chore(deps): update all non-major dependencies #94

renovate · 2025-04-27T03:57:08Z

This PR contains the following updates:

Package	Type	Update	Change
anchore/sbom-action	action	minor	`v0.18.0` -> `v0.20.1`
github.com/cert-manager/cert-manager	require	minor	`v1.17.1` -> `v1.18.2`
github.com/stackitcloud/stackit-sdk-go/core	require	patch	`v0.17.1` -> `v0.17.2`
github.com/stackitcloud/stackit-sdk-go/services/dns	require	minor	`v0.13.1` -> `v0.17.0`
go.uber.org/mock	require	patch	`v0.5.1` -> `v0.5.2`
k8s.io/api	require	minor	`v0.32.4` -> `v0.33.2`
k8s.io/apiextensions-apiserver	require	minor	`v0.32.4` -> `v0.33.2`
k8s.io/apimachinery	require	minor	`v0.32.4` -> `v0.33.2`
k8s.io/client-go	require	minor	`v0.32.4` -> `v0.33.2`
sigstore/cosign-installer	action	minor	`v3.8.2` -> `v3.9.1`
step-security/harden-runner	action	patch	`v2.12.0` -> `v2.12.2`

Release Notes

anchore/sbom-action (anchore/sbom-action)

`v0.20.1`

Compare Source

Changes in v0.20.1

Update Syft to v1.27.1 (#525)

`v0.20.0`

Compare Source

Changes in v0.20.0

chore(deps): update Syft to v1.24.0 (#522)

`v0.19.0`

Compare Source

Changes in v0.19.0

chore(deps): update Syft to v1.23.0 (#521)
chore(deps): bump peter-evans/create-pull-request from 7.0.6 to 7.0.8 (#519)
chore(deps): bump cross-spawn (#514)

cert-manager/cert-manager (github.com/cert-manager/cert-manager)

`v1.18.2`

Compare Source

`v1.18.1`

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

We have added a new feature gate ACMEHTTP01IngressPathTypeExact, to allow ingress-nginx users to turn off the new default Ingress PathType: Exact behavior, in ACME HTTP01 Ingress challenge solvers.
This change fixes the following issue: #7791

We have increased the ACME challenge authorization timeout to two minutes, which we hope will fix a timeout error (error waiting for authorization), which has been reported by multiple users, since the release of cert-manager v1.16.0.
This change should fix the following issues: #7337, #7444, and #7685.

ℹ️ Be sure to review all new features and changes below, and read the full release notes carefully before upgrading.

Changes since v1.18.0:

Feature

Added a new feature gate ACMEHTTP01IngressPathTypeExact, to allow ingress-nginx users to turn off the new default Ingress PathType: Exact behavior, in ACME HTTP01 Ingress challenge solvers. (#7810, @sspreitzer)

Bug or Regression

ACME: Increased challenge authorization timeout to 2 minutes to fix error waiting for authorization. (#7801, @hjoshi123)

Other (Cleanup or Flake)

Use the latest version of ingress-nginx in E2E tests to ensure compatibility (#7807, @wallrj)

`v1.18.0`

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

cert-manager 1.18 introduces several new features and breaking changes. Highlights include support for ACME certificate profiles, a new default for Certificate.Spec.PrivateKey.RotationPolicy now set to Always (breaking change), and the default Certificate.Spec.RevisionHistoryLimit now set to 1 (potentially breaking).

ℹ️ Be sure to review all new features and changes below, and read the full release notes carefully before upgrading.

Known Issues

ACME HTTP01 challenge paths are rejected by the ingress-nginx validating webhook (#7791)

Changes since v1.17.2:

Feature

Add config to the Vault issuer to allow the server-name to be specified when validating the certificates the Vault server presents. (#7663, @ThatsMrTalbot)
Added app.kubernetes.io/managed-by: cert-manager label to the created Let's Encrypt account keys (#7577, @terinjokes)
Added certificate issuance and expiration time metrics (certmanager_certificate_not_before_timestamp_seconds, certmanager_certificate_not_after_timestamp_seconds). (#7612, @solidDoWant)
Added ingress-shim option: --extra-certificate-annotations, which sets a list of annotation keys to be copied from Ingress-like to resulting Certificate object (#7083, @k0da)
Added the iss short name for the cert-manager Issuer resource. (#7373, @SgtCoDFish)
Added the ciss short name for the cert-manager ClusterIssuer resource (#7373, @SgtCoDFish)
Adds the global.rbac.disableHTTPChallengesRole helm value to disable HTTP-01 ACME challenges. This allows cert-manager to drop its permission to create pods, improving security when HTTP-01 challenges are not required. (#7666, @ali-hamza-noor)
Allow customizing signature algorithm (#7591, @tareksha)
Cache the full DNS response and handle TTL expiration in FindZoneByFqdn (#7596, @ThatsIvan)
Cert-manager now uses a local fork of the golang.org/x/crypto/acme package (#7752, @wallrj)
Add support for ACME profiles extension. (#7777, @wallrj)
Promote the UseDomainQualifiedFinalizer feature to GA. (#7735, @jsoref)
Switched service/servicemon definitions to use port names instead of numbers. (#7727, @jcpunk)
The default value of Certificate.Spec.PrivateKey.RotationPolicy changed from Never to Always. (#7723, @wallrj)
Potentially breaking: Set the default revisionHistoryLimit to 1 for the CertificateRequest revisions (#7758, @ali-hamza-noor)

