chore(deps): update helm release external-secrets to v2 #46

renovatebot · 2026-02-07T00:02:36Z

renovatebot commented

2026-02-07 00:02:36 +00:00

This PR contains the following updates:

Package	Type	Update	Change
external-secrets	HelmChart	major	`1.2.0` → `2.6.0`

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

external-secrets/external-secrets (external-secrets)

`v2.6.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.6.0
Image: ghcr.io/external-secrets/external-secrets:v2.6.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.6.0-ubi-boringssl

What's Changed

General

chore: release helm chart 2.5.0 by @Skarlso in #6352
feat(keeper): implement provider_api_calls_count metric by @m-k8s in #6345
docs(gcpsm): updates Google Secret Manager authentication guide with WIF usage by @bharath-b-rh in #6356
feat(release): PB-51302 - External secret should support v5-custom-fields resource type by @cedricherzog-passbolt in #6377
feat(testing): OpenBao e2e test by @phil9909 in #6396
docs: Explanation of our labels by @evrardj-roche in #6306
docs: add AGENTS.md and AI setup guide for ESO by @rowanruseler in #6141
fix(makefile): clean up cross-submodule go.mod churn after make test by @alekc in #6378
fix(provider): align TokenRequest body namespace with URL namespace by @alekc in #6420
fix(build): use buildx --load and non-registry image tag by @alekc in #6419
fix(charts): render PDB spec when minAvailable or maxUnavailable is zero by @blindrood in #6360
chore: update go version 1.26.4 by @Skarlso in #6426

Dependencies

chore(deps): bump golang from 91eda97 to 91eda97 by @dependabot[bot] in #6363
chore(deps): bump pymdown-extensions from 10.21.2 to 10.21.3 in /hack/api-docs by @dependabot[bot] in #6370
chore(deps): bump hashicorp/setup-terraform from 4.0.0 to 4.0.1 by @dependabot[bot] in #6364
chore(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 by @dependabot[bot] in #6365
chore(deps): bump step-security/harden-runner from 2.19.1 to 2.19.4 by @dependabot[bot] in #6366
chore(deps): bump github/codeql-action from 4.35.4 to 4.36.0 by @dependabot[bot] in #6368
chore(deps): bump distroless/static from 47b2d72 to 3592aa8 by @dependabot[bot] in #6362
chore(deps): bump ubi9/ubi from 2323fcf to 151fc1b by @dependabot[bot] in #6361
chore(deps): bump actions/create-github-app-token from 3.1.1 to 3.2.0 by @dependabot[bot] in #6367
chore(deps): bump idna from 3.14 to 3.16 in /hack/api-docs by @dependabot[bot] in #6369
chore(deps): bump golang from 91eda97 to 91eda97 by @dependabot[bot] in #6383
chore(deps): bump golang from 252599a to 386d475 in /e2e by @dependabot[bot] in #6389
chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 by @dependabot[bot] in #6384
chore(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 by @dependabot[bot] in #6387
chore(deps): bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6386
chore(deps): bump actions/stale from 10.2.0 to 10.3.0 by @dependabot[bot] in #6388
chore(deps): bump zipp from 3.23.1 to 4.1.0 in /hack/api-docs by @dependabot[bot] in #6390
chore(deps): bump click from 8.3.3 to 8.4.1 in /hack/api-docs by @dependabot[bot] in #6391
chore(deps): bump certifi from 2026.4.22 to 2026.5.20 in /hack/api-docs by @dependabot[bot] in #6392
chore(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6385
chore(deps): bump requests from 2.33.1 to 2.34.2 in /hack/api-docs by @dependabot[bot] in #6372
chore(deps): bump tornado from 6.5.5 to 6.5.6 in /hack/api-docs by @dependabot[bot] in #6412
chore(deps): bump ubi9/ubi from 151fc1b to 8942b73 by @dependabot[bot] in #6407
chore(deps): bump aws-actions/configure-aws-credentials from 6.1.1 to 6.2.0 by @dependabot[bot] in #6408
chore(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6409
chore(deps): bump idna from 3.16 to 3.17 in /hack/api-docs by @dependabot[bot] in #6411

New Contributors

@m-k8s made their first contribution in #6345
@phil9909 made their first contribution in #6396
@blindrood made their first contribution in #6360

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.5.0...v2.6.0

`v2.5.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.5.0
Image: ghcr.io/external-secrets/external-secrets:v2.5.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.5.0-ubi-boringssl

What's Changed

General

chore: release chart for v2.4.1 by @Skarlso in #6293
fix(doc): Adds missing doc reference for VaultDynamicSecret example using GET by @bharath-b-rh in #6296
feat(charts): make serviceaccounts/token create RBAC rule conditional by @kriszkern in #6295
ref: delete duplication of applyOwnership logic by @jaruwat-panturat in #6301
feat: add Pulumi OIDC-based authentication by @johnstonmatt in #5893
fix: datarace in fake runtime test and push secret test by @Skarlso in #6300
docs(release): Update docs to build for arm for bitwarden-cli by @Senk02 in #6312
feat: add healthz check for liveness probe to cert and webhook by @Skarlso in #6319
chore: bump go version 1.26.3 by @Skarlso in #6339
fix(charts): gate externalsecrets write RBAC on processClusterExternalSecret by @kriszkern in #6332
feat(gcp): issue-5790: optional GCP service account email for WIF impersonation by @bharath-b-rh in #6273
ref(beyondtrust): BIPS-32651 add API v3.2 support for create Secrets by @btfhernandez in #6309
fix(onepassword): return fresh provider instance from NewClient to avoid wrong-vault race by @duizabojul in #6334
docs: add Rootline to ADOPTERS.md by @daanschipper in #6342
feat(charts): default scopedNamespace to .Release.Namespace when scopedRBAC is true by @kriszkern in #6343
docs: add blank lines before lists by @chlab in #6336
chore(doc): fix Azure role name typo by @hobti01 in #6335
feat(security): Enable Authentication and Authorization for Metrics Endpoint using FilterProvider by @Zacky3181V in #5574
feat: inject kube context as STS session tags by @robertchildresscfa in #6311
fix(charts): remove stale args guard in controller deployment by @kriszkern in #6347
fix: provider/infisical provider sub-folder references in remoteRef.key by @varonix0 in #6338

Dependencies

chore(deps): bump golang from 4f4ab2c to 47ce563 in /e2e by @dependabot[bot] in #6286
chore(deps): bump click from 8.3.2 to 8.3.3 in /hack/api-docs by @dependabot[bot] in #6287
chore(deps): bump certifi from 2026.2.25 to 2026.4.22 in /hack/api-docs by @dependabot[bot] in #6288
chore(deps): bump pathspec from 1.0.4 to 1.1.1 in /hack/api-docs by @dependabot[bot] in #6291
chore(deps): bump idna from 3.11 to 3.13 in /hack/api-docs by @dependabot[bot] in #6290
chore(deps): bump packaging from 26.1 to 26.2 in /hack/api-docs by @dependabot[bot] in #6289
chore(deps): bump step-security/harden-runner from 2.19.0 to 2.19.1 by @dependabot[bot] in #6304
chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by @dependabot[bot] in #6305
chore(deps): bump golang from 1.26.2 to 1.26.3 by @dependabot[bot] in #6320
chore(deps): bump golang from 1.26.2-bookworm to 1.26.3-bookworm in /e2e by @dependabot[bot] in #6327
chore(deps): bump ubi9/ubi from fd3612e to 2323fcf by @dependabot[bot] in #6321
chore(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @dependabot[bot] in #6322
chore(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 by @dependabot[bot] in #6323
chore(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2 by @dependabot[bot] in #6325
chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by @dependabot[bot] in #6324
chore(deps): bump actions/labeler from 6.0.1 to 6.1.0 by @dependabot[bot] in #6326
chore(deps): bump idna from 3.13 to 3.14 in /hack/api-docs by @dependabot[bot] in #6328
chore(deps): bump urllib3 from 2.6.3 to 2.7.0 in /hack/api-docs by @dependabot[bot] in #6329
chore(deps): bump regex from 2026.4.4 to 2026.5.9 in /hack/api-docs by @dependabot[bot] in #6330

New Contributors

@kriszkern made their first contribution in #6295
@johnstonmatt made their first contribution in #5893
@Senk02 made their first contribution in #6312
@duizabojul made their first contribution in #6334
@daanschipper made their first contribution in #6342
@chlab made their first contribution in #6336
@hobti01 made their first contribution in #6335
@Zacky3181V made their first contribution in #5574
@robertchildresscfa made their first contribution in #6311

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.4.1...v2.5.0

`v2.4.1`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.4.1
Image: ghcr.io/external-secrets/external-secrets:v2.4.1-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.4.1-ubi-boringssl

What's Changed

General

chore: release chart for v2.4.0 by @Skarlso in #6277
feat(gcp): support multiple replicationLocations on PushSecret by @alliasgher in #6225
feat(passbolt): add custom CA bundle / CA provider support by @alliasgher in #6224
feat(azure): add contentType support for PushSecret by @ppatel1604 in #6249
feat(charts): add liveness probes to cert-controller and webhook by @mattcarp12 in #6147
fix: prevent creation of specific type of secrets by @Skarlso in #6280

Dependencies

chore(deps): bump golang from f853308 to f853308 by @dependabot[bot] in #6282
chore(deps): bump alpine from 2510918 to 5b10f43 in /hack/api-docs by @dependabot[bot] in #6285
chore(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 by @dependabot[bot] in #6283
chore(deps): bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 by @dependabot[bot] in #6284
chore(deps): bump ubi9/ubi from cf13fe2 to fd3612e by @dependabot[bot] in #6281

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.4.0...v2.4.1

`v2.4.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.4.0
Image: ghcr.io/external-secrets/external-secrets:v2.4.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.4.0-ubi-boringssl

What's Changed

General

chore: release helm chart for v2.3.0 by @Skarlso in #6204
fix(docs): hide Scarf tracking pixel to remove page whitespace by @ppatel1604 in #6209
docs: Add Grafana generator documentation by @jaruwat-panturat in #6227
docs: add TLS certificate authentication example for Vault provider by @alliasgher in #6212
docs(cloudsmith): Improve cloudsmith generator documentation by @cloudsmith-iduffy in #6232
docs: add missing specs to GeneratorSpec example by @jaruwat-panturat in #6236
feat(keeper): implement get secret by id or name by @tiberiuv in #6163
chore(secretserver): update dependencies to accept new DelineaXPM/tss-sdk-go by @DelineaSahilWankhede in #6240
docs(release): update documentation links from /main to /latest by @cinpol in #6210
fix: CAProvider cm access by @moolen in #6246
fix(chart): add failurePolicy to ClusterSecretStore webhook by @ryanjwong in #6247
feat(dvls): add name support for entries by @rbstp in #6099
fix(akeyless): upgrade akeyless-go-cloud-id to v0.3.7 by @alikdolg in #6248
chore(deps): bump azure/setup-helm from 3.5 to 5 by @dependabot[bot] in #6258
fix: do not set tags if undefined by @Skarlso in #6103
fix(conjur): return error for unimplemented PushSecret and DeleteSecret by @antonio-mazzini in #6266
docs: Enhance ClusterExternalSecret documentation with "fan-out" approach by @jaruwat-panturat in #6241
feat: add --leader-election-id flag to support HA deployments by @mattcarp12 in #6148
feat(bug): Fix CVE-2026-34165, CVE-2026-33762 and GHSA-3xc5-wrhm-f963 by @othomann in #6271
feat: enhance VaultDynamicSecret GET method to support parameters from the spec by @samm-git in #6267
fix: use a separate parameter for GET calls in VaultDynamicSecrets by @Skarlso in #6275

Dependencies

chore(deps): bump golang from c2a1f7b to c2a1f7b by @dependabot[bot] in #6214
chore(deps): bump platformdirs from 4.9.4 to 4.9.6 in /hack/api-docs by @dependabot[bot] in #6219
chore(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1 by @dependabot[bot] in #6216
chore(deps): bump codelytv/pr-size-labeler from 1.10.3 to 1.10.4 by @dependabot[bot] in #6221
chore(deps): bump ubi9/ubi from 9e6e193 to 039095f by @dependabot[bot] in #6213
chore(deps): bump importlib-resources from 6.5.2 to 7.1.0 in /hack/api-docs by @dependabot[bot] in #6220
chore(deps): bump actions/github-script from 8.0.0 to 9.0.0 by @dependabot[bot] in #6215
chore(deps): bump step-security/harden-runner from 2.16.1 to 2.17.0 by @dependabot[bot] in #6217
chore(deps): bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0 by @dependabot[bot] in #6218
chore(deps): bump azure/setup-helm from 3.4 to 3.5 by @dependabot[bot] in #6222
chore(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0 by @dependabot[bot] in #6223
chore(deps): bump golang from c2a1f7b to f853308 by @dependabot[bot] in #6252
chore(deps): bump alpine from 3.23.3 to 3.23.4 in /e2e by @dependabot[bot] in #6261
chore(deps): bump step-security/harden-runner from 2.17.0 to 2.19.0 by @dependabot[bot] in #6254
chore(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3 by @dependabot[bot] in #6257
chore(deps): bump actions/cache from 5.0.4 to 5.0.5 by @dependabot[bot] in #6259
chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by @dependabot[bot] in #6255
chore(deps): bump packaging from 26.0 to 26.1 in /hack/api-docs by @dependabot[bot] in #6263
chore(deps): bump zipp from 3.23.0 to 3.23.1 in /hack/api-docs by @dependabot[bot] in #6262
chore(deps): bump alpine from 2510918 to 5b10f43 by @dependabot[bot] in #6251
chore(deps): bump ubi9/ubi from 039095f to cf13fe2 by @dependabot[bot] in #6253
chore(deps): bump dependabot/fetch-metadata from 3.0.0 to 3.1.0 by @dependabot[bot] in #6260
chore(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.1.0 by @dependabot[bot] in #6256

