This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [external-secrets](https://github.com/external-secrets/external-secrets) | HelmChart | minor | `2.4.1` → `2.5.0` |
---
### Release Notes
<details>
<summary>external-secrets/external-secrets (external-secrets)</summary>
### [`v2.5.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.5.0)
[Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.4.1...v2.5.0)
Image: `ghcr.io/external-secrets/external-secrets:v2.5.0`
Image: `ghcr.io/external-secrets/external-secrets:v2.5.0-ubi`
Image: `ghcr.io/external-secrets/external-secrets:v2.5.0-ubi-boringssl`
<!-- Release notes generated using configuration in .github/release.yml at main -->
#### What's Changed
##### General
- chore: release chart for v2.4.1 by [@​Skarlso](https://github.com/Skarlso) in [#​6293](https://github.com/external-secrets/external-secrets/pull/6293)
- fix(doc): Adds missing doc reference for VaultDynamicSecret example using GET by [@​bharath-b-rh](https://github.com/bharath-b-rh) in [#​6296](https://github.com/external-secrets/external-secrets/pull/6296)
- feat(charts): make serviceaccounts/token create RBAC rule conditional by [@​kriszkern](https://github.com/kriszkern) in [#​6295](https://github.com/external-secrets/external-secrets/pull/6295)
- ref: delete duplication of applyOwnership logic by [@​jaruwat-panturat](https://github.com/jaruwat-panturat) in [#​6301](https://github.com/external-secrets/external-secrets/pull/6301)
- feat: add Pulumi OIDC-based authentication by [@​johnstonmatt](https://github.com/johnstonmatt) in [#​5893](https://github.com/external-secrets/external-secrets/pull/5893)
- fix: datarace in fake runtime test and push secret test by [@​Skarlso](https://github.com/Skarlso) in [#​6300](https://github.com/external-secrets/external-secrets/pull/6300)
- docs(release): Update docs to build for arm for bitwarden-cli by [@​Senk02](https://github.com/Senk02) in [#​6312](https://github.com/external-secrets/external-secrets/pull/6312)
- feat: add healthz check for liveness probe to cert and webhook by [@​Skarlso](https://github.com/Skarlso) in [#​6319](https://github.com/external-secrets/external-secrets/pull/6319)
- chore: bump go version 1.26.3 by [@​Skarlso](https://github.com/Skarlso) in [#​6339](https://github.com/external-secrets/external-secrets/pull/6339)
- fix(charts): gate externalsecrets write RBAC on processClusterExternalSecret by [@​kriszkern](https://github.com/kriszkern) in [#​6332](https://github.com/external-secrets/external-secrets/pull/6332)
- feat(gcp): issue-5790: optional GCP service account email for WIF impersonation by [@​bharath-b-rh](https://github.com/bharath-b-rh) in [#​6273](https://github.com/external-secrets/external-secrets/pull/6273)
- ref(beyondtrust): BIPS-32651 add API v3.2 support for create Secrets by [@​btfhernandez](https://github.com/btfhernandez) in [#​6309](https://github.com/external-secrets/external-secrets/pull/6309)
- fix(onepassword): return fresh provider instance from NewClient to avoid wrong-vault race by [@​duizabojul](https://github.com/duizabojul) in [#​6334](https://github.com/external-secrets/external-secrets/pull/6334)
- docs: add Rootline to ADOPTERS.md by [@​daanschipper](https://github.com/daanschipper) in [#​6342](https://github.com/external-secrets/external-secrets/pull/6342)
- feat(charts): default scopedNamespace to .Release.Namespace when scopedRBAC is true by [@​kriszkern](https://github.com/kriszkern) in [#​6343](https://github.com/external-secrets/external-secrets/pull/6343)
- docs: add blank lines before lists by [@​chlab](https://github.com/chlab) in [#​6336](https://github.com/external-secrets/external-secrets/pull/6336)
- chore(doc): fix Azure role name typo by [@​hobti01](https://github.com/hobti01) in [#​6335](https://github.com/external-secrets/external-secrets/pull/6335)
- feat(security): Enable Authentication and Authorization for Metrics Endpoint using FilterProvider by [@​Zacky3181V](https://github.com/Zacky3181V) in [#​5574](https://github.com/external-secrets/external-secrets/pull/5574)
- feat: inject kube context as STS session tags by [@​robertchildresscfa](https://github.com/robertchildresscfa) in [#​6311](https://github.com/external-secrets/external-secrets/pull/6311)
- fix(charts): remove stale args guard in controller deployment by [@​kriszkern](https://github.com/kriszkern) in [#​6347](https://github.com/external-secrets/external-secrets/pull/6347)
- fix: provider/infisical provider sub-folder references in remoteRef.key by [@​varonix0](https://github.com/varonix0) in [#​6338](https://github.com/external-secrets/external-secrets/pull/6338)
##### Dependencies
- chore(deps): bump golang from `4f4ab2c` to `47ce563` in /e2e by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6286](https://github.com/external-secrets/external-secrets/pull/6286)
