thdm-infra/clusters
2
0
Fork 0
Code Pull requests 2 Releases Packages Activity Actions

Update patch #54

Open
thdm-bot wants to merge 1 commit from renovate/patch into master
pull from: renovate/patch
merge into: thdm-infra:master
Conversation 0 Commits 1 Files changed 5 +5 -5
thdm-bot commented 2026-02-03 04:57:34 +01:00
Owner
Copy link

This PR contains the following updates:

Package Update Change
authentik (source) patch 2025.12.2 → 2025.12.3
cert-manager (source) patch v1.19.2 → v1.19.3
external-secrets patch 1.3.1 → 1.3.2
ingress-nginx patch 4.14.2 → 4.14.3
valkey-operator patch 0.1.11 → 0.1.12

Release Notes

goauthentik/helm (authentik)

v2025.12.3

Compare Source

authentik is an open-source Identity Provider focused on flexibility and versatility

What's Changed

Full Changelog: https://github.com/goauthentik/authentik/compare/version/2025.12.2...version/2025.12.3

cert-manager/cert-manager (cert-manager)

v1.19.3

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

This release contains three bug fixes, including a fix for the MODERATE severity DoS issue in GHSA-gx3x-vq4p-mhhv. All users should upgrade to the latest release.

Changes by Kind

Bug or Regression
  • Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. (#​8415, @​cert-manager-bot)
  • Fixed an issue where HTTP-01 challenges failed when the Host header contained an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. (#​8436, @​cert-manager-bot)
  • Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. (#​8468, @​SgtCoDFish)
Other (Cleanup or Flake)
external-secrets/external-secrets (external-secrets)

v1.3.2

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.3.2
Image: ghcr.io/external-secrets/external-secrets:v1.3.2-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.3.2-ubi-boringssl