New Contributors

@alliasgher made their first contribution in #6212
@tiberiuv made their first contribution in #6163
@cinpol made their first contribution in #6210
@ryanjwong made their first contribution in #6247
@alikdolg made their first contribution in #6248
@antonio-mazzini made their first contribution in #6266
@mattcarp12 made their first contribution in #6148

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.3.0...v2.4.0

`v2.3.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.3.0
Image: ghcr.io/external-secrets/external-secrets:v2.3.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.3.0-ubi-boringssl

What's Changed

General

chore: release charts v2.2.0 by @riccardomc in #6115
ref(modernize): modernize go code by @ivankatliarchuk in #6114
chore: bump bitwarden helm chart version to v0.6.0 by @Skarlso in #6118
chore: fix EoL in compatiblity table for version 2.2 by @riccardomc in #6128
docs: add missing jinja2 tags by @MindTooth in #6136
fix: cached uid after deleting a store by @Skarlso in #6138
feat(doppler): add ETag-based caching by @mikesellitto in #5997
fix(docs): fix metadata structure in Google Secrets Manager docs by @mruoss in #6139
feat: ovh provider implementation by @ldesauw in #6101
feat(providers): Implement PushSecret for Delinea Secret Server by @pr0ton11 in #6031
fix: propagate objectMeta and ownerReferences to target resources by @jaruwat-panturat in #6132
fix(release): remove docs.check and all relative calls by @jaruwat-panturat in #6146
feat: support service account impersonation when using Workload Identity Federation with a k8s service account by @zoomoid in #5707
fix: remove getHostByName from template funcs by @moolen in #6164
ref(kubernetes): move auth package from kubernetes to esutils by @alekc in #6149
docs: fix templating.md by @dangbert in #6168
fix(onepasswordsdk): support native 1Password item IDs in findItem by @LeahArmstrong in #6167
docs(ovhcloud): fix heterogeneous configuration documentation by @ldesauw in #6169
docs: add OVHcloud in ADOPTERS by @scraly in #6172
fix(docs): resolve macro syntax error in templating guide by @ManvithaP-hub in #6171
chore: rip out sprig dependency by @Skarlso in #6170
chore: fix jose cve by @Skarlso in #6178
docs: document correct htpasswd function usage by @Atomsoldat in #6177
feat(pushsecret): add dataTo support for bulk secret pushing by @mohamed-rekiba in #5850
docs: add existing blog post: ESO integration with ovhcloud secret manager with vault provider by @scraly in #6190
feat: move experimental-enable-vault-token-cache out of experimental and add expiry to validation by @sfotony in #5397
fix: prevent feedback loop by @moolen in #6021
fix: code scanning issues by @Skarlso in #6063
feat: add source null byte policy by @knelasevero in #6194
fix(test): fix broken test from automerge rebase by @knelasevero in #6199
fix(aws): handle empty resource policy in PushSecret for SecretsManager by @maks3201 in #6145
feat(github): add orgSecretVisibility field to GithubProvider by @iamnoah in #6202
feat(onepasswordSDK): multi-field and complete PushSecret by @Dariusch in #6187
feat(vault): add VaultRole attribute for TLS auth by @RicoGunawan12 in #6160
chore: bump go version to 1.26.2 by @Skarlso in #6203

Dependencies

chore(deps): bump actions/cache from 5.0.3 to 5.0.4 by @dependabot[bot] in #6121
chore(deps): bump mkdocs-material from 9.7.5 to 9.7.6 in /hack/api-docs by @dependabot[bot] in #6125
chore(deps): bump ubi9/ubi from 6ed9f6f to 1fc04e8 by @dependabot[bot] in #6119
chore(deps): bump azure/login from 2.3.0 to 3.0.0 by @dependabot[bot] in #6120
chore(deps): bump codecov/codecov-action from 5.5.2 to 5.5.3 by @dependabot[bot] in #6124
chore(deps): bump github/codeql-action from 4.32.6 to 4.34.1 by @dependabot[bot] in #6122
chore(deps): bump anchore/sbom-action from 0.23.1 to 0.24.0 by @dependabot[bot] in #6123
chore(deps): bump importlib-metadata from 8.7.1 to 9.0.0 in /hack/api-docs by @dependabot[bot] in #6126
chore(deps): bump sigstore/cosign-installer from 4.1.0 to 4.1.1 by @dependabot[bot] in #6154
chore(deps): bump pymdown-extensions from 10.21 to 10.21.2 in /hack/api-docs by @dependabot[bot] in #6157
chore(deps): bump actions/setup-go from 6.3.0 to 6.4.0 by @dependabot[bot] in #6151
chore(deps): bump github/codeql-action from 4.34.1 to 4.35.1 by @dependabot[bot] in #6152
chore(deps): bump dependabot/fetch-metadata from 2.5.0 to 3.0.0 by @dependabot[bot] in #6153
chore(deps): bump pygments from 2.19.2 to 2.20.0 in /hack/api-docs by @dependabot[bot] in #6155
chore(deps): bump regex from 2026.2.28 to 2026.3.32 in /hack/api-docs by @dependabot[bot] in #6156
chore(deps): bump requests from 2.32.5 to 2.33.0 in /hack/api-docs by @dependabot[bot] in #6158
chore(deps): bump ubi9/ubi from 1fc04e8 to 9e6e193 by @dependabot[bot] in #6150
chore(deps): bump step-security/harden-runner from 2.16.0 to 2.16.1 by @dependabot[bot] in #6180
chore(deps): bump charset-normalizer from 3.4.6 to 3.4.7 in /hack/api-docs by @dependabot[bot] in #6183
chore(deps): bump click from 8.3.1 to 8.3.2 in /hack/api-docs by @dependabot[bot] in #6185
chore(deps): bump fossas/fossa-action from 1.8.0 to 1.9.0 by @dependabot[bot] in #6181
chore(deps): bump docker/login-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6182
chore(deps): bump regex from 2026.3.32 to 2026.4.4 in /hack/api-docs by @dependabot[bot] in #6184

New Contributors

@MindTooth made their first contribution in #6136
@ldesauw made their first contribution in #6101
@pr0ton11 made their first contribution in #6031
@zoomoid made their first contribution in #5707
@dangbert made their first contribution in #6168
@LeahArmstrong made their first contribution in #6167
@scraly made their first contribution in #6172
@ManvithaP-hub made their first contribution in #6171
@Atomsoldat made their first contribution in #6177
@mohamed-rekiba made their first contribution in #5850
@sfotony made their first contribution in #5397
@maks3201 made their first contribution in #6145
@iamnoah made their first contribution in #6202
@RicoGunawan12 made their first contribution in #6160

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.2.0...v2.3.0

`v2.2.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.2.0
Image: ghcr.io/external-secrets/external-secrets:v2.2.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.2.0-ubi-boringssl

Breaking change

If you are using Flux + OCIRepository to fetch External Secrets Operator charts, please update your object to use a Layer selector:

  apiVersion: source.toolkit.fluxcd.io/v1
  kind: OCIRepository
  metadata:
    name: eso-oci
  spec:
    interval: 1m0s
    provider: generic
    ref:
      tag: 2.2.0
    url: oci://ghcr.io/external-secrets/charts/external-secrets
    layerSelector:
      mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip"
      operation: extract

What's Changed

General

chore: release charts v2.1.0 by @Skarlso in #6030
chore: fix the stability doc by @Skarlso in #6035
fix(security): Fix vulnerabilities by @othomann in #6052
fix(aws): sync tags and resource policy even when secret value unchanged by @evs-secops in #6025
fix: publish now uses docker build v4 which required some changes by @Skarlso in #6062
feat(gcpsm): auto-detect projectID from GCP metadata server by @patjlm in #5922
chore(templating): Remove years in license and their checks by @evrardj-roche in #5955
docs: Add Roche to official ADOPTERS by @evrardj-roche in #6076
feat: Add Last Sync column to ExternalSecret and PushSecret printers by @jaruwat-panturat in #6068
fix(onepassword): support native item IDs by @chadxz in #6073
feat: extract LGTM processor to external JS file with tests by @mateenali66 in #6074
feat: fail fast if LGTM label does not exist in repository by @mateenali66 in #6078
feat(passbolt): add support for Passbolt V5 API by @cedricherzog-passbolt in #5919
fix(infisical): dataFrom.find.path should filter by secret path not name by @johnvox in #6086
fix: disable the priority queue which misbehaves at scale by @Skarlso in #6083
chore: update go version to 1.26.1 by @Skarlso in #6072
docs(aws): fix PushSecret metadata indentation in resource policy exa... by @Br1an67 in #6056
fix(aws): prevent EC2 IMDS fallback when explicit credentials are pro... by @Br1an67 in #6036
feat(templating): Add certSANs function to extract SANs from certificates by @mzdeb in #6058
docs: document template.metadata labels/annotations behavior by @lucpas in #6102
fix: CODEOWNERS are seriously out of date by @Skarlso in #6106
feat(helm): add readinessProbe support for external-secrets deployment by @AlexOQ in #5831
fix: update grpc for CVE-2026-33186 by @Skarlso in #6108
feat(azurekv): add expiration time to azure kv secret by @muraliavarma in #5935
feat: add path to cloud.ru provider by @heavyandrew in #5952
fix(add-eso-version): fix separator line pattern in add_eso_version.sh script by @riccardomc in #6113

Dependencies

chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 by @dependabot[bot] in #6038
chore(deps): bump charset-normalizer from 3.4.4 to 3.4.5 in /hack/api-docs by @dependabot[bot] in #6047
chore(deps): bump platformdirs from 4.9.2 to 4.9.4 in /hack/api-docs by @dependabot[bot] in #6050
chore(deps): bump mkdocs-material from 9.7.3 to 9.7.4 in /hack/api-docs by @dependabot[bot] in #6049
chore(deps): bump github/codeql-action from 4.32.4 to 4.32.6 by @dependabot[bot] in #6039
chore(deps): bump step-security/harden-runner from 2.15.0 to 2.15.1 by @dependabot[bot] in #6043
chore(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0 by @dependabot[bot] in #6040
chore(deps): bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 by @dependabot[bot] in #6044
chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 by @dependabot[bot] in #6042
chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by @dependabot[bot] in #6041
chore(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by @dependabot[bot] in #6046
chore(deps): bump aquasecurity/trivy-action from 0.34.1 to 0.35.0 by @dependabot[bot] in #6048
chore(deps): bump anchore/sbom-action from 0.23.0 to 0.23.1 by @dependabot[bot] in #6093
chore(deps): bump distroless/static from 28efbe9 to 47b2d72 by @dependabot[bot] in #6088
chore(deps): bump ubi9/ubi from cecb1cd to 6ed9f6f by @dependabot[bot] in #6087
chore(deps): bump mkdocs-material from 9.7.4 to 9.7.5 in /hack/api-docs by @dependabot[bot] in #6096
chore(deps): bump tornado from 6.5.4 to 6.5.5 in /hack/api-docs by @dependabot[bot] in #6094
chore(deps): bump charset-normalizer from 3.4.5 to 3.4.6 in /hack/api-docs by @dependabot[bot] in #6095
chore(deps): bump step-security/harden-runner from 2.15.1 to 2.16.0 by @dependabot[bot] in #6089
chore(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 by @dependabot[bot] in #6092
chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by @dependabot[bot] in #6090
chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 by @dependabot[bot] in #6091

New Contributors

@othomann made their first contribution in #6052
@evs-secops made their first contribution in #6025
@patjlm made their first contribution in #5922
@jaruwat-panturat made their first contribution in #6068
@chadxz made their first contribution in #6073
@mateenali66 made their first contribution in #6074
@cedricherzog-passbolt made their first contribution in #5919
@johnvox made their first contribution in #6086
@Br1an67 made their first contribution in #6056
@mzdeb made their first contribution in #6058
@lucpas made their first contribution in #6102
@AlexOQ made their first contribution in #5831
@muraliavarma made their first contribution in #5935
@heavyandrew made their first contribution in #5952

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.1.0...v2.2.0

`v2.1.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.1.0
Image: ghcr.io/external-secrets/external-secrets:v2.1.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.1.0-ubi-boringssl

What's Changed

General

chore(release): Update helm chart by @evrardj-roche in #5981
fix: cosign verify does not use signing config by @gusfcarvalho in #5982
docs: Update release process by @evrardj-roche in #5980
fix: allow cross-namespace push with ClusterSecretStore objects by @Skarlso in #5998
feat(charts): add new flag enable leader for cert-manager by @nutmos in #5863
feat(kubernetes): fall back to system CA roots when no CA is configured by @rajsinghtech in #5961
feat: dedup sbom but keep it monolithic by @moolen in #6004
fix: add missing metrics and fundamentally fix the caching logic by @Skarlso in #5894
docs: designate Oracle Vault provider as 'stable' by @anders-swanson in #6020
docs: Oracle Vault provider capabilities by @anders-swanson in #6023
docs(azurekv): cert-manager pushsecret example and cleanups by @illrill in #5972
feat(kubernetes): implement SecretExists by @Saku2 in #5973
fix(charts): Fix wrongly set annotations for cert-controller metrics service by @josemaia in #6029
feat(providers): Nebius MysteryBox integration by @greenmapc in #5868

Dependencies

chore(deps): bump aquasecurity/trivy-action from 0.34.0 to 0.34.1 by @dependabot[bot] in #5986
chore(deps): bump mkdocs-material from 9.7.1 to 9.7.2 in /hack/api-docs by @dependabot[bot] in #5992
chore(deps): bump ubi9/ubi from b8923f5 to cecb1cd by @dependabot[bot] in #5984
chore(deps): bump helm/kind-action from 1.13.0 to 1.14.0 by @dependabot[bot] in #5985
chore(deps): bump actions/dependency-review-action from 4.8.2 to 4.8.3 by @dependabot[bot] in #5990
chore(deps): bump github/codeql-action from 4.32.3 to 4.32.4 by @dependabot[bot] in #5989
chore(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 by @dependabot[bot] in #5987
chore(deps): bump regex from 2026.1.15 to 2026.2.19 in /hack/api-docs by @dependabot[bot] in #5991
chore(deps): bump actions/stale from 10.1.1 to 10.2.0 by @dependabot[bot] in #5988
chore(deps): bump regex from 2026.2.19 to 2026.2.28 in /hack/api-docs by @dependabot[bot] in #6012
chore(deps): bump mkdocs-material from 9.7.2 to 9.7.3 in /hack/api-docs by @dependabot[bot] in #6014
chore(deps): bump step-security/harden-runner from 2.14.2 to 2.15.0 by @dependabot[bot] in #6015
chore(deps): bump anchore/sbom-action from 0.22.2 to 0.23.0 by @dependabot[bot] in #6016
chore(deps): bump certifi from 2026.1.4 to 2026.2.25 in /hack/api-docs by @dependabot[bot] in #6013
chore(deps): bump actions/setup-go from 6.2.0 to 6.3.0 by @dependabot[bot] in #6010
chore(deps): bump hashicorp/setup-terraform from ce70bcf to 5e8dbf3 by @dependabot[bot] in #6011
chore(deps): bump actions/attest-build-provenance from 3.2.0 to 4.1.0 by @dependabot[bot] in #6009
chore(deps): bump distroless/static from 972618c to 28efbe9 by @dependabot[bot] in #6008

New Contributors

@nutmos made their first contribution in #5863
@rajsinghtech made their first contribution in #5961
@illrill made their first contribution in #5972
@Saku2 made their first contribution in #5973
@greenmapc made their first contribution in #5868

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.0.1...v2.1.0

`v2.0.1`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.0.1
Image: ghcr.io/external-secrets/external-secrets:v2.0.1-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.0.1-ubi-boringssl

BREAKING CHANGE

The sprig update is actually a breaking change. It turns out that some of the functions in templating changed with this update.

