Update Helm release external-secrets to v1

[renovate]

This PR contains the following updates:

Package	Update	Change	Pending
external-secrets	major	0.20.4 → 1.2.1	1.3.1

---

Release Notes

external-secrets/external-secrets (external-secrets)

v1.2.1

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.2.1
Image: ghcr.io/external-secrets/external-secrets:v1.2.1-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.2.1-ubi-boringssl

What's Changed

General

• chore(chart): release helm chart 1.2.0 by @​jakobmoellerdev in #​5751
• fix: metrics not being correctly updated and deleted by @​Skarlso in #​5714
• feat(infisical): add caBundle and caProvider support by @​wi-adam in #​5770
• docs(apis): fix inaccurate SecretStore comments (v1 + v1beta1) by @​fallmo in #​5773
• fix: add missing link to the docs by @​Skarlso in #​5783
• fix: for target template parsing for complex matchers by @​Skarlso in #​5735
• fix: a lot of sonar issue fixes by @​Skarlso in #​5771

Dependencies

• chore(deps): bump golang from 2611181 to ac09a5f by @​dependabot[bot] in #​5758
• chore(deps): bump alpine from 3.23.0 to 3.23.2 in /e2e by @​dependabot[bot] in #​5764
• chore(deps): bump importlib-metadata from 8.7.0 to 8.7.1 in /hack/api-docs by @​dependabot[bot] in #​5768
• chore(deps): bump tornado from 6.5.3 to 6.5.4 in /hack/api-docs by @​dependabot[bot] in #​5767
• chore(deps): bump mkdocs-material from 9.7.0 to 9.7.1 in /hack/api-docs by @​dependabot[bot] in #​5766
• chore(deps): bump alpine from 51183f2 to 865b95f in /hack/api-docs by @​dependabot[bot] in #​5765
• chore(deps): bump alpine from 51183f2 to 865b95f by @​dependabot[bot] in #​5756
• chore(deps): bump ubi9/ubi from d4feb57 to 3816d30 by @​dependabot[bot] in #​5757
• chore(deps): bump peter-evans/slash-command-dispatch from 5.0.1 to 5.0.2 by @​dependabot[bot] in #​5763
• chore(deps): bump github/codeql-action from 4.31.8 to 4.31.9 by @​dependabot[bot] in #​5762
• chore(deps): bump actions/attest-build-provenance from 3.0.0 to 3.1.0 by @​dependabot[bot] in #​5761
• chore(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 by @​dependabot[bot] in #​5760
• chore(deps): bump hashicorp/setup-terraform from 071811a to 92e4d08 by @​dependabot[bot] in #​5759
• chore(deps): bump anchore/sbom-action from 0.20.11 to 0.21.0 by @​dependabot[bot] in #​5784

New Contributors

• @​wi-adam made their first contribution in #​5770
• @​fallmo made their first contribution in #​5773

Full Changelog: external-secrets/external-secrets@v1.2.0...v1.2.1

v1.2.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.2.0
Image: ghcr.io/external-secrets/external-secrets:v1.2.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.2.0-ubi-boringssl

What's Changed

General

• chore: bump 1.1.1 by @​gusfcarvalho in #​5687
• chore: fix the argocd e2e test case by @​Skarlso in #​5688
• feat(provider): add Barbican provider support by @​rkferreira in #​5398
• docs(secretserver): promote secretserver provider to beta by @​DelineaSahilWankhede in #​5668
• feat(controller): add flag to enable/disable secretstore reconcile by @​Ilhan-Personal in #​5653
• fix(aws-secrets-manager): Apply filtering based on both name and tags if provided by @​iypetrov in #​5685
• fix(gcpsm): SecretExists should check for regional secrets when store location is specified by @​tokiwong in #​5708
• feat: introduce store deprecation by @​gusfcarvalho in #​5711
• feat(charts): add global values for common deployment configurations by @​Gabryel8818 in #​5652
• feat: add Doppler OIDC-based authentication by @​mikesellitto in #​5475
• fix: make custom configuration available regardless of environment by @​Skarlso in #​5713
• chore(chart): update bitwarden dependency to v0.5.2 by @​Skarlso in #​5719
• docs(templating): update rbac for generic targets by @​lostick in #​5736
• fix(testing): Breaking changes should not break ci by @​evrardjp in #​5739
• fix(security): Get rid of getSecretKey by @​evrardjp in #​5738
• fix(aws): parse resource policies into canonical JSON (sorted) before comparing by @​cmoscofian in #​5622
• docs: Fix example in GCP documentation by @​headcr4sh in #​5745
• chore(secretserver): update dependencies to accept new DelineaXPM/tss-sdk-go by @​DelineaSahilWankhede in #​5742
• fix(gcpsm): Improve SecretExists method in GCP secret manager provider by @​tosih in #​5610
• chore(docs): add clarification to helm values being disabled by @​Skarlso in #​5746
• fix(release): apply 64dc681 to release by @​jakobmoellerdev in #​5749
• docs(release): 1.2 stability-support.md by @​jakobmoellerdev in #​5750

