infra/kubernetes-deploy

Fork 0

Update Helm release external-secrets to v2 #3

Merged

roshless merged 1 commit from renovate/major-helm-charts into master

2026-09-11 11:14:23 +02:00

renovate-bot commented

2026-09-10 23:00:59 +02:00

Collaborator

This PR contains the following updates:

Package	Update	Change
external-secrets	major	`0.20.4` → `2.10.0`

⚠️ Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

external-secrets/external-secrets (external-secrets)

`v2.10.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.10.0
Image: ghcr.io/external-secrets/external-secrets:v2.10.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.10.0-ubi-boringssl

What's Changed

General

chore: release helm chart for 2.9.0 by @Skarlso in #6808
docs: correct the design type in the PR template by @sanchpet in #6813
fix(aws): redact credentials in aws auth config logs by @hixichen in #6683
fix(gcp): preserve workload identity token expiry by @jakobtfr in #6772
feat(conjur): Conjur PushSecret by @aidy in #6272
fix(infisical): scope dataFrom.find.path in list requests by @thc1006 in #6821
chore: bump golangci-lint and fix new linting issues by @evrardj-roche in #6740
feat(openbao): add auth.kubernetes auth method by @Nerkho in #6591
docs: add OpenChoreo to the adopters list by @kavishkafernando in #6820
feat(passbolt): add support for custom fields by @saknopper in #6696
chore: update go version to 1.26.6 by @alekc in #6835
feat(core): report safe reconcile errors in status conditions by @alekc in #6834
fix(secretserver): missing field siteId in secret creation by @pr0ton11 in #6649
fix: Reconcile sha and version by @evrardj-roche in #6843
chore(deps): bump aws acm by @evrardj-roche in #6705
chore(deps): update go-ntlmssp to v0.1.1 by @evrardj-roche in #6701
clean: Get rid of tests importing provider deps by @evrardj-roche in #6846
chore(deps): bump GitLab API client to v1.46.0 by @evrardj-roche in #6700
docs(webhook): escape Go template examples with {% raw %} by @atobaum in #6852
fix(ci): put CODEOWNERS at a path GitHub actually reads by @alekc in #6853
feat(passbolt): PB-53915 - Surface custom field functions in SDK by @cedricherzog-passbolt in #6848
design: Guarantee module import boundaries by @evrardj-roche in #6851
feat(providers): Nebius MysteryBox SA token federation auth option added by @greenmapc in #6784
fix: Unblock CI by @evrardj-roche in #6874
fix(vault): only apply deprecated token-cache flags when explicitly set by @markof88 in #6827
feat: apply TLS security profile to the external-secrets deployment by @siddhibhor-56 in #6617
feat(github): support Dependabot secrets by @SanderKnape in #6878

Dependencies

chore(deps): bump golang from 0178a64 to 0178a64 by @dependabot[bot] in #6818
chore(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 by @dependabot[bot] in #6819
chore(deps): bump setuptools from 83.0.0 to 84.0.0 in /hack/api-docs by @dependabot[bot] in #6826
chore(deps): bump golang from af8d674 to 3889b42 by @dependabot[bot] in #6838
chore(deps): bump step-security/harden-runner from 2.20.1 to 2.21.0 by @dependabot[bot] in #6840
chore(deps): bump the codeql group across 1 directory with 3 updates by @dependabot[bot] in #6839
chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #6867
chore(deps): bump ubi9/ubi from 2a6bd69 to 5426a8f by @dependabot[bot] in #6865
chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #6868
chore(deps): bump golang from 1.26.6-bookworm to 1.27.0-bookworm in /e2e by @dependabot[bot] in #6866
chore(deps): bump golang from 3889b42 to 4c9fe60 by @dependabot[bot] in #6864
chore(deps): bump distroless/static from 9197324 to f2ea270 by @dependabot[bot] in #6863

New Contributors

@sanchpet made their first contribution in #6813
@hixichen made their first contribution in #6683
@jakobtfr made their first contribution in #6772
@aidy made their first contribution in #6272
@thc1006 made their first contribution in #6821
@Nerkho made their first contribution in #6591
@kavishkafernando made their first contribution in #6820
@saknopper made their first contribution in #6696
@atobaum made their first contribution in #6852
@markof88 made their first contribution in #6827
@SanderKnape made their first contribution in #6878

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.9.0...v2.10.0

`v2.9.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.9.0
Image: ghcr.io/external-secrets/external-secrets:v2.9.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.9.0-ubi-boringssl