What's Changed

General
Dependencies

New Contributors

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v1.3.1...v1.3.2

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [authentik](https://goauthentik.io) ([source](https://github.com/goauthentik/helm)) | patch | `2025.12.2` → `2025.12.3` | | [cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | patch | `v1.19.2` → `v1.19.3` | | [external-secrets](https://github.com/external-secrets/external-secrets) | patch | `1.3.1` → `1.3.2` | | [ingress-nginx](https://github.com/kubernetes/ingress-nginx) | patch | `4.14.2` → `4.14.3` | | valkey-operator | patch | `0.1.11` → `0.1.12` | --- ### Release Notes <details> <summary>goauthentik/helm (authentik)</summary> ### [`v2025.12.3`](https://github.com/goauthentik/helm/releases/tag/authentik-2025.12.3) [Compare Source](https://github.com/goauthentik/helm/compare/authentik-2025.12.2...authentik-2025.12.3) authentik is an open-source Identity Provider focused on flexibility and versatility #### What's Changed - charts/authentik: bump to 2025.12.3 by [@&#8203;authentik-automation](https://github.com/authentik-automation)\[bot] in [#&#8203;444](https://github.com/goauthentik/helm/pull/444) - 2025.12: Revert bulk revoke added by accident in release branch by [@&#8203;dominic-r](https://github.com/dominic-r) in [goauthentik/authentik#19870](https://github.com/goauthentik/authentik/pull/19870) - web/admin: fix toggle-group for bindings now showing up (cherry-pick [#&#8203;19820](https://github.com/goauthentik/helm/issues/19820) to version-2025.12) by [@&#8203;authentik-automation](https://github.com/authentik-automation)\[bot] in [goauthentik/authentik#19895](https://github.com/goauthentik/authentik/pull/19895) - web: fix Brand CSS not applied to nested Shadow DOM components (cherry-pick [#&#8203;19892](https://github.com/goauthentik/helm/issues/19892) to version-2025.12) by [@&#8203;authentik-automation](https://github.com/authentik-automation)\[bot] in [goauthentik/authentik#19900](https://github.com/goauthentik/authentik/pull/19900) - ci: always generate API clients ([#&#8203;19906](https://github.com/goauthentik/helm/issues/19906)) by [@&#8203;BeryJu](https://github.com/BeryJu) in [goauthentik/authentik#19932](https://github.com/goauthentik/authentik/pull/19932) - lifecycle/ak: make sure /data has the correct permissions (cherry-pick [#&#8203;19935](https://github.com/goauthentik/helm/issues/19935) to version-2025.12) by [@&#8203;authentik-automation](https://github.com/authentik-automation)\[bot] in [goauthentik/authentik#19940](https://github.com/goauthentik/authentik/pull/19940) - lifecycle/aws: add /data volume (cherry-pick [#&#8203;19936](https://github.com/goauthentik/helm/issues/19936) to version-2025.12) by [@&#8203;authentik-automation](https://github.com/authentik-automation)\[bot] in [goauthentik/authentik#19938](https://github.com/goauthentik/authentik/pull/19938) - core: fix non-expiring service accounts and app passwords (cherry-pick [#&#8203;19913](https://github.com/goauthentik/helm/issues/19913) to version-2025.12) by [@&#8203;authentik-automation](https://github.com/authentik-automation)\[bot] in [goauthentik/authentik#19941](https://github.com/goauthentik/authentik/pull/19941) **Full Changelog**: <https://github.com/goauthentik/authentik/compare/version/2025.12.2...version/2025.12.3> </details> <details> <summary>cert-manager/cert-manager (cert-manager)</summary> ### [`v1.19.3`](https://github.com/cert-manager/cert-manager/releases/tag/v1.19.3) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.19.2...v1.19.3) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. This release contains three bug fixes, including a fix for the MODERATE severity DoS issue in GHSA-gx3x-vq4p-mhhv. All users should upgrade to the latest release. #### Changes by Kind ##### Bug or Regression - Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#&#8203;8415](https://github.com/cert-manager/cert-manager/issues/8415), [@&#8203;cert-manager-bot](https://github.com/cert-manager-bot)) - Fixed an issue where HTTP-01 challenges failed when the Host header contained an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#&#8203;8436](https://github.com/cert-manager/cert-manager/issues/8436), [@&#8203;cert-manager-bot](https://github.com/cert-manager-bot)) - Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#&#8203;8468](https://github.com/cert-manager/cert-manager/issues/8468), [@&#8203;SgtCoDFish](https://github.com/SgtCoDFish)) ##### Other (Cleanup or Flake) - Bump go to 1.25.6 ([#&#8203;8459](https://github.com/cert-manager/cert-manager/issues/8459), [@&#8203;SgtCoDFish](https://github.com/SgtCoDFish)) </details> <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v1.3.2`](https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v1.3.1...v1.3.2) Image: `ghcr.io/external-secrets/external-secrets:v1.3.2` Image: `ghcr.io/external-secrets/external-secrets:v1.3.2-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.3.2-ubi-boringssl` <!-- Release notes generated using configuration in .github/release.yml at main --> #### What's Changed ##### General - chore: release helm chart for v1.3.1 by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;5860](https://github.com/external-secrets/external-secrets/pull/5860) - chore(chart): Add missing tests for readinessProbe by [@&#8203;jcpunk](https://github.com/jcpunk) in [#&#8203;5769](https://github.com/external-secrets/external-secrets/pull/5769) - docs: Update FluxCD example by [@&#8203;umizoom](https://github.com/umizoom) in [#&#8203;5862](https://github.com/external-secrets/external-secrets/pull/5862) - fix(ci): Removed the unused check for Windows in Makefile by [@&#8203;HauptJ](https://github.com/HauptJ) in [#&#8203;5870](https://github.com/external-secrets/external-secrets/pull/5870) - docs(release): Add actual dates for EOL of 1.x releases in stability and support page by [@&#8203;n4zukker](https://github.com/n4zukker) in [#&#8203;5889](https://github.com/external-secrets/external-secrets/pull/5889) - docs: Passbolt provider maintenance ownership by [@&#8203;stripthis](https://github.com/stripthis) in [#&#8203;5886](https://github.com/external-secrets/external-secrets/pull/5886) - chore: Update Passbolt MaintenanceStatus to MaintenanceStatusMaintained by [@&#8203;stripthis](https://github.com/stripthis) in [#&#8203;5887](https://github.com/external-secrets/external-secrets/pull/5887) - fix(security): sanitize json.Unmarshal errors to prevent secret data … by [@&#8203;moolen](https://github.com/moolen) in [#&#8203;5884](https://github.com/external-secrets/external-secrets/pull/5884) - fix: webhook initialization order by [@&#8203;gusfcarvalho](https://github.com/gusfcarvalho) in [#&#8203;5901](https://github.com/external-secrets/external-secrets/pull/5901) - chore: Cleanup flags by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;5845](https://github.com/external-secrets/external-secrets/pull/5845) - fix: onepasswordsdk shared tenant by altering the provider in the client cache by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;5921](https://github.com/external-secrets/external-secrets/pull/5921) ##### Dependencies - chore(deps): bump github/codeql-action from 4.31.10 to 4.31.11 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5873](https://github.com/external-secrets/external-secrets/pull/5873) - chore(deps): bump pymdown-extensions from 10.20 to 10.20.1 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5877](https://github.com/external-secrets/external-secrets/pull/5877) - chore(deps): bump markdown from 3.10 to 3.10.1 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5880](https://github.com/external-secrets/external-secrets/pull/5880) - chore(deps): bump ubi9/ubi from `22e9573` to `1f84f5c` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5871](https://github.com/external-secrets/external-secrets/pull/5871) - chore(deps): bump actions/setup-python from 6.1.0 to 6.2.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5872](https://github.com/external-secrets/external-secrets/pull/5872) - chore(deps): bump hashicorp/setup-terraform from [`93d5a27`](https://github.com/external-secrets/external-secrets/commit/93d5a27adc7ac26085422db72568ae486f091042) to [`dcc3150`](https://github.com/external-secrets/external-secrets/commit/dcc3150f6037c0405dd84cb44d1d91ebbaa96514) by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5875](https://github.com/external-secrets/external-secrets/pull/5875) - chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5876](https://github.com/external-secrets/external-secrets/pull/5876) - chore(deps): bump step-security/harden-runner from 2.14.0 to 2.14.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5878](https://github.com/external-secrets/external-secrets/pull/5878) - chore(deps): bump anchore/sbom-action from 0.21.1 to 0.22.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5874](https://github.com/external-secrets/external-secrets/pull/5874) - chore(deps): bump packaging from 25.0 to 26.0 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5879](https://github.com/external-secrets/external-secrets/pull/5879) - chore(deps): bump golang from `d9b2e14` to `98e6cff` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5907](https://github.com/external-secrets/external-secrets/pull/5907) - chore(deps): bump alpine from `865b95f` to `2510918` in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5914](https://github.com/external-secrets/external-secrets/pull/5914) - chore(deps): bump docker/login-action from 3.6.0 to 3.7.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5909](https://github.com/external-secrets/external-secrets/pull/5909) - chore(deps): bump actions/cache from 5.0.2 to 5.0.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5912](https://github.com/external-secrets/external-secrets/pull/5912) - chore(deps): bump actions/attest-build-provenance from 3.1.0 to 3.2.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5910](https://github.com/external-secrets/external-secrets/pull/5910) - chore(deps): bump hashicorp/setup-terraform from [`dcc3150`](https://github.com/external-secrets/external-secrets/commit/dcc3150f6037c0405dd84cb44d1d91ebbaa96514) to [`ce70bcf`](https://github.com/external-secrets/external-secrets/commit/ce70bcf31a3711a1efd50b61e7216b0196b6f4f1) by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5911](https://github.com/external-secrets/external-secrets/pull/5911) - chore(deps): bump ubi9/ubi from `1f84f5c` to `c8df11b` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5908](https://github.com/external-secrets/external-secrets/pull/5908) - chore(deps): bump alpine from 3.23.2 to 3.23.3 in /e2e by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5915](https://github.com/external-secrets/external-secrets/pull/5915) - chore(deps): bump alpine from `865b95f` to `2510918` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5906](https://github.com/external-secrets/external-secrets/pull/5906) - chore(deps): bump pathspec from 1.0.3 to 1.0.4 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5916](https://github.com/external-secrets/external-secrets/pull/5916) - chore(deps): bump babel from 2.17.0 to 2.18.0 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5917](https://github.com/external-secrets/external-secrets/pull/5917) - chore(deps): bump github/codeql-action from 4.31.11 to 4.32.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5913](https://github.com/external-secrets/external-secrets/pull/5913) #### New Contributors - [@&#8203;umizoom](https://github.com/umizoom) made their first contribution in [#&#8203;5862](https://github.com/external-secrets/external-secrets/pull/5862) - [@&#8203;HauptJ](https://github.com/HauptJ) made their first contribution in [#&#8203;5870](https://github.com/external-secrets/external-secrets/pull/5870) - [@&#8203;n4zukker](https://github.com/n4zukker) made their first contribution in [#&#8203;5889](https://github.com/external-secrets/external-secrets/pull/5889) - [@&#8203;stripthis](https://github.com/stripthis) made their first contribution in [#&#8203;5886](https://github.com/external-secrets/external-secrets/pull/5886) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v1.3.1...v1.3.2> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4wLjkiLCJ1cGRhdGVkSW5WZXIiOiI0My4wLjkiLCJ0YXJnZXRCcmFuY2giOiJtYXN0ZXIiLCJsYWJlbHMiOltdfQ==-->
thdm-bot force-pushed renovate/patch from 5ea5c19cc1 to 4011b87b29 2026-02-04 04:57:13 +01:00 Compare
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/patch:renovate/patch
git switch renovate/patch

Merge

Merge the changes and update on Forgejo.
git switch master
git merge --no-ff renovate/patch
git switch renovate/patch
git rebase master
git switch master
git merge --ff-only renovate/patch
git switch renovate/patch
git rebase master
git switch master
git merge --no-ff renovate/patch
git switch master
git merge --squash renovate/patch
git switch master
git merge --ff-only renovate/patch
git switch master
git merge renovate/patch
git push origin master
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
thdm-infra/clusters!54
No description provided.