Dependencies

• chore(deps): bump golang from 1.25.4 to 1.25.5 by @​dependabot[bot] in #​5693
• chore(deps): bump golang from 1.25.4-bookworm to 1.25.5-bookworm in /e2e by @​dependabot[bot] in #​5702
• chore(deps): bump ubi9/ubi from dcd8128 to 75937d9 by @​dependabot[bot] in #​5655
• chore(deps): bump peter-evans/slash-command-dispatch from 5.0.0 to 5.0.1 by @​dependabot[bot] in #​5695
• chore(deps): bump github/codeql-action from 4.31.5 to 4.31.7 by @​dependabot[bot] in #​5696
• chore(deps): bump actions/stale from 10.1.0 to 10.1.1 by @​dependabot[bot] in #​5697
• chore(deps): bump actions/create-github-app-token from 2.2.0 to 2.2.1 by @​dependabot[bot] in #​5700
• chore(deps): bump step-security/harden-runner from 2.13.2 to 2.13.3 by @​dependabot[bot] in #​5698
• chore(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @​dependabot[bot] in #​5699
• chore(deps): bump platformdirs from 4.5.0 to 4.5.1 in /hack/api-docs by @​dependabot[bot] in #​5705
• chore(deps): bump distroless/static from 87bce11 to 4b2a093 by @​dependabot[bot] in #​5692
• chore(deps): bump alpine from 3.22 to 3.23 in /hack/api-docs by @​dependabot[bot] in #​5703
• chore(deps): bump urllib3 from 2.5.0 to 2.6.0 in /hack/api-docs by @​dependabot[bot] in #​5704
• chore(deps): bump pymdown-extensions from 10.17.2 to 10.18 in /hack/api-docs by @​dependabot[bot] in #​5706
• chore(deps): bump alpine from 3.22.2 to 3.23.0 in /e2e by @​dependabot[bot] in #​5701
• chore(deps): bump golang from 2611181 to 2611181 by @​dependabot[bot] in #​5721
• chore(deps): bump codecov/codecov-action from 5.5.1 to 5.5.2 by @​dependabot[bot] in #​5725
• chore(deps): bump urllib3 from 2.6.0 to 2.6.2 in /hack/api-docs by @​dependabot[bot] in #​5730
• chore(deps): bump github/codeql-action from 4.31.7 to 4.31.8 by @​dependabot[bot] in #​5726
• chore(deps): bump anchore/sbom-action from 0.20.10 to 0.20.11 by @​dependabot[bot] in #​5724
• chore(deps): bump tornado from 6.5.2 to 6.5.3 in /hack/api-docs by @​dependabot[bot] in #​5732
• chore(deps): bump ubi9/ubi from 75937d9 to d4feb57 by @​dependabot[bot] in #​5722
• chore(deps): bump golang from 5117d68 to 09f53de in /e2e by @​dependabot[bot] in #​5729
• chore(deps): bump alpine from 4b7ce07 to 51183f2 by @​dependabot[bot] in #​5694
• chore(deps): bump hashicorp/setup-terraform from 712b439 to 071811a by @​dependabot[bot] in #​5727
• chore(deps): bump pymdown-extensions from 10.18 to 10.19.1 in /hack/api-docs by @​dependabot[bot] in #​5731
• chore(deps): bump step-security/harden-runner from 2.13.3 to 2.14.0 by @​dependabot[bot] in #​5728
• chore(deps): bump actions/cache from 4.3.0 to 5.0.1 by @​dependabot[bot] in #​5723

New Contributors

• @​iypetrov made their first contribution in #​5685
• @​tokiwong made their first contribution in #​5708
• @​Gabryel8818 made their first contribution in #​5652
• @​mikesellitto made their first contribution in #​5475
• @​lostick made their first contribution in #​5736
• @​cmoscofian made their first contribution in #​5622
• @​headcr4sh made their first contribution in #​5745
• @​tosih made their first contribution in #​5610