What's Changed

General

chore: release helm chart 2.8.0 by @Skarlso in #6656
fix(conjur): add InstallTimeout to helm chart installation and pin server image version by @alekc in #6658
fix(deps): bump grpc-go for GHSA-hrxh-6v49-42gf by @evrardj-roche in #6695
feat(charts): add opt-in schedulerName and runtimeClassName to the pods by @somaz94 in #6675
fix(webhookconfig): use a constant Eventf format by @evrardj-roche in #6699
fix: bump codeqls together by @evrardj-roche in #6707
fix(security): install crane in a reliable way and fix code scanning issue by @Skarlso in #6712
chore: Fix cve-2026-56852 by bump golang.org/x/text@0.40 by @evrardj-roche in #6734
chore(fix): template abuse for secret values by @Skarlso in #6730
chore: Bump controller runtime by @evrardj-roche in #6703
chore(fix): moved the validation further up the chain by @Skarlso in #6735
fix: pin all dependencies by @evrardj-roche in #6727
feat(e2e): implement fan-out matrix validation and credential scoping by @alekc in #6660
fix(akeyless): use local errors.As target to avoid data race by @HYPERVAPOR in #6749
test(crd): add e2e suite and CI leg for the CRD provider by @alekc in #6742
docs(webhook): add debugging guide and fix stale secret-label claim by @alekc in #6746
test(e2e): skip the global addon uninstall on disposable clusters by @alekc in #6780
feat: add environments support to 1Password SDK by @Skarlso in #6318
fix(akeyless): stop reporting API failures as a missing item by @alekc in #6753
fix(makefile): harden clean worktree check by @evrardj-roche in #6702
fix: support docs builds from worktrees by @evrardj-roche in #6741
feat(cache): add atomic ContainsOrAdd by @evrardj-roche in #6706
fix: omit empty AWS secret replica regions by @goutamadwant in #6596
fix: Follow up PR6318 by @evrardj-roche in #6782
feat: Show sponsoring of Roche by @evrardj-roche in #6790
fix(e2e): make the oracle suite runnable by @alekc in #6770
chore: temporarily allow GHSA-gcjh-h69q-9w9g by @evrardj-roche in #6795
fix(api): stop defaulting optional ExternalSecret strategy fields by @alekc in #6798
chore: remove/cleanup remaining tools from tools.go. by @evrardj-roche in #6786
chore: Cleanup sponsors dead links by @evrardj-roche in #6791
fix(aws): detach replicated regions before deleting AWS SecretsManager secret by @cmoscofian in #6687
chore: fix enable cache being removed on installCRD=false by @Skarlso in #6799

Dependencies

chore(deps): bump golang from 0178a64 to 0178a64 by @dependabot[bot] in #6663
chore(deps): bump mkdocs-material from 9.7.6 to 9.7.7 in /hack/api-docs by @dependabot[bot] in #6669
chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.1 by @dependabot[bot] in #6674
chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 by @dependabot[bot] in #6667
chore(deps): bump fkirc/skip-duplicate-actions from 5.3.1 to 5.3.2 by @dependabot[bot] in #6671
chore(deps): bump actions/stale from 10.3.0 to 10.4.0 by @dependabot[bot] in #6673
chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in #6672
chore(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 6.2.2 by @dependabot[bot] in #6670
chore(deps): bump distroless/static from d5f030c to 9197324 by @dependabot[bot] in #6662
chore(deps): bump ubi9/ubi from 8bf0e8f to 2a6bd69 by @dependabot[bot] in #6661
chore(deps): bump actions/setup-go from 6.0.0 to 7.0.0 by @dependabot[bot] in #6664
chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by @dependabot[bot] in #6665
chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.3 by @dependabot[bot] in #6666
chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #6715
chore(deps): bump aws-actions/configure-aws-credentials from 6.2.2 to 6.2.3 by @dependabot[bot] in #6717
chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bot] in #6722
chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.3 in the codeql group across 1 directory by @dependabot[bot] in #6713
chore(deps): bump google-github-actions/auth from fc21748 to cd3439a by @dependabot[bot] in #6714
chore(deps): bump actions/cache from 4.2.4 to 6.1.0 by @dependabot[bot] in #6716
chore(deps): bump actions/labeler from 6.1.0 to 7.0.0 by @dependabot[bot] in #6718
chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.2.0 by @dependabot[bot] in #6719
chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 by @dependabot[bot] in #6720
chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0 by @dependabot[bot] in #6723
chore(deps): bump docker/login-action from 4.4.0 to 4.5.2 by @dependabot[bot] in #6736
chore(deps): bump actions/stale from 10.4.0 to 11.0.0 by @dependabot[bot] in #6738
chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #6751
chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 by @dependabot[bot] in #6752
chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #6801
chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #6802
chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 by @dependabot[bot] in #6805
chore(deps): bump azure/login from 3.0.0 to 3.0.1 by @dependabot[bot] in #6804
chore(deps): bump google-github-actions/auth from cd3439a to 1206044 by @dependabot[bot] in #6737
chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.1 by @dependabot[bot] in #6803