Documentation

Fix some comments (#7620, @teslaedison)

Bug or Regression

Bump go-jose dependency to address CVE-2025-27144. (#7606, @SgtCoDFish)
Bump golang.org/x/oauth2 to patch CVE-2025-22868. (#7638, @NicholasBlaskey)
Bump golang.org/x/crypto to patch GHSA-hcg3-q754-cr77. (#7638, @NicholasBlaskey)
Bump github.com/golang-jwt/jwt to patch GHSA-mh63-6h87-95cp. (#7638, @NicholasBlaskey)
Change of the Kubernetes Ingress pathType from ImplementationSpecific to Exact for a reliable handling of ingress controllers and enhanced security. (#7767, @sspreitzer)
Fix AWS Route53 error detection for not-found errors during deletion of DNS records. (#7690, @wallrj)
Fix behavior when running with --namespace=<namespace>: limit the scope of cert-manager to a single namespace and disable cluster-scoped controllers. (#7678, @tsaarni)
Fix handling of certificates with IP addresses in the commonName field; IP addresses are no longer added to the DNS subjectAlternativeName list and are instead added to the ipAddresses field as expected. (#7081, @johnjcool)
Fix issuing of certificates via DNS01 challenges on Cloudflare after a breaking change to the Cloudflare API (#7549, @LukeCarrier)
Fixed the certmanager_certificate_renewal_timestamp_seconds metric help text indicating that the metric is relative to expiration time, rather than Unix epoch time. (#7609, @solidDoWant)
Fixing the service account template to incorporate boolean values for the annotations. (#7698, @ali-hamza-noor)
Quote nodeSelector values in Helm Chart (#7579, @tobiasbp)
Skip Gateway TLS listeners in Passthrough mode. (#6986, @vehagn)
Upgrade golang.org/x/net fixing CVE-2025-22870. (#7619, @dependabot[bot])

Other (Cleanup or Flake)

ACME E2E Tests: Upgraded Pebble to v2.7.0 and modified the ACME tests to match latest Pebble behaviour. (#7771, @wallrj)
Patch the third_party/forked/acme package with support for the ACME profiles extension. (#7776, @wallrj)
Promote the AdditionalCertificateOutputFormats feature to GA, making additional formats always enabled. (#7744, @erikgb)
Remove deprecated feature gate ValidateCAA. Setting this feature gate is now a no-op which does nothing but print a warning log line (#7553, @SgtCoDFish)
Update kind images to include the Kubernetes 1.33 node image (#7787, @cert-manager-bot)
Upgrade Go to v1.24.4 (#7785, @wallrj)
Use slices.Contains to simplify code (#7753, @cuinix)

`v1.17.4`

Compare Source

`v1.17.3`

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

This patch release addresses several vulnerabilities reported by the Trivy security scanner. It is built with the latest version of Go 1.23.

We have increased the ACME challenge authorization timeout to two minutes, which we hope will fix a timeout error (error waiting for authorization), which has been reported by multiple users, in: #7337, #7444, and #7685.

ℹ️ Be sure to review all new features and changes below, and read the full release notes carefully before upgrading.

Changes since v1.17.2:

Bug or Regression

Bump Go to 1.23.10 to fix GO-2025-3749, GO-2025-3750, and GO-2025-3751 (#7799, @wallrj)
ACME: Increased challenge authorization timeout to 2 minutes to fix error waiting for authorization (#7798, @hjoshi123)

Other (Cleanup or Flake)

Use the latest version of ingress-nginx in E2E tests to ensure compatibility (#7808, @wallrj)

`v1.17.2`

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

This patch release addresses several vulnerabilities reported by the Trivy security scanner. It is built with the latest version of Go 1.23 and includes various dependency updates.

📖 Read the full cert-manager 1.17 release notes, before installing or upgrading.

Changes since `v1.17.1`

Bug or Regression

Bump Go to v1.23.8 to fix CVE-2025-22871 (#7701, @wallrj)
Bump go-jose dependency to address CVE-2025-27144 (#7603, @SgtCoDFish)
Bump golang.org/x/net to address CVE-2025-22870 reported by Trivy (#7622, @SgtCoDFish)
Bump golang.org/x/net to fix CVE-2025-22872 (#7703, @wallrj)
Bump golang.org/x/oauth2 to patch CVE-2025-22868 (#7692, @lentzi90)
Bump golang.org/x/crypto to patch GHSA-hcg3-q754-cr77 (#7692, @lentzi90)
Bump github.com/golang-jwt/jwt to patch GHSA-mh63-6h87-95cp (#7692, @lentzi90)

uber/mock (go.uber.org/mock)

`v0.5.2`

Compare Source

0.5.2 (28 Apr 2025)

Fixed

#248: Fixed an issue with type aliases not being included in generated code correctly.