- chore(deps): bump click from 8.3.2 to 8.3.3 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6287](https://github.com/external-secrets/external-secrets/pull/6287)
- chore(deps): bump certifi from 2026.2.25 to 2026.4.22 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6288](https://github.com/external-secrets/external-secrets/pull/6288)
- chore(deps): bump pathspec from 1.0.4 to 1.1.1 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6291](https://github.com/external-secrets/external-secrets/pull/6291)
- chore(deps): bump idna from 3.11 to 3.13 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6290](https://github.com/external-secrets/external-secrets/pull/6290)
- chore(deps): bump packaging from 26.1 to 26.2 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6289](https://github.com/external-secrets/external-secrets/pull/6289)
- chore(deps): bump step-security/harden-runner from 2.19.0 to 2.19.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6304](https://github.com/external-secrets/external-secrets/pull/6304)
- chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6305](https://github.com/external-secrets/external-secrets/pull/6305)
- chore(deps): bump golang from 1.26.2 to 1.26.3 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6320](https://github.com/external-secrets/external-secrets/pull/6320)
- chore(deps): bump golang from 1.26.2-bookworm to 1.26.3-bookworm in /e2e by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6327](https://github.com/external-secrets/external-secrets/pull/6327)
- chore(deps): bump ubi9/ubi from `fd3612e` to `2323fcf` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6321](https://github.com/external-secrets/external-secrets/pull/6321)
- chore(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6322](https://github.com/external-secrets/external-secrets/pull/6322)
- chore(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6323](https://github.com/external-secrets/external-secrets/pull/6323)
- chore(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6325](https://github.com/external-secrets/external-secrets/pull/6325)
- chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6324](https://github.com/external-secrets/external-secrets/pull/6324)
- chore(deps): bump actions/labeler from 6.0.1 to 6.1.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6326](https://github.com/external-secrets/external-secrets/pull/6326)
- chore(deps): bump idna from 3.13 to 3.14 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6328](https://github.com/external-secrets/external-secrets/pull/6328)
- chore(deps): bump urllib3 from 2.6.3 to 2.7.0 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6329](https://github.com/external-secrets/external-secrets/pull/6329)
- chore(deps): bump regex from 2026.4.4 to 2026.5.9 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6330](https://github.com/external-secrets/external-secrets/pull/6330)
#### New Contributors
- [@​kriszkern](https://github.com/kriszkern) made their first contribution in [#​6295](https://github.com/external-secrets/external-secrets/pull/6295)
- [@​johnstonmatt](https://github.com/johnstonmatt) made their first contribution in [#​5893](https://github.com/external-secrets/external-secrets/pull/5893)
- [@​Senk02](https://github.com/Senk02) made their first contribution in [#​6312](https://github.com/external-secrets/external-secrets/pull/6312)
- [@​duizabojul](https://github.com/duizabojul) made their first contribution in [#​6334](https://github.com/external-secrets/external-secrets/pull/6334)
- [@​daanschipper](https://github.com/daanschipper) made their first contribution in [#​6342](https://github.com/external-secrets/external-secrets/pull/6342)
- [@​chlab](https://github.com/chlab) made their first contribution in [#​6336](https://github.com/external-secrets/external-secrets/pull/6336)
- [@​hobti01](https://github.com/hobti01) made their first contribution in [#​6335](https://github.com/external-secrets/external-secrets/pull/6335)
- [@​Zacky3181V](https://github.com/Zacky3181V) made their first contribution in [#​5574](https://github.com/external-secrets/external-secrets/pull/5574)
- [@​robertchildresscfa](https://github.com/robertchildresscfa) made their first contribution in [#​6311](https://github.com/external-secrets/external-secrets/pull/6311)
**Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.4.1...v2.5.0>
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
2.4.1→2.5.0Release Notes
external-secrets/external-secrets (external-secrets)
v2.5.0Compare Source
Image:
ghcr.io/external-secrets/external-secrets:v2.5.0Image:
ghcr.io/external-secrets/external-secrets:v2.5.0-ubiImage:
ghcr.io/external-secrets/external-secrets:v2.5.0-ubi-boringsslWhat's Changed
General
Dependencies
4f4ab2cto47ce563in /e2e by @dependabot[bot] in #6286fd3612eto2323fcfby @dependabot[bot] in #6321New Contributors
Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.4.1...v2.5.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.