Full Changelog: external-secrets/external-secrets@v1.1.1...v1.2.0

v1.1.1

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.1.1
Image: ghcr.io/external-secrets/external-secrets:v1.1.1-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.1.1-ubi-boringssl

What's Changed

General

• chore(chart): release helm chart 1.1.0 by @​Skarlso in #​5619
• docs: improve spec.md by exporting generator types by @​gusfcarvalho in #​5624
• chore(deps): remove sprig fork by @​Skarlso in #​5626
• fix: report 404 secrets correctly in Gitlab provider by @​alekc in #​5104
• docs(secretserver): update documentation to include Platform compatibility by @​DelineaSahilWankhede in #​5546
• docs: add llm policy by @​Skarlso in #​5649
• fix: pass in the token to the build and publish container by @​Skarlso in #​5651
• test(secretserver): improve test coverage for SecretServer provider by @​DelineaSahilWankhede in #​5641
• fix: docs pipeline by @​rkferreira in #​5663
• fix: modify the url of the remote to include the token by @​Skarlso in #​5664
• feat(helm): add dynamic labelSelector if not define in topologySpread… by @​fe80 in #​5065
• feat: Support retry settings for Doppler provider by @​maduonline in #​5608
• feat(beyondtrust): enable pushing secrets in BeyondTrust provider by @​btfhernandez in #​5586
• fix: correctly merge map fields during templating by @​Skarlso in #​5671
• fix: use patch instead of update for finalizers addition and removal by @​Skarlso in #​5670
• feat(oracle): implement SecretExists by @​anders-swanson in #​5672
• fix(security): create provider for webhook & fake by @​ShimonDarshan in #​5628
• fix: set client transport to use GitHub Enterprise URL by @​fred-gagnon in #​5662
• feat(generator): Password generator can generate and expose multiple passwords by @​Trojanekkk in #​5669
• fix: run check diff on main by @​Skarlso in #​5681
• feat: bitwardenServerSDKURL is required for bitwardensecretsmanager by @​budimanjojo in #​5679
• fix: update the refreshInterval formatting everywhere by @​Skarlso in #​5680
• clean: Update conjur-api-go; Disable credential storage by @​szh in #​5648
• fix: add live-reload to make docs.serve by @​gusfcarvalho in #​5676
• fix: remove cached artifacts after build by @​gusfcarvalho in #​5686
• fix(keepersecurity): properly handle fields key by @​pepordev in #​5674

Dependencies

• chore(deps): bump golang from d3f0cf7 to d3f0cf7 by @​dependabot[bot] in #​5630
• chore(deps): bump golang from 7419f54 to e174196 in /e2e by @​dependabot[bot] in #​5638
• chore(deps): bump zizmorcore/zizmor-action from 0.2.0 to 0.3.0 by @​dependabot[bot] in #​5637
• chore(deps): bump actions/setup-go from 6.0.0 to 6.1.0 by @​dependabot[bot] in #​5636
• chore(deps): bump anchore/sbom-action from 0.20.9 to 0.20.10 by @​dependabot[bot] in #​5635
• chore(deps): bump actions/create-github-app-token from 2.1.4 to 2.2.0 by @​dependabot[bot] in #​5634
• chore(deps): bump github/codeql-action from 4.31.3 to 4.31.4 by @​dependabot[bot] in #​5633
• chore(deps): bump aws-actions/configure-aws-credentials from f2964c7 to 4a54c24 by @​dependabot[bot] in #​5632
• chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 by @​dependabot[bot] in #​5631
• chore(deps): bump pymdown-extensions from 10.17.1 to 10.17.2 in /hack/api-docs by @​dependabot[bot] in #​5660
• chore(deps): bump softprops/action-gh-release from 2.4.2 to 2.5.0 by @​dependabot[bot] in #​5656
• chore(deps): bump actions/setup-python from 6.0.0 to 6.1.0 by @​dependabot[bot] in #​5657
• chore(deps): bump peter-evans/slash-command-dispatch from 4.0.0 to 5.0.0 by @​dependabot[bot] in #​5658
• chore(deps): bump hashicorp/setup-terraform from 4c5fdab to 712b439 by @​dependabot[bot] in #​5659

New Contributors

• @​fe80 made their first contribution in #​5065
• @​maduonline made their first contribution in #​5608
• @​fred-gagnon made their first contribution in #​5662
• @​Trojanekkk made their first contribution in #​5669
• @​budimanjojo made their first contribution in #​5679

Full Changelog: external-secrets/external-secrets@v1.1.0...v1.1.1

v1.1.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.1.0
Image: ghcr.io/external-secrets/external-secrets:v1.1.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.1.0-ubi-boringssl

What's Changed

!NOTE!: During last community meeting we discussed that we are retiring our scarf account. With that, we will be changing back to ghcr.io/external-secrets/external-secrets instead of oci.external-secrets.io/external-secrets/external-secrets.