Looks like it's just the htpasswd function that was renamed.

What's Changed

General

chore: release helm chart for v2.0.0 by @Skarlso in #5932
docs: update the stability doc with the new version by @Skarlso in #5933
chore(doc): add loblaw to adopter md by @FZhg in #5937
chore: bump golang to 1.25.7 because of cve by @Skarlso in #5938
fix: deleting the whole secret when it is empty by @Skarlso in #5927
chore: update controller runtime by @Skarlso in #5930
fix: update cosign and syft for signing by @Skarlso in #5958
fix: the informer can not register use GetInformer instead by @Skarlso in #5931
fix: attempt to fix cosign compatibility issues by @gusfcarvalho in #5959
chore: remove outdated info from stability doc by @Skarlso in #5971
chore(deps): update Masterminds/sprig to 8cb06fe… by @tete17 in #5747
docs(release): Update support matrix by @evrardjp in #5978

Dependencies

chore(deps): bump golang from 20c8a94 to f6751d8 by @dependabot[bot] in #5940
chore(deps): bump ubi9/ubi from c8df11b to b8923f5 by @dependabot[bot] in #5939
chore(deps): bump distroless/static from cd64bec to 972618c by @dependabot[bot] in #5941
chore(deps): bump github/codeql-action from 4.32.0 to 4.32.2 by @dependabot[bot] in #5942
chore(deps): bump anchore/sbom-action from 0.22.1 to 0.22.2 by @dependabot[bot] in #5943
chore(deps): bump step-security/harden-runner from 2.14.1 to 2.14.2 by @dependabot[bot] in #5944
chore(deps): bump zizmorcore/zizmor-action from 0.4.1 to 0.5.0 by @dependabot[bot] in #5945
chore(deps): bump fossas/fossa-action from 1.7.0 to 1.8.0 by @dependabot[bot] in #5946
chore(deps): bump aws-actions/configure-aws-credentials from 5.1.1 to 6.0.0 by @dependabot[bot] in #5947
chore(deps): bump github/codeql-action from 4.32.2 to 4.32.3 by @dependabot[bot] in #5965
chore(deps): bump markdown from 3.10.1 to 3.10.2 in /hack/api-docs by @dependabot[bot] in #5968
chore(deps): bump aquasecurity/trivy-action from 0.33.1 to 0.34.0 by @dependabot[bot] in #5964
chore(deps): bump platformdirs from 4.5.1 to 4.9.2 in /hack/api-docs by @dependabot[bot] in #5967
chore(deps): bump pymdown-extensions from 10.20.1 to 10.21 in /hack/api-docs by @dependabot[bot] in #5969

New Contributors

@FZhg made their first contribution in #5937

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.0.0...v2.0.1

`v2.0.0`

Compare Source

BREAKING CHANGE

Please note that this release removed two of the unsupported and unmaintained providers Alibaba and Device42.

Image: ghcr.io/external-secrets/external-secrets:v2.0.0
Image: ghcr.io/external-secrets/external-secrets:v2.0.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.0.0-ubi-boringssl

What's Changed

General

chore: bump charts to 1.3.2 by @gusfcarvalho in #5923
feat(charts): add hostAliases support by @janlauber in #5866
chore: remove unmaintained secret stores by @Skarlso in #5918
docs(infisical): document al provider auth methods by @varonix0 in #5929
chore: Get validating webhook failurePolicy for Secretstore dynamically by @LochanRn in #5605

New Contributors

@LochanRn made their first contribution in #5605

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v1.3.2...v2.0.0

`v1.3.2`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.3.2
Image: ghcr.io/external-secrets/external-secrets:v1.3.2-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.3.2-ubi-boringssl

What's Changed

General

chore: release helm chart for v1.3.1 by @Skarlso in #5860
chore(chart): Add missing tests for readinessProbe by @jcpunk in #5769
docs: Update FluxCD example by @umizoom in #5862
fix(ci): Removed the unused check for Windows in Makefile by @HauptJ in #5870
docs(release): Add actual dates for EOL of 1.x releases in stability and support page by @n4zukker in #5889
docs: Passbolt provider maintenance ownership by @stripthis in #5886
chore: Update Passbolt MaintenanceStatus to MaintenanceStatusMaintained by @stripthis in #5887
fix(security): sanitize json.Unmarshal errors to prevent secret data … by @moolen in #5884
fix: webhook initialization order by @gusfcarvalho in #5901
chore: Cleanup flags by @evrardj-roche in #5845
fix: onepasswordsdk shared tenant by altering the provider in the client cache by @Skarlso in #5921

Dependencies

chore(deps): bump github/codeql-action from 4.31.10 to 4.31.11 by @dependabot[bot] in #5873
chore(deps): bump pymdown-extensions from 10.20 to 10.20.1 in /hack/api-docs by @dependabot[bot] in #5877
chore(deps): bump markdown from 3.10 to 3.10.1 in /hack/api-docs by @dependabot[bot] in #5880
chore(deps): bump ubi9/ubi from 22e9573 to 1f84f5c by @dependabot[bot] in #5871
chore(deps): bump actions/setup-python from 6.1.0 to 6.2.0 by @dependabot[bot] in #5872
chore(deps): bump hashicorp/setup-terraform from 93d5a27 to dcc3150 by @dependabot[bot] in #5875
chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in #5876
chore(deps): bump step-security/harden-runner from 2.14.0 to 2.14.1 by @dependabot[bot] in #5878
chore(deps): bump anchore/sbom-action from 0.21.1 to 0.22.0 by @dependabot[bot] in #5874
chore(deps): bump packaging from 25.0 to 26.0 in /hack/api-docs by @dependabot[bot] in #5879
chore(deps): bump golang from d9b2e14 to 98e6cff by @dependabot[bot] in #5907
chore(deps): bump alpine from 865b95f to 2510918 in /hack/api-docs by @dependabot[bot] in #5914
chore(deps): bump docker/login-action from 3.6.0 to 3.7.0 by @dependabot[bot] in #5909
chore(deps): bump actions/cache from 5.0.2 to 5.0.3 by @dependabot[bot] in #5912
chore(deps): bump actions/attest-build-provenance from 3.1.0 to 3.2.0 by @dependabot[bot] in #5910
chore(deps): bump hashicorp/setup-terraform from dcc3150 to ce70bcf by @dependabot[bot] in #5911
chore(deps): bump ubi9/ubi from 1f84f5c to c8df11b by @dependabot[bot] in #5908
chore(deps): bump alpine from 3.23.2 to 3.23.3 in /e2e by @dependabot[bot] in #5915
chore(deps): bump alpine from 865b95f to 2510918 by @dependabot[bot] in #5906
chore(deps): bump pathspec from 1.0.3 to 1.0.4 in /hack/api-docs by @dependabot[bot] in #5916
chore(deps): bump babel from 2.17.0 to 2.18.0 in /hack/api-docs by @dependabot[bot] in #5917
chore(deps): bump github/codeql-action from 4.31.11 to 4.32.0 by @dependabot[bot] in #5913

New Contributors

@umizoom made their first contribution in #5862
@HauptJ made their first contribution in #5870
@n4zukker made their first contribution in #5889
@stripthis made their first contribution in #5886

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v1.3.1...v1.3.2

`v1.3.1`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.3.1
Image: ghcr.io/external-secrets/external-secrets:v1.3.1-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.3.1-ubi-boringssl

For a Full release please referre to https://github.com/external-secrets/external-secrets/releases/tag/v1.3.0. This is a fix build for the docker publish flow.

What's Changed

General

fix: ignore the in-toto manifest when promoting the docker build by @Skarlso in #5859

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v1.3.0...v1.3.1

`v1.2.1`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.2.1
Image: ghcr.io/external-secrets/external-secrets:v1.2.1-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.2.1-ubi-boringssl

What's Changed

General

chore(chart): release helm chart 1.2.0 by @jakobmoellerdev in #5751
fix: metrics not being correctly updated and deleted by @Skarlso in #5714
feat(infisical): add caBundle and caProvider support by @wi-adam in #5770
docs(apis): fix inaccurate SecretStore comments (v1 + v1beta1) by @fallmo in #5773
fix: add missing link to the docs by @Skarlso in #5783
fix: for target template parsing for complex matchers by @Skarlso in #5735
fix: a lot of sonar issue fixes by @Skarlso in #5771

Dependencies

chore(deps): bump golang from 2611181 to ac09a5f by @dependabot[bot] in #5758
chore(deps): bump alpine from 3.23.0 to 3.23.2 in /e2e by @dependabot[bot] in #5764
chore(deps): bump importlib-metadata from 8.7.0 to 8.7.1 in /hack/api-docs by @dependabot[bot] in #5768
chore(deps): bump tornado from 6.5.3 to 6.5.4 in /hack/api-docs by @dependabot[bot] in #5767
chore(deps): bump mkdocs-material from 9.7.0 to 9.7.1 in /hack/api-docs by @dependabot[bot] in #5766
chore(deps): bump alpine from 51183f2 to 865b95f in /hack/api-docs by @dependabot[bot] in #5765
chore(deps): bump alpine from 51183f2 to 865b95f by @dependabot[bot] in #5756
chore(deps): bump ubi9/ubi from d4feb57 to 3816d30 by @dependabot[bot] in #5757
chore(deps): bump peter-evans/slash-command-dispatch from 5.0.1 to 5.0.2 by @dependabot[bot] in #5763
chore(deps): bump github/codeql-action from 4.31.8 to 4.31.9 by @dependabot[bot] in #5762
chore(deps): bump actions/attest-build-provenance from 3.0.0 to 3.1.0 by @dependabot[bot] in #5761
chore(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 by @dependabot[bot] in #5760
chore(deps): bump hashicorp/setup-terraform from 071811a to 92e4d08 by @dependabot[bot] in #5759
chore(deps): bump anchore/sbom-action from 0.20.11 to 0.21.0 by @dependabot[bot] in #5784

New Contributors

@wi-adam made their first contribution in #5770
@fallmo made their first contribution in #5773

