chore(deps): bump github.com/cert-manager/cert-manager from 1.16.2 to 1.18.0

[dependabot]

Bumps github.com/cert-manager/cert-manager from 1.16.2 to 1.18.0.

Release notes

Sourced from github.com/cert-manager/cert-manager's releases.

v1.18.0-beta.0

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

⚠️ This is a pre-release. Please help the project by testing this release!

📖 Draft release notes: https://release-next--cert-manager.netlify.app/docs/releases/release-notes/release-notes-1.18/

Changes since v1.17.0:

Feature

• Add config to the Vault issuer to allow the server-name to be specified when validating the certificates the Vault server presents. ([#7663](https://github.com/cert-manager/cert-manager/issues/7663), @ThatsMrTalbot)
• Added app.kubernetes.io/managed-by: cert-manager label to the created Let's Encrypt account keys ([#7577](https://github.com/cert-manager/cert-manager/issues/7577), @terinjokes)
• Added certificate issuance and expiration time metrics (certmanager_certificate_not_before_timestamp_seconds, certmanager_certificate_not_after_timestamp_seconds). ([#7612](https://github.com/cert-manager/cert-manager/issues/7612), @solidDoWant)
• Added ingress-shim option --extra-certificate-annotations, which sets a list of annotation keys to be copied from Ingress-like to resulting Certificate object ([#7083](https://github.com/cert-manager/cert-manager/issues/7083), @k0da)
• Added the iss short name for the cert-manager Issuer resource
• Added the ciss short name for the cert-manager ClusterIssuer resource ([#7373](https://github.com/cert-manager/cert-manager/issues/7373), @SgtCoDFish)
• Adds the global.rbac.disableHTTPChallengesRole helm value to disable HTTP-01 ACME challenges. This allows cert-manager to drop its permission to create pods, improving security when HTTP-01 challenges are not required. ([#7666](https://github.com/cert-manager/cert-manager/issues/7666), @ali-hamza-noor)
• Allow customizing signature algorithm ([#7591](https://github.com/cert-manager/cert-manager/issues/7591), @tareksha)
• Cache the full DNS response and handle TTL expiration in FindZoneByFqdn ([#7596](https://github.com/cert-manager/cert-manager/issues/7596), @ThatsIvan)
• Cert-manager now uses a local fork of the golang.org/x/crypto/acme package ([#7752](https://github.com/cert-manager/cert-manager/issues/7752), @wallrj)
• Add support for ACME profiles extension. ([#7777](https://github.com/cert-manager/cert-manager/issues/7777), @wallrj)
• Promote the UseDomainQualifiedFinalizer feature to GA. ([#7735](https://github.com/cert-manager/cert-manager/issues/7735), @jsoref)
• Switched service/servicemon definitions to use port names instead of numbers. ([#7727](https://github.com/cert-manager/cert-manager/issues/7727), @jcpunk)
• The default value of Certificate.Spec.PrivateKey.RotationPolicy changed from Never to Always. ([#7723](https://github.com/cert-manager/cert-manager/issues/7723), @wallrj)
• Set the default revisionHistoryLimit to 1 for the CertificateRequest revisions ([#7758](https://github.com/cert-manager/cert-manager/issues/7758), @ali-hamza-noor)

Documentation

• Fix some comments ([#7620](https://github.com/cert-manager/cert-manager/issues/7620), @teslaedison)

Bug or Regression

• Bump go-jose dependency to address CVE-2025-27144. ([#7606](https://github.com/cert-manager/cert-manager/issues/7606), @SgtCoDFish)
• Bump golang.org/x/oauth2 to patch CVE-2025-22868.
• Bump golang.org/x/crypto to patch GHSA-hcg3-q754-cr77.
• Bump github.com/golang-jwt/jwt to patch GHSA-mh63-6h87-95cp. ([#7638](https://github.com/cert-manager/cert-manager/issues/7638), @NicholasBlaskey)
• Change of the Kubernetes Ingress pathType from ImplementationSpecific to Exact for a reliable handling of ingress controllers and enhanced security. ([#7767](https://github.com/cert-manager/cert-manager/issues/7767), @sspreitzer)
• Fix AWS Route53 error detection for not-found errors during deletion of DNS records. ([#7690](https://github.com/cert-manager/cert-manager/issues/7690), @wallrj)
• Fix behavior when running with --namespace=<namespace>: limit the scope of cert-manager to a single namespace and disable cluster-scoped controllers. ([#7678](https://github.com/cert-manager/cert-manager/issues/7678), @tsaarni)
• Fix handling of certificates with IP addresses in the commonName field; IP addresses are no longer added to the DNS subjectAlternativeName list and are instead added to the ipAddresses field as expected. ([#7081](https://github.com/cert-manager/cert-manager/issues/7081), @johnjcool)
• Fix issuing of certificates via DNS01 challenges on Cloudflare after a breaking change to the Cloudflare API ([#7549](https://github.com/cert-manager/cert-manager/issues/7549), @LukeCarrier)
• Fixed the certmanager_certificate_renewal_timestamp_seconds metric help text indicating that the metric is relative to expiration time, rather than Unix epoch time. ([#7609](https://github.com/cert-manager/cert-manager/issues/7609), @solidDoWant)
• Fixing the service account template to incorporate boolean values for the annotations. ([#7698](https://github.com/cert-manager/cert-manager/issues/7698), @ali-hamza-noor)
• Quote nodeSelector values in Helm Chart ([#7579](https://github.com/cert-manager/cert-manager/issues/7579), @tobiasbp)
• Skip Gateway TLS listeners in Passthrough mode. ([#6986](https://github.com/cert-manager/cert-manager/issues/6986), @vehagn)
• Upgrade golang.org/x/net fixing CVE-2025-22870. ([#7619](https://github.com/cert-manager/cert-manager/issues/7619), @depandabot[bot])

Other (Cleanup or Flake)

... (truncated)

Commits

• 83dae3e Merge pull request #7790 from cert-manager-bot/cherry-pick-7789-to-release-1.18
• 64b5da2 make generate
• bdd1320 Fix typo in Certificate API documentation
• 3ab737e Merge pull request #7787 from cert-manager-bot/cherry-pick-7786-to-release-1.18
• 4d0193e Add 1.33 option to cluster.sh
• 8947397 ./hack/latest-kind-images.sh v0.27.0
• 4eb6df2 Fix a typo in the make help text
• 331f9e6 Merge pull request #7785 from wallrj/go-1.24.4
• df9f43b Upgrade Go to v1.24.4
• 99aded1 Merge pull request #7777 from wallrj/acme-profiles
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #31.