chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #177 · stackitcloud/stackit-cert-manager-webhook

renovate · 2026-03-06T13:09:11Z

This PR contains the following updates:

Package	Type	Update	Change
anchore/sbom-action	action	minor	`v0.23.0` → `v0.24.0`
github.com/cert-manager/cert-manager	require	minor	`v1.19.4` → `v1.20.1`
github.com/stackitcloud/stackit-sdk-go/core	require	minor	`v0.22.0` → `v0.24.0`
github.com/stackitcloud/stackit-sdk-go/services/dns	require	minor	`v0.17.6` → `v0.19.2`
github/codeql-action	action	minor	`v4.32.6` → `v4.35.1`
sigstore/cosign-installer	action	minor	`v4.0.0` → `v4.1.1`
step-security/harden-runner	action	minor	`v2.15.1` → `v2.16.1`

Release Notes

anchore/sbom-action (anchore/sbom-action)

`v0.24.0`

Compare Source

v0.24.0

chore: update to node 24 + deps (#614) [@kzantow]
chore: update to ES modules (#595) [@kzantow]

⬆️ Dependencies

chore(deps): update Syft to v1.42.3 (#615) [@anchore-actions-token-generator[bot]]

`v0.23.1`

Compare Source

v0.23.1

⬆️ Dependencies

chore(deps): update Syft to v1.42.2 (#607) [@anchore-actions-token-generator[bot]]
chore(deps): bump fast-xml-parser and all other deps (#604) [@dependabot[bot]]

cert-manager/cert-manager (github.com/cert-manager/cert-manager)

`v1.20.1`

Compare Source

`v1.20.0`

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.20.0 adds alpha support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta.

Changes by Kind

Feature

Added a set of flags to permit setting NetworkPolicy across all deployed containers. Remove redundant global IP ranges from example policies. (#8370, @jcpunk)
Added selectable fields to custom resource definitions for .spec.issuerRef.{group, kind, name} (#8256, @tareksha)
Added support for specifying imagePullSecrets in the startupapicheck-job Helm template to enable pulling images from private registries. (#8186, @mathieu-clnk)
Added 'extraContainers' helm chart value, allowing the deployment of arbitrary sidecar containers within the cert-manager operator pod. This can be used to support, for e.g., AWS IAM Roles Anywhere for Route53 DNS01 verification. (#8355, @dancmeyers)
Added parentRef override annotations on the Certificate resource. (#8518, @hjoshi123)
Added support for azure private zones for dns01 issuer. (#8494, @hjoshi123)
Added support for configuring PEM decoding size limits, allowing operators to handle larger certificates and keys. (#7642, @robertlestak)
Added support for unhealthyPodEvictionPolicy in PodDisruptionBudget (#7728, @jcpunk)
For Venafi provider, read venafi.cert-manager.io/custom-fields annotation on Issuer/ClusterIssuer and use it as base with override/append capabilities on Certificate level. (#8301, @k0da)
Improve error message when CA issuers are misconfigured to use a clashing secret name (#8374, @majiayu000)
Introduce a new Ingress annotation acme.cert-manager.io/http01-ingress-ingressclassname to override http01.ingress.ingressClassName field in HTTP-01 challenge solvers. (#8244, @lunarwhite)
Update global.nodeSelector to helm chart to perform a merge and allow for a single nodeSelector to be set across all services. (#8195, @StingRayZA)
Vault issuers will now include the Vault server address as one of the default audiences on generated service account tokens. (#8228, @terinjokes)
Added experimental XListenerSets feature gate (#8394, @hjoshi123)

Documentation

Add GWAPI documentation to NOTES.TXT in helm chart (#8353, @jaxels10)

Bug or Regression

Adds logs for cases when acme server returns us a fatal error in the order controller (#8199, @Peac36)
Fixed an issue where kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed (#8160, @inteon)
Changes to the Duration and RenewBefore annotations on ingress and gateway-api resources will now trigger certificate updates. (#8232, @eleanor-merry)
Fix an issue where ACME challenge TXT records are not cleaned up when there are many resource records in CloudDNS. (#8456, @tkna)
Fix unregulated retries with the DigitalOcean DNS-01 solver
Add full detailed DNS-01 errors to the events attached to the Challenge, for easier debugging (#8221, @wallrj-cyberark)
Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. (#8403, @calm329)
Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. (#8424, @SlashNephy)
Fixed the HTTP-01 Gateway solver creating invalid HTTPRoutes by not setting spec.hostnames when the challenge DNSName is an IP address. (#8443, @alviss7)
Revert API defaults for issuer reference kind and group introduced in 0.19.0 (#8173, @erikgb)
Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. (#8469, @SgtCoDFish)
Update Go to v1.25.5 to fix CVE-2025-61727 and CVE-2025-61729 (#8290, @octo-sts[bot])
When Prometheus monitoring is enabled, the metrics label is now set to the intended value of cert-manager. Previously, it was set depending on various factors (namespace cert-manager is installed in and/or Helm release name). (#8162, @LiquidPL)