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v1.2.0...v1.2.1

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | HelmChart | major | `1.2.0` → `2.6.0` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/8) for more information. --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v2.6.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.6.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.5.0...v2.6.0) Image: `ghcr.io/external-secrets/external-secrets:v2.6.0` Image: `ghcr.io/external-secrets/external-secrets:v2.6.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.6.0-ubi-boringssl`  #### What's Changed ##### General - chore: release helm chart 2.5.0 by [@Skarlso](https://github.com/Skarlso) in [#6352](https://github.com/external-secrets/external-secrets/pull/6352) - feat(keeper): implement provider\_api\_calls\_count metric by [@m-k8s](https://github.com/m-k8s) in [#6345](https://github.com/external-secrets/external-secrets/pull/6345) - docs(gcpsm): updates Google Secret Manager authentication guide with WIF usage by [@bharath-b-rh](https://github.com/bharath-b-rh) in [#6356](https://github.com/external-secrets/external-secrets/pull/6356) - feat(release): PB-51302 - External secret should support v5-custom-fields resource type by [@cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) in [#6377](https://github.com/external-secrets/external-secrets/pull/6377) - feat(testing): OpenBao e2e test by [@phil9909](https://github.com/phil9909) in [#6396](https://github.com/external-secrets/external-secrets/pull/6396) - docs: Explanation of our labels by [@evrardj-roche](https://github.com/evrardj-roche) in [#6306](https://github.com/external-secrets/external-secrets/pull/6306) - docs: add AGENTS.md and AI setup guide for ESO by [@rowanruseler](https://github.com/rowanruseler) in [#6141](https://github.com/external-secrets/external-secrets/pull/6141) - fix(makefile): clean up cross-submodule go.mod churn after make test by [@alekc](https://github.com/alekc) in [#6378](https://github.com/external-secrets/external-secrets/pull/6378) - fix(provider): align TokenRequest body namespace with URL namespace by [@alekc](https://github.com/alekc) in [#6420](https://github.com/external-secrets/external-secrets/pull/6420) - fix(build): use buildx --load and non-registry image tag by [@alekc](https://github.com/alekc) in [#6419](https://github.com/external-secrets/external-secrets/pull/6419) - fix(charts): render PDB spec when minAvailable or maxUnavailable is zero by [@blindrood](https://github.com/blindrood) in [#6360](https://github.com/external-secrets/external-secrets/pull/6360) - chore: update go version 1.26.4 by [@Skarlso](https://github.com/Skarlso) in [#6426](https://github.com/external-secrets/external-secrets/pull/6426) ##### Dependencies - chore(deps): bump golang from `91eda97` to `91eda97` by [@dependabot](https://github.com/dependabot)\[bot] in [#6363](https://github.com/external-secrets/external-secrets/pull/6363) - chore(deps): bump pymdown-extensions from 10.21.2 to 10.21.3 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6370](https://github.com/external-secrets/external-secrets/pull/6370) - chore(deps): bump hashicorp/setup-terraform from 4.0.0 to 4.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6364](https://github.com/external-secrets/external-secrets/pull/6364) - chore(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 by [@dependabot](https://github.com/dependabot)\[bot] in [#6365](https://github.com/external-secrets/external-secrets/pull/6365) - chore(deps): bump step-security/harden-runner from 2.19.1 to 2.19.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#6366](https://github.com/external-secrets/external-secrets/pull/6366) - chore(deps): bump github/codeql-action from 4.35.4 to 4.36.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6368](https://github.com/external-secrets/external-secrets/pull/6368) - chore(deps): bump distroless/static from `47b2d72` to `3592aa8` by [@dependabot](https://github.com/dependabot)\[bot] in [#6362](https://github.com/external-secrets/external-secrets/pull/6362) - chore(deps): bump ubi9/ubi from `2323fcf` to `151fc1b` by [@dependabot](https://github.com/dependabot)\[bot] in [#6361](https://github.com/external-secrets/external-secrets/pull/6361) - chore(deps): bump actions/create-github-app-token from 3.1.1 to 3.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6367](https://github.com/external-secrets/external-secrets/pull/6367) - chore(deps): bump idna from 3.14 to 3.16 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6369](https://github.com/external-secrets/external-secrets/pull/6369) - chore(deps): bump golang from `91eda97` to `91eda97` by [@dependabot](https://github.com/dependabot)\[bot] in [#6383](https://github.com/external-secrets/external-secrets/pull/6383) - chore(deps): bump golang from `252599a` to `386d475` in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#6389](https://github.com/external-secrets/external-secrets/pull/6389) - chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6384](https://github.com/external-secrets/external-secrets/pull/6384) - chore(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6387](https://github.com/external-secrets/external-secrets/pull/6387) - chore(deps): bump docker/login-action from 4.1.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6386](https://github.com/external-secrets/external-secrets/pull/6386) - chore(deps): bump actions/stale from 10.2.0 to 10.3.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6388](https://github.com/external-secrets/external-secrets/pull/6388) - chore(deps): bump zipp from 3.23.1 to 4.1.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6390](https://github.com/external-secrets/external-secrets/pull/6390) - chore(deps): bump click from 8.3.3 to 8.4.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6391](https://github.com/external-secrets/external-secrets/pull/6391) - chore(deps): bump certifi from 2026.4.22 to 2026.5.20 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6392](https://github.com/external-secrets/external-secrets/pull/6392) - chore(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6385](https://github.com/external-secrets/external-secrets/pull/6385) - chore(deps): bump requests from 2.33.1 to 2.34.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6372](https://github.com/external-secrets/external-secrets/pull/6372) - chore(deps): bump tornado from 6.5.5 to 6.5.6 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6412](https://github.com/external-secrets/external-secrets/pull/6412) - chore(deps): bump ubi9/ubi from `151fc1b` to `8942b73` by [@dependabot](https://github.com/dependabot)\[bot] in [#6407](https://github.com/external-secrets/external-secrets/pull/6407) - chore(deps): bump aws-actions/configure-aws-credentials from 6.1.1 to 6.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6408](https://github.com/external-secrets/external-secrets/pull/6408) - chore(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6409](https://github.com/external-secrets/external-secrets/pull/6409) - chore(deps): bump idna from 3.16 to 3.17 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6411](https://github.com/external-secrets/external-secrets/pull/6411) #### New Contributors - [@m-k8s](https://github.com/m-k8s) made their first contribution in [#6345](https://github.com/external-secrets/external-secrets/pull/6345) - [@phil9909](https://github.com/phil9909) made their first contribution in [#6396](https://github.com/external-secrets/external-secrets/pull/6396) - [@blindrood](https://github.com/blindrood) made their first contribution in [#6360](https://github.com/external-secrets/external-secrets/pull/6360) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.5.0...v2.6.0> ### [`v2.5.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.5.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.4.1...v2.5.0) Image: `ghcr.io/external-secrets/external-secrets:v2.5.0` Image: `ghcr.io/external-secrets/external-secrets:v2.5.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.5.0-ubi-boringssl`  #### What's Changed ##### General - chore: release chart for v2.4.1 by [@Skarlso](https://github.com/Skarlso) in [#6293](https://github.com/external-secrets/external-secrets/pull/6293) - fix(doc): Adds missing doc reference for VaultDynamicSecret example using GET by [@bharath-b-rh](https://github.com/bharath-b-rh) in [#6296](https://github.com/external-secrets/external-secrets/pull/6296) - feat(charts): make serviceaccounts/token create RBAC rule conditional by [@kriszkern](https://github.com/kriszkern) in [#6295](https://github.com/external-secrets/external-secrets/pull/6295) - ref: delete duplication of applyOwnership logic by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6301](https://github.com/external-secrets/external-secrets/pull/6301) - feat: add Pulumi OIDC-based authentication by [@johnstonmatt](https://github.com/johnstonmatt) in [#5893](https://github.com/external-secrets/external-secrets/pull/5893) - fix: datarace in fake runtime test and push secret test by [@Skarlso](https://github.com/Skarlso) in [#6300](https://github.com/external-secrets/external-secrets/pull/6300) - docs(release): Update docs to build for arm for bitwarden-cli by [@Senk02](https://github.com/Senk02) in [#6312](https://github.com/external-secrets/external-secrets/pull/6312) - feat: add healthz check for liveness probe to cert and webhook by [@Skarlso](https://github.com/Skarlso) in [#6319](https://github.com/external-secrets/external-secrets/pull/6319) - chore: bump go version 1.26.3 by [@Skarlso](https://github.com/Skarlso) in [#6339](https://github.com/external-secrets/external-secrets/pull/6339) - fix(charts): gate externalsecrets write RBAC on processClusterExternalSecret by [@kriszkern](https://github.com/kriszkern) in [#6332](https://github.com/external-secrets/external-secrets/pull/6332) - feat(gcp): issue-5790: optional GCP service account email for WIF impersonation by [@bharath-b-rh](https://github.com/bharath-b-rh) in [#6273](https://github.com/external-secrets/external-secrets/pull/6273) - ref(beyondtrust): BIPS-32651 add API v3.2 support for create Secrets by [@btfhernandez](https://github.com/btfhernandez) in [#6309](https://github.com/external-secrets/external-secrets/pull/6309) - fix(onepassword): return fresh provider instance from NewClient to avoid wrong-vault race by [@duizabojul](https://github.com/duizabojul) in [#6334](https://github.com/external-secrets/external-secrets/pull/6334) - docs: add Rootline to ADOPTERS.md by [@daanschipper](https://github.com/daanschipper) in [#6342](https://github.com/external-secrets/external-secrets/pull/6342) - feat(charts): default scopedNamespace to .Release.Namespace when scopedRBAC is true by [@kriszkern](https://github.com/kriszkern) in [#6343](https://github.com/external-secrets/external-secrets/pull/6343) - docs: add blank lines before lists by [@chlab](https://github.com/chlab) in [#6336](https://github.com/external-secrets/external-secrets/pull/6336) - chore(doc): fix Azure role name typo by [@hobti01](https://github.com/hobti01) in [#6335](https://github.com/external-secrets/external-secrets/pull/6335) - feat(security): Enable Authentication and Authorization for Metrics Endpoint using FilterProvider by [@Zacky3181V](https://github.com/Zacky3181V) in [#5574](https://github.com/external-secrets/external-secrets/pull/5574) - feat: inject kube context as STS session tags by [@robertchildresscfa](https://github.com/robertchildresscfa) in [#6311](https://github.com/external-secrets/external-secrets/pull/6311) - fix(charts): remove stale args guard in controller deployment by [@kriszkern](https://github.com/kriszkern) in [#6347](https://github.com/external-secrets/external-secrets/pull/6347) - fix: provider/infisical provider sub-folder references in remoteRef.key by [@varonix0](https://github.com/varonix0) in [#6338](https://github.com/external-secrets/external-secrets/pull/6338) ##### Dependencies - chore(deps): bump golang from `4f4ab2c` to `47ce563` in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#6286](https://github.com/external-secrets/external-secrets/pull/6286) - chore(deps): bump click from 8.3.2 to 8.3.3 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6287](https://github.com/external-secrets/external-secrets/pull/6287) - chore(deps): bump certifi from 2026.2.25 to 2026.4.22 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6288](https://github.com/external-secrets/external-secrets/pull/6288) - chore(deps): bump pathspec from 1.0.4 to 1.1.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6291](https://github.com/external-secrets/external-secrets/pull/6291) - chore(deps): bump idna from 3.11 to 3.13 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6290](https://github.com/external-secrets/external-secrets/pull/6290) - chore(deps): bump packaging from 26.1 to 26.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6289](https://github.com/external-secrets/external-secrets/pull/6289) - chore(deps): bump step-security/harden-runner from 2.19.0 to 2.19.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6304](https://github.com/external-secrets/external-secrets/pull/6304) - chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#6305](https://github.com/external-secrets/external-secrets/pull/6305) - chore(deps): bump golang from 1.26.2 to 1.26.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#6320](https://github.com/external-secrets/external-secrets/pull/6320) - chore(deps): bump golang from 1.26.2-bookworm to 1.26.3-bookworm in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#6327](https://github.com/external-secrets/external-secrets/pull/6327) - chore(deps): bump ubi9/ubi from `fd3612e` to `2323fcf` by [@dependabot](https://github.com/dependabot)\[bot] in [#6321](https://github.com/external-secrets/external-secrets/pull/6321) - chore(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6322](https://github.com/external-secrets/external-secrets/pull/6322) - chore(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6323](https://github.com/external-secrets/external-secrets/pull/6323) - chore(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6325](https://github.com/external-secrets/external-secrets/pull/6325) - chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#6324](https://github.com/external-secrets/external-secrets/pull/6324) - chore(deps): bump actions/labeler from 6.0.1 to 6.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6326](https://github.com/external-secrets/external-secrets/pull/6326) - chore(deps): bump idna from 3.13 to 3.14 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6328](https://github.com/external-secrets/external-secrets/pull/6328) - chore(deps): bump urllib3 from 2.6.3 to 2.7.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6329](https://github.com/external-secrets/external-secrets/pull/6329) - chore(deps): bump regex from 2026.4.4 to 2026.5.9 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6330](https://github.com/external-secrets/external-secrets/pull/6330) #### New Contributors - [@kriszkern](https://github.com/kriszkern) made their first contribution in [#6295](https://github.com/external-secrets/external-secrets/pull/6295) - [@johnstonmatt](https://github.com/johnstonmatt) made their first contribution in [#5893](https://github.com/external-secrets/external-secrets/pull/5893) - [@Senk02](https://github.com/Senk02) made their first contribution in [#6312](https://github.com/external-secrets/external-secrets/pull/6312) - [@duizabojul](https://github.com/duizabojul) made their first contribution in [#6334](https://github.com/external-secrets/external-secrets/pull/6334) - [@daanschipper](https://github.com/daanschipper) made their first contribution in [#6342](https://github.com/external-secrets/external-secrets/pull/6342) - [@chlab](https://github.com/chlab) made their first contribution in [#6336](https://github.com/external-secrets/external-secrets/pull/6336) - [@hobti01](https://github.com/hobti01) made their first contribution in [#6335](https://github.com/external-secrets/external-secrets/pull/6335) - [@Zacky3181V](https://github.com/Zacky3181V) made their first contribution in [#5574](https://github.com/external-secrets/external-secrets/pull/5574) - [@robertchildresscfa](https://github.com/robertchildresscfa) made their first contribution in [#6311](https://github.com/external-secrets/external-secrets/pull/6311) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.4.1...v2.5.0> ### [`v2.4.1`](https://github.com/external-secrets/external-secrets/releases/tag/v2.4.1) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.4.0...v2.4.1) Image: `ghcr.io/external-secrets/external-secrets:v2.4.1` Image: `ghcr.io/external-secrets/external-secrets:v2.4.1-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.4.1-ubi-boringssl`  #### What's Changed ##### General - chore: release chart for v2.4.0 by [@Skarlso](https://github.com/Skarlso) in [#6277](https://github.com/external-secrets/external-secrets/pull/6277) - feat(gcp): support multiple replicationLocations on PushSecret by [@alliasgher](https://github.com/alliasgher) in [#6225](https://github.com/external-secrets/external-secrets/pull/6225) - feat(passbolt): add custom CA bundle / CA provider support by [@alliasgher](https://github.com/alliasgher) in [#6224](https://github.com/external-secrets/external-secrets/pull/6224) - feat(azure): add contentType support for PushSecret by [@ppatel1604](https://github.com/ppatel1604) in [#6249](https://github.com/external-secrets/external-secrets/pull/6249) - feat(charts): add liveness probes to cert-controller and webhook by [@mattcarp12](https://github.com/mattcarp12) in [#6147](https://github.com/external-secrets/external-secrets/pull/6147) - fix: prevent creation of specific type of secrets by [@Skarlso](https://github.com/Skarlso) in [#6280](https://github.com/external-secrets/external-secrets/pull/6280) ##### Dependencies - chore(deps): bump golang from `f853308` to `f853308` by [@dependabot](https://github.com/dependabot)\[bot] in [#6282](https://github.com/external-secrets/external-secrets/pull/6282) - chore(deps): bump alpine from `2510918` to `5b10f43` in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6285](https://github.com/external-secrets/external-secrets/pull/6285) - chore(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6283](https://github.com/external-secrets/external-secrets/pull/6283) - chore(deps): bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6284](https://github.com/external-secrets/external-secrets/pull/6284) - chore(deps): bump ubi9/ubi from `cf13fe2` to `fd3612e` by [@dependabot](https://github.com/dependabot)\[bot] in [#6281](https://github.com/external-secrets/external-secrets/pull/6281) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.4.0...v2.4.1> ### [`v2.4.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.4.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.3.0...v2.4.0) Image: `ghcr.io/external-secrets/external-secrets:v2.4.0` Image: `ghcr.io/external-secrets/external-secrets:v2.4.