kubernetes/api (k8s.io/api)

kubernetes/apiextensions-apiserver (k8s.io/apiextensions-apiserver)

`v0.33.2`

Compare Source

`v0.33.1`

Compare Source

`v0.33.0`

Compare Source

`v0.32.6`

Compare Source

`v0.32.5`

Compare Source

kubernetes/apimachinery (k8s.io/apimachinery)

`v0.33.2`

Compare Source

`v0.33.1`

Compare Source

`v0.33.0`

Compare Source

`v0.32.6`

Compare Source

`v0.32.5`

Compare Source

kubernetes/client-go (k8s.io/client-go)

`v0.33.2`

Compare Source

`v0.33.1`

Compare Source

`v0.33.0`

Compare Source

`v0.32.6`

Compare Source

`v0.32.5`

Compare Source

sigstore/cosign-installer (sigstore/cosign-installer)

`v3.9.1`

Compare Source

What's Changed

default action install to use release v2.5.1 by @cpanato in https://github.com/sigstore/cosign-installer/pull/193
default cosign to v2.5.2 by @cpanato in https://github.com/sigstore/cosign-installer/pull/194

Full Changelog: sigstore/cosign-installer@v3.9.0...v3.9.1

`v3.9.0`

Compare Source

What's Changed

Bump actions/setup-go from 5.4.0 to 5.5.0 by @dependabot in https://github.com/sigstore/cosign-installer/pull/189
bump cosign install to use release v2.5.0 as default by @cpanato in https://github.com/sigstore/cosign-installer/pull/191

Full Changelog: sigstore/cosign-installer@v3...v3.9.0

step-security/harden-runner (step-security/harden-runner)

`v2.12.2`

Compare Source

What's Changed

Added HTTPS Monitoring for additional destinations - *.githubusercontent.com
Bug fixes:

Implicitly allow local multicast, local unicast and broadcast IP addresses in block mode
Increased policy map size for block mode

Full Changelog: step-security/harden-runner@v2...v2.12.2

`v2.12.1`

Compare Source

What's Changed

Detection capabilities have been upgraded to better recognize attempts at runner tampering. These improvements are informed by real-world incident learnings, including analysis of anomalous behaviors observed in the tj-actions and reviewdog supply chain attack.
Resolved an issue where the block policy was not enforced correctly when the GitHub Actions job was running inside a container on a self-hosted VM runner.

Full Changelog: step-security/harden-runner@v2...v2.12.1

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2025-04-27T03:57:09Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -d -t ./...
go: -d flag is deprecated. -d=true is a no-op
go: module k8s.io/[email protected] requires go >= 1.24.0; switching to go1.24.4
go: downloading go1.24.4 (linux/amd64)
go: download go1.24.4: golang.org/[email protected]: verifying module: checksum database disabled by GOSUMDB=off

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate · 2025-07-02T13:05:12Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

renovate bot requested a review from fsandel as a code owner April 27, 2025 03:57

renovate bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 052ea5f to 08f0752 Compare May 2, 2025 15:07

renovate bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 8edbb1b to d59d2f5 Compare May 16, 2025 03:04

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from daa4591 to fed52b9 Compare May 22, 2025 12:12

renovate bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 9a29429 to 145cb90 Compare June 10, 2025 12:38

renovate bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 0b16a5c to 25c1b8e Compare June 18, 2025 16:26

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 3aef735 to 456b755 Compare June 23, 2025 16:28

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from dbd8e04 to 6bbf3f0 Compare June 30, 2025 12:41

chore(deps): update all non-major dependencies

a4fe73a

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate bot force-pushed the renovate/all-minor-patch branch from 6bbf3f0 to a4fe73a Compare July 2, 2025 13:02

fix go version

b7129aa

PatrickKoss added 2 commits July 2, 2025 15:09

update go version

59b24c8

fix deps

b7650b0

PatrickKoss merged commit 6053906 into main Jul 2, 2025
4 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update all non-major dependencies #94

chore(deps): update all non-major dependencies #94

Uh oh!

renovate bot commented Apr 27, 2025 •

edited

Loading

Uh oh!

renovate bot commented Apr 27, 2025 •

edited

Loading

Uh oh!

renovate bot commented Jul 2, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

chore(deps): update all non-major dependencies #94

chore(deps): update all non-major dependencies #94

Uh oh!

Conversation

renovate bot commented Apr 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Changes in v0.20.1

Changes in v0.20.0

Changes in v0.19.0

Feature

Bug or Regression

Other (Cleanup or Flake)

Known Issues

Feature

Documentation

Bug or Regression

Other (Cleanup or Flake)

Bug or Regression

Other (Cleanup or Flake)

Changes since v1.17.1

Bug or Regression

0.5.2 (28 Apr 2025)

Fixed

What's Changed

What's Changed

What's Changed

What's Changed

Configuration

Uh oh!

renovate bot commented Apr 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: go.sum

Uh oh!

renovate bot commented Jul 2, 2025

Edited/Blocked Notification

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

renovate bot commented Apr 27, 2025 •

edited

Loading

Changes since `v1.17.1`

renovate bot commented Apr 27, 2025 •

edited

Loading