New Contributors

@HYPERVAPOR made their first contribution in #6749
@goutamadwant made their first contribution in #6596

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.8.0...v2.9.0

`v2.8.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.8.0
Image: ghcr.io/external-secrets/external-secrets:v2.8.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.8.0-ubi-boringssl

What's Changed

General

chore: release helm chart 2.7.0 by @Skarlso in #6529
docs(barbican): correct find semantics and document property/extract by @alekc in #6531
docs(gcp): use external-secrets.io/v1 in SecretStore examples by @alekc in #6563
feat(generators): add GitLab deploy token generator by @alekc in #6493
fix(barbican): validate store config and fix SecretExists error message by @alekc in #6534
docs(beyondtrust): fix capability matrix and document decrypt/separator by @alekc in #6535
feat: Make SecondsToLive optional for Grafana generator by @jaruwat-panturat in #6479
docs: add missing generators to ClusterGenerator spec snippet by @jaruwat-panturat in #6590
docs(doppler): fix download format list and heading levels by @alekc in #6559
docs(fortanix): add to support matrix and tidy provider page by @alekc in #6562
docs(yandex): fix Lockbox referent cell and add Certificate Manager rows by @alekc in #6585
docs(volcengine): mark referent authentication as supported by @alekc in #6584
docs(senhasegura): mark deletion + referent in matrix and fix title by @alekc in #6583
docs(scaleway): mark referent auth in matrix and fix headings by @alekc in #6581
docs(pulumi): correct find/referent matrix cells and fix headings by @alekc in #6578
docs(previder): correct find/referent matrix cells and fix headings by @alekc in #6577
docs(1password): mark SDK find support in matrix and promote titles by @alekc in #6568
feat(charts): Add aggregateToAdmin toggle by @illrill in #6586
docs(providers): consolidate 11 conflicting provider-doc PRs by @alekc in #6592
feat(charts): add startupProbe support to webhook deployment by @alpcanaydin in #6612
feat(akeyless): support azure_ad Workload Identity via serviceAccountRef by @baraka-akeyless in #6530
docs(kubernetes): fix invalid tab indentation and heading levels by @alekc in #6565
docs(dvls): mark DeletionPolicy supported and fix page title by @alekc in #6557
docs(bitwarden): fix find behaviour, find-by-name rules, and admonitions by @alekc in #6551
docs(github): add to support matrix, fix auth field, tidy page by @alekc in #6564
docs: Improve explanations of pem_chain by @evrardjp in #6623
feat: Make our stance regarding AI usage more explicit. by @evrardj-roche in #6621
fix(barbican): treat find.name.regexp as a regexp, not an exact match by @arpitjain099 in #6614
chore: update go version 1.26.5 - Fix CVE-2026-39822 by @alekc in #6631
ref(testing): change the e2e workflow to separate building stage from e2e stage (and free up resources) by @alekc in #6634
chore: updating ok-to-test to allow interim maintainers by @gusfcarvalho in #6638
fix(onepassword): support PushSecret IfNotExists by @civilizedBaboon in #6646
fix(testing): check out PR head in fork e2e instead of main by @alekc in #6647
fix(secretserver): validate store and map fields correctly by @dbinger in #6616
feat(charts): Add optional networkPolicy by @jcpunk in #5779
feat(akeyless): add SecretStore ignoreCache to bypass Gateway cache by @baraka-akeyless in #6507
feat(provider): implement AWS Certificate Manager provider by @dsp0x4 in #6117
feat: expose more values for custom metadata for vault v2 by @Skarlso in #6652
clean: Remove duplicate code by @evrardj-roche in #6629
feat: configurable leader election lease timings by @izz-linux in #6644
fix(akeyless): support dataFrom.extract.property for nested JSON by @baraka-akeyless in #6633
feat(conjur): Certificate Auth support by @hdabrowski in #6393
docs(aws): restore dropped access section and document missing fields by @alekc in #6517
feat(secretserver): support authentication via access token by @sumanpal97 in #6597
docs(secretserver): document authentication, key formats, property behavior, and limitations by @dbinger in #6619
feat(release): Support reading values from kubernetes CRD by @alekc in #6211
clean: Standardize and friendly name for validations policies by @evrardj-roche in #6630
feat: add CreateOrMerge creation policy for ExternalSecrets by @alekc in #6641
feat(core): accept duration string for SecretStore refreshInterval by @alekc in #6594
fix(beyondtrust): validate store without panicking on API key auth by @emmayusufu in #6553
fix(oracle): cache default WorkloadIdentity provider to prevent tcp port exhaustion by @Ashutosh-3601 in #6421