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.4.0-ubi-boringssl`  #### What's Changed ##### General - chore: release helm chart for v2.3.0 by [@Skarlso](https://github.com/Skarlso) in [#6204](https://github.com/external-secrets/external-secrets/pull/6204) - fix(docs): hide Scarf tracking pixel to remove page whitespace by [@ppatel1604](https://github.com/ppatel1604) in [#6209](https://github.com/external-secrets/external-secrets/pull/6209) - docs: Add Grafana generator documentation by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6227](https://github.com/external-secrets/external-secrets/pull/6227) - docs: add TLS certificate authentication example for Vault provider by [@alliasgher](https://github.com/alliasgher) in [#6212](https://github.com/external-secrets/external-secrets/pull/6212) - docs(cloudsmith): Improve cloudsmith generator documentation by [@cloudsmith-iduffy](https://github.com/cloudsmith-iduffy) in [#6232](https://github.com/external-secrets/external-secrets/pull/6232) - docs: add missing specs to GeneratorSpec example by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6236](https://github.com/external-secrets/external-secrets/pull/6236) - feat(keeper): implement get secret by id or name by [@tiberiuv](https://github.com/tiberiuv) in [#6163](https://github.com/external-secrets/external-secrets/pull/6163) - chore(secretserver): update dependencies to accept new DelineaXPM/tss-sdk-go by [@DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#6240](https://github.com/external-secrets/external-secrets/pull/6240) - docs(release): update documentation links from /main to /latest by [@cinpol](https://github.com/cinpol) in [#6210](https://github.com/external-secrets/external-secrets/pull/6210) - fix: CAProvider cm access by [@moolen](https://github.com/moolen) in [#6246](https://github.com/external-secrets/external-secrets/pull/6246) - fix(chart): add failurePolicy to ClusterSecretStore webhook by [@ryanjwong](https://github.com/ryanjwong) in [#6247](https://github.com/external-secrets/external-secrets/pull/6247) - feat(dvls): add name support for entries by [@rbstp](https://github.com/rbstp) in [#6099](https://github.com/external-secrets/external-secrets/pull/6099) - fix(akeyless): upgrade akeyless-go-cloud-id to v0.3.7 by [@alikdolg](https://github.com/alikdolg) in [#6248](https://github.com/external-secrets/external-secrets/pull/6248) - chore(deps): bump azure/setup-helm from 3.5 to 5 by [@dependabot](https://github.com/dependabot)\[bot] in [#6258](https://github.com/external-secrets/external-secrets/pull/6258) - fix: do not set tags if undefined by [@Skarlso](https://github.com/Skarlso) in [#6103](https://github.com/external-secrets/external-secrets/pull/6103) - fix(conjur): return error for unimplemented PushSecret and DeleteSecret by [@antonio-mazzini](https://github.com/antonio-mazzini) in [#6266](https://github.com/external-secrets/external-secrets/pull/6266) - docs: Enhance ClusterExternalSecret documentation with "fan-out" approach by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6241](https://github.com/external-secrets/external-secrets/pull/6241) - feat: add --leader-election-id flag to support HA deployments by [@mattcarp12](https://github.com/mattcarp12) in [#6148](https://github.com/external-secrets/external-secrets/pull/6148) - feat(bug): Fix CVE-2026-34165, CVE-2026-33762 and GHSA-3xc5-wrhm-f963 by [@othomann](https://github.com/othomann) in [#6271](https://github.com/external-secrets/external-secrets/pull/6271) - feat: enhance VaultDynamicSecret GET method to support parameters from the spec by [@samm-git](https://github.com/samm-git) in [#6267](https://github.com/external-secrets/external-secrets/pull/6267) - fix: use a separate parameter for GET calls in VaultDynamicSecrets by [@Skarlso](https://github.com/Skarlso) in [#6275](https://github.com/external-secrets/external-secrets/pull/6275) ##### Dependencies - chore(deps): bump golang from `c2a1f7b` to `c2a1f7b` by [@dependabot](https://github.com/dependabot)\[bot] in [#6214](https://github.com/external-secrets/external-secrets/pull/6214) - chore(deps): bump platformdirs from 4.9.4 to 4.9.6 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6219](https://github.com/external-secrets/external-secrets/pull/6219) - chore(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6216](https://github.com/external-secrets/external-secrets/pull/6216) - chore(deps): bump codelytv/pr-size-labeler from 1.10.3 to 1.10.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#6221](https://github.com/external-secrets/external-secrets/pull/6221) - chore(deps): bump ubi9/ubi from `9e6e193` to `039095f` by [@dependabot](https://github.com/dependabot)\[bot] in [#6213](https://github.com/external-secrets/external-secrets/pull/6213) - chore(deps): bump importlib-resources from 6.5.2 to 7.1.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6220](https://github.com/external-secrets/external-secrets/pull/6220) - chore(deps): bump actions/github-script from 8.0.0 to 9.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6215](https://github.com/external-secrets/external-secrets/pull/6215) - chore(deps): bump step-security/harden-runner from 2.16.1 to 2.17.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6217](https://github.com/external-secrets/external-secrets/pull/6217) - chore(deps): bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6218](https://github.com/external-secrets/external-secrets/pull/6218) - chore(deps): bump azure/setup-helm from 3.4 to 3.5 by [@dependabot](https://github.com/dependabot)\[bot] in [#6222](https://github.com/external-secrets/external-secrets/pull/6222) - chore(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6223](https://github.com/external-secrets/external-secrets/pull/6223) - chore(deps): bump golang from `c2a1f7b` to `f853308` by [@dependabot](https://github.com/dependabot)\[bot] in [#6252](https://github.com/external-secrets/external-secrets/pull/6252) - chore(deps): bump alpine from 3.23.3 to 3.23.4 in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#6261](https://github.com/external-secrets/external-secrets/pull/6261) - chore(deps): bump step-security/harden-runner from 2.17.0 to 2.19.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6254](https://github.com/external-secrets/external-secrets/pull/6254) - chore(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#6257](https://github.com/external-secrets/external-secrets/pull/6257) - chore(deps): bump actions/cache from 5.0.4 to 5.0.5 by [@dependabot](https://github.com/dependabot)\[bot] in [#6259](https://github.com/external-secrets/external-secrets/pull/6259) - chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6255](https://github.com/external-secrets/external-secrets/pull/6255) - chore(deps): bump packaging from 26.0 to 26.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6263](https://github.com/external-secrets/external-secrets/pull/6263) - chore(deps): bump zipp from 3.23.0 to 3.23.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6262](https://github.com/external-secrets/external-secrets/pull/6262) - chore(deps): bump alpine from `2510918` to `5b10f43` by [@dependabot](https://github.com/dependabot)\[bot] in [#6251](https://github.com/external-secrets/external-secrets/pull/6251) - chore(deps): bump ubi9/ubi from `039095f` to `cf13fe2` by [@dependabot](https://github.com/dependabot)\[bot] in [#6253](https://github.com/external-secrets/external-secrets/pull/6253) - chore(deps): bump dependabot/fetch-metadata from 3.0.0 to 3.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6260](https://github.com/external-secrets/external-secrets/pull/6260) - chore(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6256](https://github.com/external-secrets/external-secrets/pull/6256) #### New Contributors - [@alliasgher](https://github.com/alliasgher) made their first contribution in [#6212](https://github.com/external-secrets/external-secrets/pull/6212) - [@tiberiuv](https://github.com/tiberiuv) made their first contribution in [#6163](https://github.com/external-secrets/external-secrets/pull/6163) - [@cinpol](https://github.com/cinpol) made their first contribution in [#6210](https://github.com/external-secrets/external-secrets/pull/6210) - [@ryanjwong](https://github.com/ryanjwong) made their first contribution in [#6247](https://github.com/external-secrets/external-secrets/pull/6247) - [@alikdolg](https://github.com/alikdolg) made their first contribution in [#6248](https://github.com/external-secrets/external-secrets/pull/6248) - [@antonio-mazzini](https://github.com/antonio-mazzini) made their first contribution in [#6266](https://github.com/external-secrets/external-secrets/pull/6266) - [@mattcarp12](https://github.com/mattcarp12) made their first contribution in [#6148](https://github.com/external-secrets/external-secrets/pull/6148) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.3.0...v2.4.0> ### [`v2.3.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.3.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.2.0...v2.3.0) Image: `ghcr.io/external-secrets/external-secrets:v2.3.0` Image: `ghcr.io/external-secrets/external-secrets:v2.3.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.3.0-ubi-boringssl`  #### What's Changed ##### General - chore: release charts v2.2.0 by [@riccardomc](https://github.com/riccardomc) in [#6115](https://github.com/external-secrets/external-secrets/pull/6115) - ref(modernize): modernize go code by [@ivankatliarchuk](https://github.com/ivankatliarchuk) in [#6114](https://github.com/external-secrets/external-secrets/pull/6114) - chore: bump bitwarden helm chart version to v0.6.0 by [@Skarlso](https://github.com/Skarlso) in [#6118](https://github.com/external-secrets/external-secrets/pull/6118) - chore: fix EoL in compatiblity table for version 2.2 by [@riccardomc](https://github.com/riccardomc) in [#6128](https://github.com/external-secrets/external-secrets/pull/6128) - docs: add missing jinja2 tags by [@MindTooth](https://github.com/MindTooth) in [#6136](https://github.com/external-secrets/external-secrets/pull/6136) - fix: cached uid after deleting a store by [@Skarlso](https://github.com/Skarlso) in [#6138](https://github.com/external-secrets/external-secrets/pull/6138) - feat(doppler): add ETag-based caching by [@mikesellitto](https://github.com/mikesellitto) in [#5997](https://github.com/external-secrets/external-secrets/pull/5997) - fix(docs): fix metadata structure in Google Secrets Manager docs by [@mruoss](https://github.com/mruoss) in [#6139](https://github.com/external-secrets/external-secrets/pull/6139) - feat: ovh provider implementation by [@ldesauw](https://github.com/ldesauw) in [#6101](https://github.com/external-secrets/external-secrets/pull/6101) - feat(providers): Implement PushSecret for Delinea Secret Server by [@pr0ton11](https://github.com/pr0ton11) in [#6031](https://github.com/external-secrets/external-secrets/pull/6031) - fix: propagate objectMeta and ownerReferences to target resources by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6132](https://github.com/external-secrets/external-secrets/pull/6132) - fix(release): remove docs.check and all relative calls by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6146](https://github.com/external-secrets/external-secrets/pull/6146) - feat: support service account impersonation when using Workload Identity Federation with a k8s service account by [@zoomoid](https://github.com/zoomoid) in [#5707](https://github.com/external-secrets/external-secrets/pull/5707) - fix: remove getHostByName from template funcs by [@moolen](https://github.com/moolen) in [#6164](https://github.com/external-secrets/external-secrets/pull/6164) - ref(kubernetes): move auth package from kubernetes to esutils by [@alekc](https://github.com/alekc) in [#6149](https://github.com/external-secrets/external-secrets/pull/6149) - docs: fix templating.md by [@dangbert](https://github.com/dangbert) in [#6168](https://github.com/external-secrets/external-secrets/pull/6168) - fix(onepasswordsdk): support native 1Password item IDs in findItem by [@LeahArmstrong](https://github.com/LeahArmstrong) in [#6167](https://github.com/external-secrets/external-secrets/pull/6167) - docs(ovhcloud): fix heterogeneous configuration documentation by [@ldesauw](https://github.com/ldesauw) in [#6169](https://github.com/external-secrets/external-secrets/pull/6169) - docs: add OVHcloud in ADOPTERS by [@scraly](https://github.com/scraly) in [#6172](https://github.com/external-secrets/external-secrets/pull/6172) - fix(docs): resolve macro syntax error in templating guide by [@ManvithaP-hub](https://github.com/ManvithaP-hub) in [#6171](https://github.com/external-secrets/external-secrets/pull/6171) - chore: rip out sprig dependency by [@Skarlso](https://github.com/Skarlso) in [#6170](https://github.com/external-secrets/external-secrets/pull/6170) - chore: fix jose cve by [@Skarlso](https://github.com/Skarlso) in [#6178](https://github.com/external-secrets/external-secrets/pull/6178) - docs: document correct htpasswd function usage by [@Atomsoldat](https://github.com/Atomsoldat) in [#6177](https://github.com/external-secrets/external-secrets/pull/6177) - feat(pushsecret): add dataTo support for bulk secret pushing by [@mohamed-rekiba](https://github.com/mohamed-rekiba) in [#5850](https://github.com/external-secrets/external-secrets/pull/5850) - docs: add existing blog post: ESO integration with ovhcloud secret manager with vault provider by [@scraly](https://github.com/scraly) in [#6190](https://github.com/external-secrets/external-secrets/pull/6190) - feat: move experimental-enable-vault-token-cache out of experimental and add expiry to validation by [@sfotony](https://github.com/sfotony) in [#5397](https://github.com/external-secrets/external-secrets/pull/5397) - fix: prevent feedback loop by [@moolen](https://github.com/moolen) in [#6021](https://github.com/external-secrets/external-secrets/pull/6021) - fix: code scanning issues by [@Skarlso](https://github.com/Skarlso) in [#6063](https://github.com/external-secrets/external-secrets/pull/6063) - feat: add source null byte policy by [@knelasevero](https://github.com/knelasevero) in [#6194](https://github.com/external-secrets/external-secrets/pull/6194) - fix(test): fix broken test from automerge rebase by [@knelasevero](https://github.com/knelasevero) in [#6199](https://github.com/external-secrets/external-secrets/pull/6199) - fix(aws): handle empty resource policy in PushSecret for SecretsManager by [@maks3201](https://github.com/maks3201) in [#6145](https://github.com/external-secrets/external-secrets/pull/6145) - feat(github): add orgSecretVisibility field to GithubProvider by [@iamnoah](https://github.com/iamnoah) in [#6202](https://github.com/external-secrets/external-secrets/pull/6202) - feat(onepasswordSDK): multi-field and complete PushSecret by [@Dariusch](https://github.com/Dariusch) in [#6187](https://github.com/external-secrets/external-secrets/pull/6187) - feat(vault): add VaultRole attribute for TLS auth by [@RicoGunawan12](https://github.com/RicoGunawan12) in [#6160](https://github.com/external-secrets/external-secrets/pull/6160) - chore: bump go version to 1.26.2 by [@Skarlso](https://github.com/Skarlso) in [#6203](https://github.com/external-secrets/external-secrets/pull/6203) ##### Dependencies - chore(deps): bump actions/cache from 5.0.3 to 5.0.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#6121](https://github.com/external-secrets/external-secrets/pull/6121) - chore(deps): bump mkdocs-material from 9.7.5 to 9.7.6 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6125](https://github.com/external-secrets/external-secrets/pull/6125) - chore(deps): bump ubi9/ubi from `6ed9f6f` to `1fc04e8` by [@dependabot](https://github.com/dependabot)\[bot] in [#6119](https://github.com/external-secrets/external-secrets/pull/6119) - chore(deps): bump azure/login from 2.3.0 to 3.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6120](https://github.com/external-secrets/external-secrets/pull/6120) - chore(deps): bump codecov/codecov-action from 5.5.2 to 5.5.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#6124](https://github.com/external-secrets/external-secrets/pull/6124) - chore(deps): bump github/codeql-action from 4.32.6 to 4.34.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6122](https://github.com/external-secrets/external-secrets/pull/6122) - chore(deps): bump anchore/sbom-action from 0.23.1 to 0.24.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6123](https://github.com/external-secrets/external-secrets/pull/6123) - chore(deps): bump importlib-metadata from 8.7.1 to 9.0.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6126](https://github.com/external-secrets/external-secrets/pull/6126) - chore(deps): bump sigstore/cosign-installer from 4.1.0 to 4.1.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6154](https://github.com/external-secrets/external-secrets/pull/6154) - chore(deps): bump pymdown-extensions from 10.21 to 10.21.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6157](https://github.com/external-secrets/external-secrets/pull/6157) - chore(deps): bump actions/setup-go from 6.3.0 to 6.4.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6151](https://github.com/external-secrets/external-secrets/pull/6151) - chore(deps): bump github/codeql-action from 4.34.1 to 4.35.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6152](https://github.com/external-secrets/external-secrets/pull/6152) - chore(deps): bump dependabot/fetch-metadata from 2.5.0 to 3.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6153](https://github.com/external-secrets/external-secrets/pull/6153) - chore(deps): bump pygments from 2.19.2 to 2.20.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6155](https://github.com/external-secrets/external-secrets/pull/6155) - chore(deps): bump regex from 2026.2.28 to 2026.3.32 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6156](https://github.com/external-secrets/external-secrets/pull/6156) - chore(deps): bump requests from 2.32.5 to 2.33.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6158](https://github.com/external-secrets/external-secrets/pull/6158) - chore(deps): bump ubi9/ubi from `1fc04e8` to `9e6e193` by [@dependabot](https://github.com/dependabot)\[bot] in [#6150](https://github.com/external-secrets/external-secrets/pull/6150) - chore(deps): bump step-security/harden-runner from 2.16.0 to 2.16.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6180](https://github.com/external-secrets/external-secrets/pull/6180) - chore(deps): bump charset-normalizer from 3.4.6 to 3.4.7 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6183](https://github.com/external-secrets/external-secrets/pull/6183) - chore(deps): bump click from 8.3.1 to 8.3.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6185](https://github.com/external-secrets/external-secrets/pull/6185) - chore(deps): bump fossas/fossa-action from 1.8.0 to 1.9.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6181](https://github.com/external-secrets/external-secrets/pull/6181) - chore(deps): bump docker/login-action from 4.0.0 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6182](https://github.com/external-secrets/external-secrets/pull/6182) - chore(deps): bump regex from 2026.3.32 to 2026.4.