Other (Cleanup or Flake)

Promoted the OtherNames feature to Beta and enabled it by default (#8288, @wallrj-cyberark)
Promoting XListenerSets feature gate to ListenerSets (#8501, @hjoshi123)
Rebranding of the Venafi Issuer to CyberArk (#8215, @iossifbenbassat123)
Switched to SSA for challenge finalizer updates (#8519, @inteon)
The default container user (UID) is now 65532 (previously 1000) and the default container group (GID) is now 65532 (previously 0) (#8408, @wallrj-cyberark)
The feature-gate DefaultPrivateKeyRotationPolicyAlways moved from Beta to GA and can no longer be disabled. (#8287, @wallrj-cyberark)
Update cert-manager's ACME client, forked from golang/x/crypto (#8268, @SgtCoDFish)
Use the latest version of Kyverno (1.16.2) in the best-practice installation tests (#8389, @wallrj-cyberark)
We stopped testing with Coutour due to it not supporting the new XListenerSet resource, and moved to kgateway. (#8426, @hjoshi123)

github/codeql-action (github/codeql-action)

`v4.35.1`

Compare Source

Fix incorrect minimum required Git version for improved incremental analysis: it should have been 2.36.0, not 2.11.0. #3781

`v4.35.0`

Compare Source

Reduced the minimum Git version required for improved incremental analysis from 2.38.0 to 2.11.0. #3767
Update default CodeQL bundle version to 2.25.1. #3773

`v4.34.1`

Compare Source

Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #3762

`v4.34.0`

Compare Source

Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #3569
We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #3584
Update default CodeQL bundle version to 2.25.0. #3585

`v4.33.0`

Compare Source

Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. #3562

To opt out of this change:
- Repositories owned by an organization: Create a custom repository property with the name github-codeql-file-coverage-on-prs and the type "True/false", then set this property to true in the repository's settings. For more information, see Managing custom properties for repositories in your organization. Alternatively, if you are using an advanced setup workflow, you can set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
- User-owned repositories using default setup: Switch to an advanced setup workflow and set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
- User-owned repositories using advanced setup: Set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
Fixed a bug which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. #3557
The CodeQL Action now loads custom repository properties on GitHub Enterprise Server, enabling the customization of features such as github-codeql-disable-overlay that was previously only available on GitHub.com. #3559
Once private package registries can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. #3563
Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". #3564
A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. #3570

sigstore/cosign-installer (sigstore/cosign-installer)

`v4.1.1`

Compare Source

What's Changed

chore: update default cosign-release to v3.0.5 in #223

Full Changelog: sigstore/cosign-installer@v4.1.0...v4.1.1

`v4.1.0`

Compare Source

What's Changed

We recommend updating as soon as possible as this includes bug fixes for Cosign. We also recommend removing with: cosign-release and strongly discourage using cosign-release unless you have a specific reason to use an older version of Cosign.

Bump cosign to 3.0.5 in #220
fix: add retry to curl downloads for transient network failures in #210

Full Changelog: sigstore/cosign-installer@v4.0.0...v4.1.0

step-security/harden-runner (step-security/harden-runner)

`v2.16.1`

Compare Source

What's Changed

Enterprise tier: Added support for direct IP addresses in the allow list
Community tier: Migrated Harden Runner telemetry to a new endpoint

Full Changelog: step-security/harden-runner@v2.16.0...v2.16.1

`v2.16.0`

Compare Source

What's Changed

Updated action.yml to use node24
Security fix: Fixed a medium severity vulnerability where the egress block policy could be bypassed via DNS over HTTPS (DoH) by proxying DNS queries through a permitted resolver, allowing data exfiltration even with a restrictive allowed-endpoints list. This issue only affects the Community Tier; the Enterprise Tier is not affected. See GHSA-46g3-37rh-v698 for details.
Security fix: Fixed a medium severity vulnerability where the egress block policy could be bypassed via DNS queries over TCP to external resolvers, allowing outbound network communication that evades configured network restrictions. This issue only affects the Community Tier; the Enterprise Tier is not affected. See GHSA-g699-3x6g-wm3g for details.

