changelog	✅ Scanned	Bug fixes and feature updates only — no security patches beyond Go toolchain bump already in v8.5.0

Non-applicable findings (verified and excluded)

Finding	Severity	Reason not applicable
CVE-2019-11255	MEDIUM	Affects external-snapshotter <1.2.2; both v8.5.0 and v8.6.0 are well above the affected range
CVE-2025-68121 (Go toolchain)	MEDIUM	Already fixed in v8.5.0 per its changelog; not a direct vulnerability in the package itself

Changelog Security Highlights (v8.5.0 → v8.6.0)

• v8.5.0 — Go version updated to fix CVE-2025-68121 (toolchain fix)
• v8.6.0 — HTTP server timeouts added to webhook (hardening); k8s deps bumped to v1.36.1, Go to 1.26.0

---

Recommendations

• MERGE PRIORITY: LOW — No security vulnerabilities found in either version. Merge at own discretion.
• This is a minor feature release promoting VolumeGroupSnapshot API to GA and adding bug fixes.
• No breaking changes expected from v8.5.0 → v8.6.0.

---

⚠️ This comment was posted by an automated security scanner (Ciel).
To re-scan, trigger the renovate-security-scanner skill.

[tinfoild]

kube/kustomization/out00

--- kube/clusters/biohazard/flux Kustomization: flux-system/0-biohazard-config GitRepository: flux-system/external-snapshotter

+++ kube/clusters/biohazard/flux Kustomization: flux-system/0-biohazard-config GitRepository: flux-system/external-snapshotter

@@ -14,9 +14,9 @@

     # include CR
     !/client/config/crd
     # include controller
     !/deploy/kubernetes/snapshot-controller
   interval: 1h
   ref:
-    tag: v8.5.0
+    tag: v8.6.0
   url: https://github.com/kubernetes-csi/external-snapshotter.git