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6184](https://github.com/external-secrets/external-secrets/pull/6184) #### New Contributors - [@MindTooth](https://github.com/MindTooth) made their first contribution in [#6136](https://github.com/external-secrets/external-secrets/pull/6136) - [@ldesauw](https://github.com/ldesauw) made their first contribution in [#6101](https://github.com/external-secrets/external-secrets/pull/6101) - [@pr0ton11](https://github.com/pr0ton11) made their first contribution in [#6031](https://github.com/external-secrets/external-secrets/pull/6031) - [@zoomoid](https://github.com/zoomoid) made their first contribution in [#5707](https://github.com/external-secrets/external-secrets/pull/5707) - [@dangbert](https://github.com/dangbert) made their first contribution in [#6168](https://github.com/external-secrets/external-secrets/pull/6168) - [@LeahArmstrong](https://github.com/LeahArmstrong) made their first contribution in [#6167](https://github.com/external-secrets/external-secrets/pull/6167) - [@scraly](https://github.com/scraly) made their first contribution in [#6172](https://github.com/external-secrets/external-secrets/pull/6172) - [@ManvithaP-hub](https://github.com/ManvithaP-hub) made their first contribution in [#6171](https://github.com/external-secrets/external-secrets/pull/6171) - [@Atomsoldat](https://github.com/Atomsoldat) made their first contribution in [#6177](https://github.com/external-secrets/external-secrets/pull/6177) - [@mohamed-rekiba](https://github.com/mohamed-rekiba) made their first contribution in [#5850](https://github.com/external-secrets/external-secrets/pull/5850) - [@sfotony](https://github.com/sfotony) made their first contribution in [#5397](https://github.com/external-secrets/external-secrets/pull/5397) - [@maks3201](https://github.com/maks3201) made their first contribution in [#6145](https://github.com/external-secrets/external-secrets/pull/6145) - [@iamnoah](https://github.com/iamnoah) made their first contribution in [#6202](https://github.com/external-secrets/external-secrets/pull/6202) - [@RicoGunawan12](https://github.com/RicoGunawan12) made their first contribution in [#6160](https://github.com/external-secrets/external-secrets/pull/6160) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.2.0...v2.3.0> ### [`v2.2.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.2.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.1.0...v2.2.0) Image: `ghcr.io/external-secrets/external-secrets:v2.2.0` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi-boringssl` ### Breaking change If you are using Flux + OCIRepository to fetch External Secrets Operator charts, please update your object to use a Layer selector: ```yaml apiVersion: source.toolkit.fluxcd.io/v1 kind: OCIRepository metadata: name: eso-oci spec: interval: 1m0s provider: generic ref: tag: 2.2.0 url: oci://ghcr.io/external-secrets/charts/external-secrets layerSelector: mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip" operation: extract ```  #### What's Changed ##### General - chore: release charts v2.1.0 by [@Skarlso](https://github.com/Skarlso) in [#6030](https://github.com/external-secrets/external-secrets/pull/6030) - chore: fix the stability doc by [@Skarlso](https://github.com/Skarlso) in [#6035](https://github.com/external-secrets/external-secrets/pull/6035) - fix(security): Fix vulnerabilities by [@othomann](https://github.com/othomann) in [#6052](https://github.com/external-secrets/external-secrets/pull/6052) - fix(aws): sync tags and resource policy even when secret value unchanged by [@evs-secops](https://github.com/evs-secops) in [#6025](https://github.com/external-secrets/external-secrets/pull/6025) - fix: publish now uses docker build v4 which required some changes by [@Skarlso](https://github.com/Skarlso) in [#6062](https://github.com/external-secrets/external-secrets/pull/6062) - feat(gcpsm): auto-detect projectID from GCP metadata server by [@patjlm](https://github.com/patjlm) in [#5922](https://github.com/external-secrets/external-secrets/pull/5922) - chore(templating): Remove years in license and their checks by [@evrardj-roche](https://github.com/evrardj-roche) in [#5955](https://github.com/external-secrets/external-secrets/pull/5955) - docs: Add Roche to official ADOPTERS by [@evrardj-roche](https://github.com/evrardj-roche) in [#6076](https://github.com/external-secrets/external-secrets/pull/6076) - feat: Add Last Sync column to ExternalSecret and PushSecret printers by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6068](https://github.com/external-secrets/external-secrets/pull/6068) - fix(onepassword): support native item IDs by [@chadxz](https://github.com/chadxz) in [#6073](https://github.com/external-secrets/external-secrets/pull/6073) - feat: extract LGTM processor to external JS file with tests by [@mateenali66](https://github.com/mateenali66) in [#6074](https://github.com/external-secrets/external-secrets/pull/6074) - feat: fail fast if LGTM label does not exist in repository by [@mateenali66](https://github.com/mateenali66) in [#6078](https://github.com/external-secrets/external-secrets/pull/6078) - feat(passbolt): add support for Passbolt V5 API by [@cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) in [#5919](https://github.com/external-secrets/external-secrets/pull/5919) - fix(infisical): dataFrom.find.path should filter by secret path not name by [@johnvox](https://github.com/johnvox) in [#6086](https://github.com/external-secrets/external-secrets/pull/6086) - fix: disable the priority queue which misbehaves at scale by [@Skarlso](https://github.com/Skarlso) in [#6083](https://github.com/external-secrets/external-secrets/pull/6083) - chore: update go version to 1.26.1 by [@Skarlso](https://github.com/Skarlso) in [#6072](https://github.com/external-secrets/external-secrets/pull/6072) - docs(aws): fix PushSecret metadata indentation in resource policy exa... by [@Br1an67](https://github.com/Br1an67) in [#6056](https://github.com/external-secrets/external-secrets/pull/6056) - fix(aws): prevent EC2 IMDS fallback when explicit credentials are pro... by [@Br1an67](https://github.com/Br1an67) in [#6036](https://github.com/external-secrets/external-secrets/pull/6036) - feat(templating): Add certSANs function to extract SANs from certificates by [@mzdeb](https://github.com/mzdeb) in [#6058](https://github.com/external-secrets/external-secrets/pull/6058) - docs: document template.metadata labels/annotations behavior by [@lucpas](https://github.com/lucpas) in [#6102](https://github.com/external-secrets/external-secrets/pull/6102) - fix: CODEOWNERS are seriously out of date by [@Skarlso](https://github.com/Skarlso) in [#6106](https://github.com/external-secrets/external-secrets/pull/6106) - feat(helm): add readinessProbe support for external-secrets deployment by [@AlexOQ](https://github.com/AlexOQ) in [#5831](https://github.com/external-secrets/external-secrets/pull/5831) - fix: update grpc for CVE-2026-33186 by [@Skarlso](https://github.com/Skarlso) in [#6108](https://github.com/external-secrets/external-secrets/pull/6108) - feat(azurekv): add expiration time to azure kv secret by [@muraliavarma](https://github.com/muraliavarma) in [#5935](https://github.com/external-secrets/external-secrets/pull/5935) - feat: add path to cloud.ru provider by [@heavyandrew](https://github.com/heavyandrew) in [#5952](https://github.com/external-secrets/external-secrets/pull/5952) - fix(add-eso-version): fix separator line pattern in add\_eso\_version.sh script by [@riccardomc](https://github.com/riccardomc) in [#6113](https://github.com/external-secrets/external-secrets/pull/6113) ##### Dependencies - chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6038](https://github.com/external-secrets/external-secrets/pull/6038) - chore(deps): bump charset-normalizer from 3.4.4 to 3.4.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6047](https://github.com/external-secrets/external-secrets/pull/6047) - chore(deps): bump platformdirs from 4.9.2 to 4.9.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6050](https://github.com/external-secrets/external-secrets/pull/6050) - chore(deps): bump mkdocs-material from 9.7.3 to 9.7.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6049](https://github.com/external-secrets/external-secrets/pull/6049) - chore(deps): bump github/codeql-action from 4.32.4 to 4.32.6 by [@dependabot](https://github.com/dependabot)\[bot] in [#6039](https://github.com/external-secrets/external-secrets/pull/6039) - chore(deps): bump step-security/harden-runner from 2.15.0 to 2.15.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6043](https://github.com/external-secrets/external-secrets/pull/6043) - chore(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6040](https://github.com/external-secrets/external-secrets/pull/6040) - chore(deps): bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6044](https://github.com/external-secrets/external-secrets/pull/6044) - chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6042](https://github.com/external-secrets/external-secrets/pull/6042) - chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6041](https://github.com/external-secrets/external-secrets/pull/6041) - chore(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6046](https://github.com/external-secrets/external-secrets/pull/6046) - chore(deps): bump aquasecurity/trivy-action from 0.34.1 to 0.35.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6048](https://github.com/external-secrets/external-secrets/pull/6048) - chore(deps): bump anchore/sbom-action from 0.23.0 to 0.23.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6093](https://github.com/external-secrets/external-secrets/pull/6093) - chore(deps): bump distroless/static from `28efbe9` to `47b2d72` by [@dependabot](https://github.com/dependabot)\[bot] in [#6088](https://github.com/external-secrets/external-secrets/pull/6088) - chore(deps): bump ubi9/ubi from `cecb1cd` to `6ed9f6f` by [@dependabot](https://github.com/dependabot)\[bot] in [#6087](https://github.com/external-secrets/external-secrets/pull/6087) - chore(deps): bump mkdocs-material from 9.7.4 to 9.7.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6096](https://github.com/external-secrets/external-secrets/pull/6096) - chore(deps): bump tornado from 6.5.4 to 6.5.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6094](https://github.com/external-secrets/external-secrets/pull/6094) - chore(deps): bump charset-normalizer from 3.4.5 to 3.4.6 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6095](https://github.com/external-secrets/external-secrets/pull/6095) - chore(deps): bump step-security/harden-runner from 2.15.1 to 2.16.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6089](https://github.com/external-secrets/external-secrets/pull/6089) - chore(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6092](https://github.com/external-secrets/external-secrets/pull/6092) - chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6090](https://github.com/external-secrets/external-secrets/pull/6090) - chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6091](https://github.com/external-secrets/external-secrets/pull/6091) #### New Contributors - [@othomann](https://github.com/othomann) made their first contribution in [#6052](https://github.com/external-secrets/external-secrets/pull/6052) - [@evs-secops](https://github.com/evs-secops) made their first contribution in [#6025](https://github.com/external-secrets/external-secrets/pull/6025) - [@patjlm](https://github.com/patjlm) made their first contribution in [#5922](https://github.com/external-secrets/external-secrets/pull/5922) - [@jaruwat-panturat](https://github.com/jaruwat-panturat) made their first contribution in [#6068](https://github.com/external-secrets/external-secrets/pull/6068) - [@chadxz](https://github.com/chadxz) made their first contribution in [#6073](https://github.com/external-secrets/external-secrets/pull/6073) - [@mateenali66](https://github.com/mateenali66) made their first contribution in [#6074](https://github.com/external-secrets/external-secrets/pull/6074) - [@cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) made their first contribution in [#5919](https://github.com/external-secrets/external-secrets/pull/5919) - [@johnvox](https://github.com/johnvox) made their first contribution in [#6086](https://github.com/external-secrets/external-secrets/pull/6086) - [@Br1an67](https://github.com/Br1an67) made their first contribution in [#6056](https://github.com/external-secrets/external-secrets/pull/6056) - [@mzdeb](https://github.com/mzdeb) made their first contribution in [#6058](https://github.com/external-secrets/external-secrets/pull/6058) - [@lucpas](https://github.com/lucpas) made their first contribution in [#6102](https://github.com/external-secrets/external-secrets/pull/6102) - [@AlexOQ](https://github.com/AlexOQ) made their first contribution in [#5831](https://github.com/external-secrets/external-secrets/pull/5831) - [@muraliavarma](https://github.com/muraliavarma) made their first contribution in [#5935](https://github.com/external-secrets/external-secrets/pull/5935) - [@heavyandrew](https://github.com/heavyandrew) made their first contribution in [#5952](https://github.com/external-secrets/external-secrets/pull/5952) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.1.0...v2.2.0> ### [`v2.1.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.1.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.0.1...v2.1.0) Image: `ghcr.io/external-secrets/external-secrets:v2.1.0` Image: `ghcr.io/external-secrets/external-secrets:v2.1.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.1.0-ubi-boringssl`  #### What's Changed ##### General - chore(release): Update helm chart by [@evrardj-roche](https://github.com/evrardj-roche) in [#5981](https://github.com/external-secrets/external-secrets/pull/5981) - fix: cosign verify does not use signing config by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5982](https://github.com/external-secrets/external-secrets/pull/5982) - docs: Update release process by [@evrardj-roche](https://github.com/evrardj-roche) in [#5980](https://github.com/external-secrets/external-secrets/pull/5980) - fix: allow cross-namespace push with ClusterSecretStore objects by [@Skarlso](https://github.com/Skarlso) in [#5998](https://github.com/external-secrets/external-secrets/pull/5998) - feat(charts): add new flag enable leader for cert-manager by [@nutmos](https://github.com/nutmos) in [#5863](https://github.com/external-secrets/external-secrets/pull/5863) - feat(kubernetes): fall back to system CA roots when no CA is configured by [@rajsinghtech](https://github.com/rajsinghtech) in [#5961](https://github.com/external-secrets/external-secrets/pull/5961) - feat: dedup sbom but keep it monolithic by [@moolen](https://github.com/moolen) in [#6004](https://github.com/external-secrets/external-secrets/pull/6004) - fix: add missing metrics and fundamentally fix the caching logic by [@Skarlso](https://github.com/Skarlso) in [#5894](https://github.com/external-secrets/external-secrets/pull/5894) - docs: designate Oracle Vault provider as 'stable' by [@anders-swanson](https://github.com/anders-swanson) in [#6020](https://github.com/external-secrets/external-secrets/pull/6020) - docs: Oracle Vault provider capabilities by [@anders-swanson](https://github.com/anders-swanson) in [#6023](https://github.com/external-secrets/external-secrets/pull/6023) - docs(azurekv): cert-manager pushsecret example and cleanups by [@illrill](https://github.com/illrill) in [#5972](https://github.com/external-secrets/external-secrets/pull/5972) - feat(kubernetes): implement SecretExists by [@Saku2](https://github.com/Saku2) in [#5973](https://github.com/external-secrets/external-secrets/pull/5973) - fix(charts): Fix wrongly set annotations for cert-controller metrics service by [@josemaia](https://github.com/josemaia) in [#6029](https://github.com/external-secrets/external-secrets/pull/6029) - feat(providers): Nebius MysteryBox integration by [@greenmapc](https://github.com/greenmapc) in [#5868](https://github.com/external-secrets/external-secrets/pull/5868) ##### Dependencies - chore(deps): bump aquasecurity/trivy-action from 0.34.0 to 0.34.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5986](https://github.com/external-secrets/external-secrets/pull/5986) - chore(deps): bump mkdocs-material from 9.7.1 to 9.7.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5992](https://github.com/external-secrets/external-secrets/pull/5992) - chore(deps): bump ubi9/ubi from `b8923f5` to `cecb1cd` by [@dependabot](https://github.com/dependabot)\[bot] in [#5984](https://github.com/external-secrets/external-secrets/pull/5984) - chore(deps): bump helm/kind-action from 1.13.0 to 1.14.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5985](https://github.com/external-secrets/external-secrets/pull/5985) - chore(deps): bump actions/dependency-review-action from 4.8.2 to 4.8.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5990](https://github.com/external-secrets/external-secrets/pull/5990) - chore(deps): bump github/codeql-action from 4.32.3 to 4.32.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#5989](https://github.com/external-secrets/external-secrets/pull/5989) - chore(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5987](https://github.com/external-secrets/external-secrets/pull/5987) - chore(deps): bump regex from 2026.1.15 to 2026.2.19 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5991](https://github.com/external-secrets/external-secrets/pull/5991) - chore(deps): bump actions/stale from 10.1.1 to 10.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5988](https://github.com/external-secrets/external-secrets/pull/5988) - chore(deps): bump regex from 2026.2.19 to 2026.2.28 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6012](https://github.com/external-secrets/external-secrets/pull/6012) - chore(deps): bump mkdocs-material from 9.7.2 to 9.7.3 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6014](https://github.com/external-secrets/external-secrets/pull/6014) - chore(deps): bump step-security/harden-runner from 2.14.2 to 2.15.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6015](https://github.com/external-secrets/external-secrets/pull/6015) - chore(deps): bump anchore/sbom-action from 0.22.2 to 0.23.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6016](https://github.com/external-secrets/external-secrets/pull/6016) - chore(deps): bump certifi from 2026.1.4 to 2026.2.25 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6013](https://github.com/external-secrets/external-secrets/pull/6013) - chore(deps): bump actions/setup-go from 6.2.0 to 6.3.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6010](https://github.com/external-secrets/external-secrets/pull/6010) - chore(deps): bump hashicorp/setup-terraform from [`ce70bcf`](https://github.com/external-secrets/external-secrets/commit/ce70bcf31a3711a1efd50b61e7216b0196b6f4f1) to [`5e8dbf3`](https://github.com/external-secrets/external-secrets/commit/5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85) by [@dependabot](https://github.com/dependabot)\[bot] in [#6011](https://github.com/external-secrets/external-secrets/pull/6011) - chore(deps): bump actions/attest-build-provenance from 3.2.0 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6009](https://github.com/external-secrets/external-secrets/pull/6009) - chore(deps): bump distroless/static from `972618c` to `28efbe9` by [@dependabot](https://github.com/dependabot)\[bot] in [#6008](https://github.com/external-secrets/external-secrets/pull/6008) #### New Contributors - [@nutmos](https://github.com/nutmos) made their first contribution in [#5863](https://github.com/external-secrets/external-secrets/pull/5863) - [@rajsinghtech](https://github.com/rajsinghtech) made their first contribution in [#5961](https://github.com/external-secrets/external-secrets/pull/5961) - [@illrill](https://github.com/illrill) made their first contribution in [#5972](https://github.com/external-secrets/external-secrets/pull/5972) - [@Saku2](https://github.com/Saku2) made their first contribution in [#5973](https://github.com/external-secrets/external-secrets/pull/5973) - [@greenmapc](https://github.com/greenmapc) made their first contribution in [#5868](https://github.com/external-secrets/external-secrets/pull/5868) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.0.1...v2.1.0> ### [`v2.0.1`](https://github.com/external-secrets/external-secrets/releases/tag/v2.0.1) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.0.0...v2.0.1) Image: `ghcr.io/external-secrets/external-secrets:v2.0.1` Image: `ghcr.io/external-secrets/external-secrets:v2.0.1-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.0.1-ubi-boringssl` ### BREAKING CHANGE The sprig update is actually a breaking change. It turns out that some of the functions in templating changed with this update. Looks like it's just the `htpasswd` function that was renamed.  #### What's Changed ##### General - chore: release helm chart for v2.0.0 by [@Skarlso](https://github.com/Skarlso) in [#5932](https://github.com/external-secrets/external-secrets/pull/5932) - docs: update the stability doc with the new version by [@Skarlso](https://github.com/Skarlso) in [#5933](https://github.com/external-secrets/external-secrets/pull/5933) - chore(doc): add loblaw to adopter md by [@FZhg](https://github.com/FZhg) in [#5937](https://github.com/external-secrets/external-secrets/pull/5937) - chore: bump golang to 1.25.7 because of cve by [@Skarlso](https://github.com/Skarlso) in [#5938](https://github.com/external-secrets/external-secrets/pull/5938) - fix: deleting the whole secret when it is empty by [@Skarlso](https://github.com/Skarlso) in [#5927](https://github.com/external-secrets/external-secrets/pull/5927) - chore: update controller runtime by [@Skarlso](https://github.com/Skarlso) in [#5930](https://github.com/external-secrets/external-secrets/pull/5930) - fix: update cosign and syft for signing by [@Skarlso](https://github.com/Skarlso) in [#5958](https://github.com/external-secrets/external-secrets/pull/5958) - fix: the informer can not register use GetInformer instead by [@Skarlso](https://github.com/Skarlso) in [#5931](https://github.com/external-secrets/external-secrets/pull/5931) - fix: attempt to fix cosign compatibility issues by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5959](https://github.com/external-secrets/external-secrets/pull/5959) - chore: remove outdated info from stability doc by [@Skarlso](https://github.com/Skarlso) in [#5971](https://github.com/external-secrets/external-secrets/pull/5971) - chore(deps): update Masterminds/sprig to [`8cb06fe`](https://github.com/external-secrets/external-secrets/commit/8cb06fe3c8b0f1163c26b0a55866)… by [@tete17](https://github.com/tete17) in [#5747](https://github.com/external-secrets/external-secrets/pull/5747) - docs(release): Update support matrix by [@evrardjp](https://github.com/evrardjp) in [#5978](https://github.com/external-secrets/external-secrets/pull/5978) ##### Dependencies - chore(deps): bump golang from `20c8a94` to `f6751d8` by [@dependabot](https://github.com/dependabot)\[bot] in [#5940](https://github.com/external-secrets/external-secrets/pull/5940) - chore(deps): bump ubi9/ubi from `c8df11b` to `b8923f5` by [@dependabot](https://github.com/dependabot)\[bot] in [#5939](https://github.com/external-secrets/external-secrets/pull/5939) - chore(deps): bump distroless/static from `cd64bec` to `972618c` by [@dependabot](https://github.com/dependabot)\[bot] in [#5941](https://github.com/external-secrets/external-secrets/pull/5941) - chore(deps): bump github/codeql-action from 4.32.0 to 4.32.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5942](https://github.com/external-secrets/external-secrets/pull/5942) - chore(deps): bump anchore/sbom-action from 0.22.1 to 0.22.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5943](https://github.com/external-secrets/external-secrets/pull/5943) - chore(deps): bump step-security/harden-runner from 2.14.1 to 2.14.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5944](https://github.com/external-secrets/external-secrets/pull/5944) - chore(deps): bump zizmorcore/zizmor-action from 0.4.1 to 0.5.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5945](https://github.com/external-secrets/external-secrets/pull/5945) - chore(deps): bump fossas/fossa-action from 1.7.0 to 1.8.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5946](https://github.com/external-secrets/external-secrets/pull/5946) - chore(deps): bump aws-actions/configure-aws-credentials from 5.1.1 to 6.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5947](https://github.com/external-secrets/external-secrets/pull/5947) - chore(deps): bump github/codeql-action from 4.32.2 to 4.32.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5965](https://github.com/external-secrets/external-secrets/pull/5965) - chore(deps): bump markdown from 3.10.1 to 3.10.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5968](https://github.com/external-secrets/external-secrets/pull/5968) - chore(deps): bump aquasecurity/trivy-action from 0.33.1 to 0.34.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5964](https://github.com/external-secrets/external-secrets/pull/5964) - chore(deps): bump platformdirs from 4.5.1 to 4.9.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5967](https://github.com/external-secrets/external-secrets/pull/5967) - chore(deps): bump pymdown-extensions from 10.20.1 to 10.21 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5969](https://github.com/external-secrets/external-secrets/pull/5969) #### New Contributors - [@FZhg](https://github.com/FZhg) made their first contribution in [#5937](https://github.com/external-secrets/external-secrets/pull/5937) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.0.0...v2.0.1> ### [`v2.0.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.0.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v1.3.2...v2.0.0) ### BREAKING CHANGE Please note that this release removed two of the unsupported and unmaintained providers Alibaba and Device42. Image: `ghcr.io/external-secrets/external-secrets:v2.0.0` Image: `ghcr.io/external-secrets/external-secrets:v2.0.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.0.0-ubi-boringssl`  #### What's Changed ##### General - chore: bump charts to 1.3.2 by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5923](https://github.com/external-secrets/external-secrets/pull/5923) - feat(charts): add hostAliases support by [@janlauber](https://github.com/janlauber) in [#5866](https://github.com/external-secrets/external-secrets/pull/5866) - chore: remove unmaintained secret stores by [@Skarlso](https://github.com/Skarlso) in [#5918](https://github.com/external-secrets/external-secrets/pull/5918) - docs(infisical): document al provider auth methods by [@varonix0](https://github.com/varonix0) in [#5929](https://github.com/external-secrets/external-secrets/pull/5929) - chore: Get validating webhook failurePolicy for Secretstore dynamically by [@LochanRn](https://github.com/LochanRn) in [#5605](https://github.com/external-secrets/external-secrets/pull/5605) #### New Contributors - [@LochanRn](https://github.com/LochanRn) made their first contribution in [#5605](https://github.com/external-secrets/external-secrets/pull/5605) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v1.3.2...v2.0.0> ### [`v1.3.2`](https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v1.3.1...v1.3.2) Image: `ghcr.io/external-secrets/external-secrets:v1.3.2` Image: `ghcr.io/external-secrets/external-secrets:v1.3.2-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.3.2-ubi-boringssl`  #### What's Changed ##### General - chore: release helm chart for v1.3.1 by [@Skarlso](https://github.com/Skarlso) in [#5860](https://github.com/external-secrets/external-secrets/pull/5860) - chore(chart): Add missing tests for readinessProbe by [@jcpunk](https://github.com/jcpunk) in [#5769](https://github.com/external-secrets/external-secrets/pull/5769) - docs: Update FluxCD example by [@umizoom](https://github.com/umizoom) in [#5862](https://github.com/external-secrets/external-secrets/pull/5862) - fix(ci): Removed the unused check for Windows in Makefile by [@HauptJ](https://github.com/HauptJ) in [#5870](https://github.com/external-secrets/external-secrets/pull/5870) - docs(release): Add actual dates for EOL of 1.x releases in stability and support page by [@n4zukker](https://github.com/n4zukker) in [#5889](https://github.com/external-secrets/external-secrets/pull/5889) - docs: Passbolt provider maintenance ownership by [@stripthis](https://github.com/stripthis) in [#5886](https://github.com/external-secrets/external-secrets/pull/5886) - chore: Update Passbolt MaintenanceStatus to MaintenanceStatusMaintained by [@stripthis](https://github.com/stripthis) in [#5887](https://github.com/external-secrets/external-secrets/pull/5887) - fix(security): sanitize json.Unmarshal errors to prevent secret data … by [@moolen](https://github.com/moolen) in [#5884](https://github.com/external-secrets/external-secrets/pull/5884) - fix: webhook initialization order by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5901](https://github.com/external-secrets/external-secrets/pull/5901) - chore: Cleanup flags by [@evrardj-roche](https://github.com/evrardj-roche) in [#5845](https://github.com/external-secrets/external-secrets/pull/5845) - fix: onepasswordsdk shared tenant by altering the provider in the client cache by [@Skarlso](https://github.com/Skarlso) in [#5921](https://github.com/external-secrets/external-secrets/pull/5921) ##### Dependencies - chore(deps): bump github/codeql-action from 4.31.10 to 4.31.11 by [@dependabot](https://github.com/dependabot)\[bot] in [#5873](https://github.com/external-secrets/external-secrets/pull/5873) - chore(deps): bump pymdown-extensions from 10.20 to 10.20.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5877](https://github.com/external-secrets/external-secrets/pull/5877) - chore(deps): bump markdown from 3.10 to 3.10.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5880](https://github.com/external-secrets/external-secrets/pull/5880) - chore(deps): bump ubi9/ubi from `22e9573` to `1f84f5c` by [@dependabot](https://github.com/dependabot)\[bot] in [#5871](https://github.com/external-secrets/external-secrets/pull/5871) - chore(deps): bump actions/setup-python from 6.1.0 to 6.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5872](https://github.com/external-secrets/external-secrets/pull/5872) - chore(deps): bump hashicorp/setup-terraform from [`93d5a27`](https://github.com/external-secrets/external-secrets/commit/93d5a27adc7ac26085422db72568ae486f091042) to [`dcc3150`](https://github.com/external-secrets/external-secrets/commit/dcc3150f6037c0405dd84cb44d1d91ebbaa96514) by [@dependabot](https://github.com/dependabot)\[bot] in [#5875](https://github.com/external-secrets/external-secrets/pull/5875) - chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5876](https://github.com/external-secrets/external-secrets/pull/5876) - chore(deps): bump step-security/harden-runner from 2.14.0 to 2.14.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5878](https://github.com/external-secrets/external-secrets/pull/5878) - chore(deps): bump anchore/sbom-action from 0.21.1 to 0.22.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5874](https://github.com/external-secrets/external-secrets/pull/5874) - chore(deps): bump packaging from 25.0 to 26.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5879](https://github.com/external-secrets/external-secrets/pull/5879) - chore(deps): bump golang from `d9b2e14` to `98e6cff` by [@dependabot](https://github.com/dependabot)\[bot] in [#5907](https://github.com/external-secrets/external-secrets/pull/5907) - chore(deps): bump alpine from `865b95f` to `2510918` in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5914](https://github.com/external-secrets/external-secrets/pull/5914) - chore(deps): bump docker/login-action from 3.6.0 to 3.7.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5909](https://github.com/external-secrets/external-secrets/pull/5909) - chore(deps): bump actions/cache from 5.0.2 to 5.0.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5912](https://github.com/external-secrets/external-secrets/pull/5912) - chore(deps): bump actions/attest-build-provenance from 3.1.0 to 3.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5910](https://github.com/external-secrets/external-secrets/pull/5910) - chore(deps): bump hashicorp/setup-terraform from [`dcc3150`](https://github.com/external-secrets/external-secrets/commit/dcc3150f6037c0405dd84cb44d1d91ebbaa96514) to [`ce70bcf`](https://github.com/external-secrets/external-secrets/commit/ce70bcf31a3711a1efd50b61e7216b0196b6f4f1) by [@dependabot](https://github.com/dependabot)\[bot] in [#5911](https://github.com/external-secrets/external-secrets/pull/5911) - chore(deps): bump ubi9/ubi from `1f84f5c` to `c8df11b` by [@dependabot](https://github.com/dependabot)\[bot] in [#5908](https://github.com/external-secrets/external-secrets/pull/5908) - chore(deps): bump alpine from 3.23.2 to 3.23.3 in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5915](https://github.com/external-secrets/external-secrets/pull/5915) - chore(deps): bump alpine from `865b95f` to `2510918` by [@dependabot](https://github.com/dependabot)\[bot] in [#5906](https://github.com/external-secrets/external-secrets/pull/5906) - chore(deps): bump pathspec from 1.0.3 to 1.0.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5916](https://github.com/external-secrets/external-secrets/pull/5916) - chore(deps): bump babel from 2.17.0 to 2.18.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5917](https://github.com/external-secrets/external-secrets/pull/5917) - chore(deps): bump github/codeql-action from 4.31.11 to 4.32.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5913](https://github.com/external-secrets/external-secrets/pull/5913) #### New Contributors - [@umizoom](https://github.com/umizoom) made their first contribution in [#5862](https://github.com/external-secrets/external-secrets/pull/5862) - [@HauptJ](https://github.com/HauptJ) made their first contribution in [#5870](https://github.com/external-secrets/external-secrets/pull/5870) - [@n4zukker](https://github.com/n4zukker) made their first contribution in [#5889](https://github.com/external-secrets/external-secrets/pull/5889) - [@stripthis](https://github.com/stripthis) made their first contribution in [#5886](https://github.com/external-secrets/external-secrets/pull/5886) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v1.3.1...v1.3.2> ### [`v1.3.1`](https://github.com/external-secrets/external-secrets/releases/tag/v1.3.1) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v1.2.1...v1.3.1) Image: `ghcr.io/external-secrets/external-secrets:v1.3.1` Image: `ghcr.io/external-secrets/external-secrets:v1.3.1-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.3.1-ubi-boringssl`  For a Full release please referre to <https://github.com/external-secrets/external-secrets/releases/tag/v1.3.0>. This is a fix build for the docker publish flow. #### What's Changed ##### General - fix: ignore the in-toto manifest when promoting the docker build by [@Skarlso](https://github.com/Skarlso) in [#5859](https://github.com/external-secrets/external-secrets/pull/5859) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v1.3.0...v1.3.1> ### [`v1.2.1`](https://github.com/external-secrets/external-secrets/releases/tag/v1.2.1) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v1.2.0...v1.2.1) Image: `ghcr.io/external-secrets/external-secrets:v1.2.1` Image: `ghcr.io/external-secrets/external-secrets:v1.2.1-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.2.1-ubi-boringssl`  #### What's Changed ##### General - chore(chart): release helm chart 1.2.0 by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5751](https://github.com/external-secrets/external-secrets/pull/5751) - fix: metrics not being correctly updated and deleted by [@Skarlso](https://github.com/Skarlso) in [#5714](https://github.com/external-secrets/external-secrets/pull/5714) - feat(infisical): add caBundle and caProvider support by [@wi-adam](https://github.com/wi-adam) in [#5770](https://github.com/external-secrets/external-secrets/pull/5770) - docs(apis): fix inaccurate SecretStore comments (v1 + v1beta1) by [@fallmo](https://github.com/fallmo) in [#5773](https://github.com/external-secrets/external-secrets/pull/5773) - fix: add missing link to the docs by [@Skarlso](https://github.com/Skarlso) in [#5783](https://github.com/external-secrets/external-secrets/pull/5783) - fix: for target template parsing for complex matchers by [@Skarlso](https://github.com/Skarlso) in [#5735](https://github.com/external-secrets/external-secrets/pull/5735) - fix: a lot of sonar issue fixes by [@Skarlso](https://github.com/Skarlso) in [#5771](https://github.com/external-secrets/external-secrets/pull/5771) ##### Dependencies - chore(deps): bump golang from `2611181` to `ac09a5f` by [@dependabot](https://github.com/dependabot)\[bot] in [#5758](https://github.com/external-secrets/external-secrets/pull/5758) - chore(deps): bump alpine from 3.23.0 to 3.23.2 in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5764](https://github.com/external-secrets/external-secrets/pull/5764) - chore(deps): bump importlib-metadata from 8.7.0 to 8.7.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5768](https://github.com/external-secrets/external-secrets/pull/5768) - chore(deps): bump tornado from 6.5.3 to 6.5.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5767](https://github.com/external-secrets/external-secrets/pull/5767) - chore(deps): bump mkdocs-material from 9.7.0 to 9.7.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5766](https://github.com/external-secrets/external-secrets/pull/5766) - chore(deps): bump alpine from `51183f2` to `865b95f` in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5765](https://github.com/external-secrets/external-secrets/pull/5765) - chore(deps): bump alpine from `51183f2` to `865b95f` by [@dependabot](https://github.com/dependabot)\[bot] in [#5756](https://github.com/external-secrets/external-secrets/pull/5756) - chore(deps): bump ubi9/ubi from `d4feb57` to `3816d30` by [@dependabot](https://github.com/dependabot)\[bot] in [#5757](https://github.com/external-secrets/external-secrets/pull/5757) - chore(deps): bump peter-evans/slash-command-dispatch from 5.0.1 to 5.0.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5763](https://github.com/external-secrets/external-secrets/pull/5763) - chore(deps): bump github/codeql-action from 4.31.8 to 4.31.9 by [@dependabot](https://github.com/dependabot)\[bot] in [#5762](https://github.com/external-secrets/external-secrets/pull/5762) - chore(deps): bump actions/attest-build-provenance from 3.0.0 to 3.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5761](https://github.com/external-secrets/external-secrets/pull/5761) - chore(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5760](https://github.com/external-secrets/external-secrets/pull/5760) - chore(deps): bump hashicorp/setup-terraform from [`071811a`](https://github.com/external-secrets/external-secrets/commit/071811a16241b026a69d0c8823fc3d7c54385db5) to [`92e4d08`](https://github.com/external-secrets/external-secrets/commit/92e4d08fe1d24283952afa28216efa8f4ed5aeab) by [@dependabot](https://github.com/dependabot)\[bot] in [#5759](https://github.com/external-secrets/external-secrets/pull/5759) - chore(deps): bump anchore/sbom-action from 0.20.11 to 0.21.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5784](https://github.com/external-secrets/external-secrets/pull/5784) #### New Contributors - [@wi-adam](https://github.com/wi-adam) made their first contribution in [#5770](https://github.com/external-secrets/external-secrets/pull/5770) - [@fallmo](https://github.com/fallmo) made their first contribution in [#5773](https://github.com/external-secrets/external-secrets/pull/5773) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v1.2.0...v1.2.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovatebot added the

