This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [external-secrets](https://github.com/external-secrets/external-secrets) | HelmChart | minor | `2.8.0` → `2.9.0` |
---
### Release Notes
<details>
<summary>external-secrets/external-secrets (external-secrets)</summary>
### [`v2.9.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.9.0)
[Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.8.0...v2.9.0)
Image: `ghcr.io/external-secrets/external-secrets:v2.9.0`
Image: `ghcr.io/external-secrets/external-secrets:v2.9.0-ubi`
Image: `ghcr.io/external-secrets/external-secrets:v2.9.0-ubi-boringssl`
<!-- Release notes generated using configuration in .github/release.yml at main -->
#### What's Changed
##### General
- chore: release helm chart 2.8.0 by [@​Skarlso](https://github.com/Skarlso) in [#​6656](https://github.com/external-secrets/external-secrets/pull/6656)
- fix(conjur): add InstallTimeout to helm chart installation and pin server image version by [@​alekc](https://github.com/alekc) in [#​6658](https://github.com/external-secrets/external-secrets/pull/6658)
- fix(deps): bump grpc-go for GHSA-hrxh-6v49-42gf by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​6695](https://github.com/external-secrets/external-secrets/pull/6695)
- feat(charts): add opt-in schedulerName and runtimeClassName to the pods by [@​somaz94](https://github.com/somaz94) in [#​6675](https://github.com/external-secrets/external-secrets/pull/6675)
- fix(webhookconfig): use a constant Eventf format by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​6699](https://github.com/external-secrets/external-secrets/pull/6699)
- fix: bump codeqls together by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​6707](https://github.com/external-secrets/external-secrets/pull/6707)
- fix(security): install crane in a reliable way and fix code scanning issue by [@​Skarlso](https://github.com/Skarlso) in [#​6712](https://github.com/external-secrets/external-secrets/pull/6712)
- chore: Fix cve-2026-56852 by bump golang.org/x/text\@​0.40 by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​6734](https://github.com/external-secrets/external-secrets/pull/6734)
- chore(fix): template abuse for secret values by [@​Skarlso](https://github.com/Skarlso) in [#​6730](https://github.com/external-secrets/external-secrets/pull/6730)
- chore: Bump controller runtime by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​6703](https://github.com/external-secrets/external-secrets/pull/6703)
- chore(fix): moved the validation further up the chain by [@​Skarlso](https://github.com/Skarlso) in [#​6735](https://github.com/external-secrets/external-secrets/pull/6735)
- fix: pin all dependencies by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​6727](https://github.com/external-secrets/external-secrets/pull/6727)
- feat(e2e): implement fan-out matrix validation and credential scoping by [@​alekc](https://github.com/alekc) in [#​6660](https://github.com/external-secrets/external-secrets/pull/6660)
- fix(akeyless): use local errors.As target to avoid data race by [@​HYPERVAPOR](https://github.com/HYPERVAPOR) in [#​6749](https://github.com/external-secrets/external-secrets/pull/6749)
- test(crd): add e2e suite and CI leg for the CRD provider by [@​alekc](https://github.com/alekc) in [#​6742](https://github.com/external-secrets/external-secrets/pull/6742)
- docs(webhook): add debugging guide and fix stale secret-label claim by [@​alekc](https://github.com/alekc) in [#​6746](https://github.com/external-secrets/external-secrets/pull/6746)
- test(e2e): skip the global addon uninstall on disposable clusters by [@​alekc](https://github.com/alekc) in [#​6780](https://github.com/external-secrets/external-secrets/pull/6780)
- feat: add environments support to 1Password SDK by [@​Skarlso](https://github.com/Skarlso) in [#​6318](https://github.com/external-secrets/external-secrets/pull/6318)
- fix(akeyless): stop reporting API failures as a missing item by [@​alekc](https://github.com/alekc) in [#​6753](https://github.com/external-secrets/external-secrets/pull/6753)
- fix(makefile): harden clean worktree check by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​6702](https://github.com/external-secrets/external-secrets/pull/6702)
- fix: support docs builds from worktrees by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​6741](https://github.com/external-secrets/external-secrets/pull/6741)
- feat(cache): add atomic ContainsOrAdd by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​6706](https://github.com/external-secrets/external-secrets/pull/6706)
- fix: omit empty AWS secret replica regions by [@​goutamadwant](https://github.com/goutamadwant) in [#​6596](https://github.com/external-secrets/external-secrets/pull/6596)
- fix: Follow up PR6318 by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​6782](https://github.com/external-secrets/external-secrets/pull/6782)
- feat: Show sponsoring of Roche by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​6790](https://github.com/external-secrets/external-secrets/pull/6790)
- fix(e2e): make the oracle suite runnable by [@​alekc](https://github.com/alekc) in [#​6770](https://github.com/external-secrets/external-secrets/pull/6770)
- chore: temporarily allow GHSA-gcjh-h69q-9w9g by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​6795](https://github.com/external-secrets/external-secrets/pull/6795)
- fix(api): stop defaulting optional ExternalSecret strategy fields by [@​alekc](https://github.com/alekc) in [#​6798](https://github.com/external-secrets/external-secrets/pull/6798)
- chore: remove/cleanup remaining tools from tools.go. by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​6786](https://github.com/external-secrets/external-secrets/pull/6786)
- chore: Cleanup sponsors dead links by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​6791](https://github.com/external-secrets/external-secrets/pull/6791)
- fix(aws): detach replicated regions before deleting AWS SecretsManager secret by [@​cmoscofian](https://github.com/cmoscofian) in [#​6687](https://github.com/external-secrets/external-secrets/pull/6687)
- chore: fix enable cache being removed on installCRD=false by [@​Skarlso](https://github.com/Skarlso) in [#​6799](https://github.com/external-secrets/external-secrets/pull/6799)
##### Dependencies
- chore(deps): bump golang from `0178a64` to `0178a64` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6663](https://github.com/external-secrets/external-secrets/pull/6663)
- chore(deps): bump mkdocs-material from 9.7.6 to 9.7.7 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6669](https://github.com/external-secrets/external-secrets/pull/6669)
- chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6674](https://github.com/external-secrets/external-secrets/pull/6674)
- chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6667](https://github.com/external-secrets/external-secrets/pull/6667)
- chore(deps): bump fkirc/skip-duplicate-actions from 5.3.1 to 5.3.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6671](https://github.com/external-secrets/external-secrets/pull/6671)
- chore(deps): bump actions/stale from 10.3.0 to 10.4.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6673](https://github.com/external-secrets/external-secrets/pull/6673)
- chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6672](https://github.com/external-secrets/external-secrets/pull/6672)
- chore(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 6.2.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6670](https://github.com/external-secrets/external-secrets/pull/6670)
- chore(deps): bump distroless/static from `d5f030c` to `9197324` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6662](https://github.com/external-secrets/external-secrets/pull/6662)
- chore(deps): bump ubi9/ubi from `8bf0e8f` to `2a6bd69` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6661](https://github.com/external-secrets/external-secrets/pull/6661)
- chore(deps): bump actions/setup-go from 6.0.0 to 7.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6664](https://github.com/external-secrets/external-secrets/pull/6664)
- chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6665](https://github.com/external-secrets/external-secrets/pull/6665)
- chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.3 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6666](https://github.com/external-secrets/external-secrets/pull/6666)
- chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6715](https://github.com/external-secrets/external-secrets/pull/6715)
- chore(deps): bump aws-actions/configure-aws-credentials from 6.2.2 to 6.2.3 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6717](https://github.com/external-secrets/external-secrets/pull/6717)
- chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6722](https://github.com/external-secrets/external-secrets/pull/6722)
- chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.3 in the codeql group across 1 directory by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6713](https://github.com/external-secrets/external-secrets/pull/6713)
- chore(deps): bump google-github-actions/auth from [`fc21748`](https://github.com/external-secrets/external-secrets/commit/fc2174804b84f912b1f6d334e9463f484f1c552d) to [`cd3439a`](https://github.com/external-secrets/external-secrets/commit/cd3439a4d2c29fd597fb063e209ee2c2d6128dcd) by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6714](https://github.com/external-secrets/external-secrets/pull/6714)
- chore(deps): bump actions/cache from 4.2.4 to 6.1.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6716](https://github.com/external-secrets/external-secrets/pull/6716)
- chore(deps): bump actions/labeler from 6.1.0 to 7.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6718](https://github.com/external-secrets/external-secrets/pull/6718)
- chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.2.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6719](https://github.com/external-secrets/external-secrets/pull/6719)
- chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6720](https://github.com/external-secrets/external-secrets/pull/6720)
- chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6723](https://github.com/external-secrets/external-secrets/pull/6723)
- chore(deps): bump docker/login-action from 4.4.0 to 4.5.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6736](https://github.com/external-secrets/external-secrets/pull/6736)
- chore(deps): bump actions/stale from 10.4.0 to 11.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6738](https://github.com/external-secrets/external-secrets/pull/6738)
- chore(deps): bump the codeql group with 3 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6751](https://github.com/external-secrets/external-secrets/pull/6751)
- chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6752](https://github.com/external-secrets/external-secrets/pull/6752)
- chore(deps): bump the codeql group with 3 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6801](https://github.com/external-secrets/external-secrets/pull/6801)
- chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6802](https://github.com/external-secrets/external-secrets/pull/6802)
- chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6805](https://github.com/external-secrets/external-secrets/pull/6805)
- chore(deps): bump azure/login from 3.0.0 to 3.0.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6804](https://github.com/external-secrets/external-secrets/pull/6804)
- chore(deps): bump google-github-actions/auth from [`cd3439a`](https://github.com/external-secrets/external-secrets/commit/cd3439a4d2c29fd597fb063e209ee2c2d6128dcd) to [`1206044`](https://github.com/external-secrets/external-secrets/commit/12060449e87204eca501a11f2f7f1483024afff0) by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6737](https://github.com/external-secrets/external-secrets/pull/6737)
- chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6803](https://github.com/external-secrets/external-secrets/pull/6803)
#### New Contributors
- [@​HYPERVAPOR](https://github.com/HYPERVAPOR) made their first contribution in [#​6749](https://github.com/external-secrets/external-secrets/pull/6749)
- [@​goutamadwant](https://github.com/goutamadwant) made their first contribution in [#​6596](https://github.com/external-secrets/external-secrets/pull/6596)
**Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.8.0...v2.9.0>
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNC4zIiwidXBkYXRlZEluVmVyIjoiNDQuMTQuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
2.8.0→2.9.0Release Notes
external-secrets/external-secrets (external-secrets)
v2.9.0Compare Source
Image:
ghcr.io/external-secrets/external-secrets:v2.9.0Image:
ghcr.io/external-secrets/external-secrets:v2.9.0-ubiImage:
ghcr.io/external-secrets/external-secrets:v2.9.0-ubi-boringsslWhat's Changed
General
Dependencies
0178a64to0178a64by @dependabot[bot] in #6663d5f030cto9197324by @dependabot[bot] in #66628bf0e8fto2a6bd69by @dependabot[bot] in #6661fc21748tocd3439aby @dependabot[bot] in #6714cd3439ato1206044by @dependabot[bot] in #6737New Contributors
Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.8.0...v2.9.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.