For now, the old domain will live for a couple months to give people to change back. With this release , the values in the helm chart that define where the image is switched back to ghcr.

The helm-chart itself is served from under github-pages so that does not move.

General

• chore(chart): release helm chart 1.0.0 by @​Skarlso in #​5552
• feat(security): add support for ECDSA ssh keys by @​bigjazzsound in #​5559
• fix: minor typo in comment of KeeperSecurity example by @​mdjong1 in #​5573
• docs(gcp): update documentation for using WorkloadIdentityFederation in non-GKE cluster by @​jennweir in #​5556
• chore(release): add darwin_arm64 releases by @​lbordowitz in #​5583
• feat: support override IAM endpoint in IBM provider for APIkey auth by @​fidel-ruiz in #​5550
• feat(security): build tags for all the providers to disable them on d… by @​ShimonDarshan in #​5578
• fix: do not include the last element of the path in the iteration by @​Skarlso in #​5588
• fix(k8s): support deleting whole secret by @​tiagolobocastro in #​5538
• fix(provider): configure TLS for secret server provider by @​Lumexralph in #​5558
• chore(aws): remove any usage of aws-sdk-v1 by @​Skarlso in #​5590
• fix(gcp): check for secret version exists in PushSecret by @​bpalko in #​5593
• feat(vault): add GCP Workload Identity authentication support by @​SamuelMolling in #​5356
• chore: fix sonar cloud issues by @​Skarlso in #​5405
• chore(aws-sdk-v2): update dependencies to accept new aws regions by @​damienpuig in #​5577
• feat(chart): use ghcr.io instead of our own domain by @​evrardjp in #​5617

Dependencies

• chore(deps): bump golang from 1.25.3 to 1.25.4 by @​dependabot[bot] in #​5560
• chore(deps): bump golang from 1.25.3-bookworm to 1.25.4-bookworm in /e2e by @​dependabot[bot] in #​5568
• chore(deps): bump step-security/harden-runner from 2.13.1 to 2.13.2 by @​dependabot[bot] in #​5561
• chore(deps): bump softprops/action-gh-release from 2.4.1 to 2.4.2 by @​dependabot[bot] in #​5564
• chore(deps): bump helm/chart-testing-action from 2.7.0 to 2.8.0 by @​dependabot[bot] in #​5565
• chore(deps): bump aws-actions/configure-aws-credentials from 0d00a56 to 2475ef7 by @​dependabot[bot] in #​5562
• chore(deps): bump helm/kind-action from 1.12.0 to 1.13.0 by @​dependabot[bot] in #​5563
• chore(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 by @​dependabot[bot] in #​5567
• chore(deps): bump regex from 2025.10.23 to 2025.11.3 in /hack/api-docs by @​dependabot[bot] in #​5570
• chore(deps): bump markdown from 3.9 to 3.10 in /hack/api-docs by @​dependabot[bot] in #​5569
• chore(deps): bump hashicorp/setup-terraform from 982f6f0 to 4c5fdab by @​dependabot[bot] in #​5566
• chore(deps): bump golang from d3f0cf7 to d3f0cf7 by @​dependabot[bot] in #​5595
• chore(deps): bump github/codeql-action from 4.31.2 to 4.31.3 by @​dependabot[bot] in #​5596
• chore(deps): bump click from 8.3.0 to 8.3.1 in /hack/api-docs by @​dependabot[bot] in #​5602
• chore(deps): bump ubi9/ubi from dec374e to dcd8128 by @​dependabot[bot] in #​5594
• chore(deps): bump aws-actions/configure-aws-credentials from 2475ef7 to f2964c7 by @​dependabot[bot] in #​5597
• chore(deps): bump actions/dependency-review-action from 4.8.1 to 4.8.2 by @​dependabot[bot] in #​5598
• chore(deps): bump pymdown-extensions from 10.16.1 to 10.17.1 in /hack/api-docs by @​dependabot[bot] in #​5599
• chore(deps): bump certifi from 2025.10.5 to 2025.11.12 in /hack/api-docs by @​dependabot[bot] in #​5600
• chore(deps): bump mkdocs-material from 9.6.23 to 9.7.0 in /hack/api-docs by @​dependabot[bot] in #​5601
• chore(deps): bump mkdocs-macros-plugin from 1.4.1 to 1.5.0 in /hack/api-docs by @​dependabot[bot] in #​5603