Priority

High

2

Kind/Security labels 2026-02-07 00:02:36 +00:00

renovatebot added 1 commit 2026-02-07 00:02:36 +00:00

chore(deps): update helm release external-secrets to v2 bc94004051

renovatebot force-pushed renovate/external-secrets-2.x from bc94004051 to 8d9c8f53a4

2026-02-21 00:02:58 +00:00

Compare

renovatebot force-pushed renovate/external-secrets-2.x from 8d9c8f53a4 to 9134e33964

2026-03-10 14:29:47 +00:00

Compare

renovatebot force-pushed renovate/external-secrets-2.x from 9134e33964 to 1e3f8dde28

2026-03-21 00:01:05 +00:00

Compare

renovatebot force-pushed renovate/external-secrets-2.x from 1e3f8dde28 to 6b3f1b091e

2026-04-11 00:01:31 +00:00

Compare

renovatebot force-pushed renovate/external-secrets-2.x from 6b3f1b091e to 4389d1a2f4

2026-05-21 08:12:42 +00:00

Compare

renovatebot force-pushed renovate/external-secrets-2.x from 4389d1a2f4 to bcd65cf9e8

2026-06-08 00:03:23 +00:00

Compare

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/external-secrets-2.x:renovate/external-secrets-2.x

git checkout renovate/external-secrets-2.x

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: DGSE/kubernetes#46