Full Changelog: step-security/harden-runner@v2.15.1...v2.16.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-03-10T17:22:52Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

34 additional dependencies were updated

Details:

Package	Change
`k8s.io/api`	`v0.34.6` -> `v0.35.2`
`k8s.io/apiextensions-apiserver`	`v0.34.6` -> `v0.35.2`
`k8s.io/apimachinery`	`v0.34.6` -> `v0.35.2`
`k8s.io/client-go`	`v0.34.6` -> `v0.35.2`
`cel.dev/expr`	`v0.24.0` -> `v0.25.1`
`github.com/go-openapi/jsonpointer`	`v0.22.1` -> `v0.22.4`
`github.com/go-openapi/jsonreference`	`v0.21.2` -> `v0.21.4`
`github.com/go-openapi/swag/jsonname`	`v0.25.1` -> `v0.25.4`
`github.com/google/gnostic-models`	`v0.7.0` -> `v0.7.1`
`github.com/mailru/easyjson`	`v0.9.0` -> `v0.9.1`
`github.com/miekg/dns`	`v1.1.68` -> `v1.1.72`
`github.com/spf13/cobra`	`v1.10.1` -> `v1.10.2`
`golang.org/x/crypto`	`v0.45.0` -> `v0.49.0`
`golang.org/x/mod`	`v0.29.0` -> `v0.33.0`
`golang.org/x/net`	`v0.47.0` -> `v0.52.0`
`golang.org/x/oauth2`	`v0.31.0` -> `v0.35.0`
`golang.org/x/sync`	`v0.18.0` -> `v0.20.0`
`golang.org/x/sys`	`v0.40.0` -> `v0.42.0`
`golang.org/x/term`	`v0.37.0` -> `v0.41.0`
`golang.org/x/text`	`v0.31.0` -> `v0.35.0`
`golang.org/x/time`	`v0.13.0` -> `v0.14.0`
`golang.org/x/tools`	`v0.38.0` -> `v0.42.0`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20250721164621-a45f3dfb1074` -> `v0.0.0-20260128011058-8636f8732409`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20250929231259-57b25ae835d4` -> `v0.0.0-20260319201613-d00831a3d3e7`
`google.golang.org/grpc`	`v1.75.1` -> `v1.79.3`
`google.golang.org/protobuf`	`v1.36.9` -> `v1.36.11`
`k8s.io/apiserver`	`v0.34.6` -> `v0.35.2`
`k8s.io/component-base`	`v0.34.6` -> `v0.35.2`
`k8s.io/klog/v2`	`v2.130.1` -> `v2.140.0`
`k8s.io/kms`	`v0.34.6` -> `v0.35.2`
`k8s.io/kube-openapi`	`v0.0.0-20250910181357-589584f1c912` -> `v0.0.0-20260127142750-a19766b6e2d4`
`sigs.k8s.io/controller-runtime`	`v0.22.3` -> `v0.23.1`
`sigs.k8s.io/gateway-api`	`v1.4.0` -> `v1.5.0`
`sigs.k8s.io/structured-merge-diff/v6`	`v6.3.0` -> `v6.3.2`

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate bot requested a review from fsandel as a code owner March 6, 2026 13:09

renovate bot force-pushed the renovate/all-minor-patch branch from 1f384d6 to df3a4c5 Compare March 9, 2026 21:43

renovate bot changed the title ~~chore(deps): update module github.com/stackitcloud/stackit-sdk-go/services/dns to v0.18.0~~ chore(deps): update all non-major dependencies Mar 9, 2026

renovate bot force-pushed the renovate/all-minor-patch branch from df3a4c5 to 68b26d0 Compare March 10, 2026 17:22

renovate bot force-pushed the renovate/all-minor-patch branch 9 times, most recently from 4b89819 to b1700ca Compare March 16, 2026 14:50

renovate bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 9e45b46 to d4771d4 Compare March 20, 2026 01:33

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 583d786 to 955aad5 Compare March 31, 2026 14:46

chore(deps): update all non-major dependencies

73e7f75

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate bot force-pushed the renovate/all-minor-patch branch from 955aad5 to 73e7f75 Compare March 31, 2026 14:46

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update all non-major dependencies#177

chore(deps): update all non-major dependencies#177
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all-minor-patch

renovate bot commented Mar 6, 2026 •

edited

Loading

Uh oh!

renovate bot commented Mar 10, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v0.24.0

⬆️ Dependencies

v0.23.1

⬆️ Dependencies

Changes by Kind

Feature

Documentation

Bug or Regression

Other (Cleanup or Flake)

What's Changed

What's Changed

What's Changed

What's Changed

Configuration

Uh oh!

renovate bot commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Mar 6, 2026 •

edited

Loading

renovate bot commented Mar 10, 2026 •

edited

Loading