New Contributors

• @​bigjazzsound made their first contribution in #​5559
• @​mdjong1 made their first contribution in #​5573
• @​jennweir made their first contribution in #​5556
• @​lbordowitz made their first contribution in #​5583
• @​fidel-ruiz made their first contribution in #​5550
• @​ShimonDarshan made their first contribution in #​5578
• @​bpalko made their first contribution in #​5593
• @​SamuelMolling made their first contribution in #​5356
• @​damienpuig made their first contribution in #​5577

Full Changelog: external-secrets/external-secrets@v1.0.0...v1.1.0

v1.0.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.0.0
Image: ghcr.io/external-secrets/external-secrets:v1.0.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.0.0-ubi-boringssl

What's Changed

General

• chore: release helm chart for v0.20.4 by @​Skarlso in #​5502
• chore(actions): fix security alerts for github actions by @​Skarlso in #​5504
• chore(release): fix incorrect shas from security alert pinning by @​jakobmoellerdev in #​5512
• chore: update dependencies by @​eso-service-account-app[bot] in #​5519
• fix: upgrade go version by @​Skarlso in #​5529
• fix(charts): normalize certificate duration default value by @​aslafy-z in #​5497
• chore(revive-linter): add revive linter configuration by @​Lumexralph in #​5515
• feat: go module separation by @​moolen in #​5498
• fix: update deps script to reflect new go mod structure by @​moolen in #​5532
• fix: lint by @​gusfcarvalho in #​5536
• feat: dynamic target implementation for external secrets sources by @​Skarlso in #​5470
• fix: codeql should not rebuild the world on every run by @​Skarlso in #​5540
• fix(onepassword): Reduce API usage by @​sondrelg in #​5410
• feat(esoctl): adds bootstrap generator commands by @​gusfcarvalho in #​5539
• fix: adds missing externalsecret_type validation on generatorRef by @​gusfcarvalho in #​5547
• chore(docs): fix the generic resource doc using the incorrect switch by @​Skarlso in #​5548
• docs(adopters): add Topicus.Education to adopters list by @​sboschman in #​5551
• fix(build): use more portable bash by @​tiagolobocastro in #​5537

Dependencies

• chore(deps): bump alpine from 4bcff63 to 4b7ce07 in /hack/api-docs by @​dependabot[bot] in #​5507
• chore(deps): bump golang from 1.25.2 to 1.25.3 by @​dependabot[bot] in #​5506
• chore(deps): bump golang from aee43c3 to aee43c3 by @​dependabot[bot] in #​5516
• chore(deps): bump golang from 1.25.2-bookworm to 1.25.3-bookworm in /e2e by @​dependabot[bot] in #​5505
• chore(deps): bump anchore/sbom-action from 0.20.8 to 0.20.9 by @​dependabot[bot] in #​5508
• chore(deps): bump hashicorp/setup-terraform from c529327 to 982f6f0 by @​dependabot[bot] in #​5510
• chore(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @​dependabot[bot] in #​5513
• chore(deps): bump github/codeql-action from 4.30.9 to 4.31.0 by @​dependabot[bot] in #​5514
• chore(deps): bump actions/cache from 4.2.4 to 4.3.0 by @​dependabot[bot] in #​5511
• chore(deps): bump regex from 2025.9.18 to 2025.10.23 in /hack/api-docs by @​dependabot[bot] in #​5509
• chore(deps): bump mkdocs-macros-plugin from 1.4.0 to 1.4.1 in /hack/api-docs by @​dependabot[bot] in #​5518
• chore(deps): bump termcolor from 3.1.0 to 3.2.0 in /hack/api-docs by @​dependabot[bot] in #​5517
• chore(deps): bump github/codeql-action from 4.31.0 to 4.31.2 by @​dependabot[bot] in #​5531
• chore(deps): bump mkdocs-material from 9.6.22 to 9.6.23 in /hack/api-docs by @​dependabot[bot] in #​5533

New Contributors

• @​sondrelg made their first contribution in #​5410
• @​tiagolobocastro made their first contribution in #​5537

Full Changelog: external-secrets/external-secrets@v0.20.4...v1.0.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.