Dependencies

chore(deps): bump golang from 3ad5730 to 3ad5730 by @dependabot[bot] in #6538
chore(deps): bump ubi9/ubi from 1b99266 to 37a1589 by @dependabot[bot] in #6537
chore(deps): bump golang from 5f68ec6 to b305420 in /e2e by @dependabot[bot] in #6539
chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 by @dependabot[bot] in #6540
chore(deps): bump aws-actions/configure-aws-credentials from 6.2.0 to 6.2.1 by @dependabot[bot] in #6542
chore(deps): bump actions/attest-build-provenance from 4.1.0 to 4.1.1 by @dependabot[bot] in #6543
chore(deps): bump azure/setup-helm from 5.0.0 to 5.0.1 by @dependabot[bot] in #6544
chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #6541
chore(deps): bump actions/cache from 5.0.5 to 6.1.0 by @dependabot[bot] in #6545
chore(deps): bump golang from 3ad5730 to 3ad5730 by @dependabot[bot] in #6600
chore(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6606
chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6603
chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by @dependabot[bot] in #6607
chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3 by @dependabot[bot] in #6604
chore(deps): bump github/codeql-action/init from 4.36.2 to 4.36.3 by @dependabot[bot] in #6608
chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by @dependabot[bot] in #6605
chore(deps): bump docker/login-action from 4.2.0 to 4.4.0 by @dependabot[bot] in #6602
chore(deps): bump fossas/fossa-action from 1.9.0 to 2.0.0 by @dependabot[bot] in #6601
chore(deps): bump ubi9/ubi from 37a1589 to 8bf0e8f by @dependabot[bot] in #6599
chore(deps): bump golang from 1.26.4 to 1.26.5 by @dependabot[bot] in #6636
chore(deps): bump distroless/static from 3592aa8 to d5f030c by @dependabot[bot] in #6635

New Contributors

@alpcanaydin made their first contribution in #6612
@baraka-akeyless made their first contribution in #6530
@arpitjain099 made their first contribution in #6614
@civilizedBaboon made their first contribution in #6646
@dbinger made their first contribution in #6616
@dsp0x4 made their first contribution in #6117
@izz-linux made their first contribution in #6644
@hdabrowski made their first contribution in #6393
@sumanpal97 made their first contribution in #6597
@emmayusufu made their first contribution in #6553
@Ashutosh-3601 made their first contribution in #6421

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.7.0...v2.8.0

`v2.7.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.7.0
Image: ghcr.io/external-secrets/external-secrets:v2.7.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.7.0-ubi-boringssl

What's Changed

General

chore: release helm charts 2.6.0 by @Skarlso in #6427
test: add Infisical provider e2e suite by @alekc in #6415
docs: fix discrepancies and add missing documentation for GitLab provider by @alekc in #6430
docs: fix discrepancies and add missing documentation for Infisical provider by @alekc in #6431
feat(templating): add hexdec function by @tstenner in #6422
fix(volcengine): honor secretRef.namespace for ClusterSecretStore by @ruslan-rm in #6423
docs(core): correct CRD examples and document missing fields by @alekc in #6441
feat(provider): initial dedicated OpenBao provider by @phil9909 in #6405
feat(onepasswordsdk): implement GetAllSecrets by @calebmckay in #6445
feat(controller): log secret deletions and data-key changes by @alekc in #6443
feat: Add BeyondTrust WorkloadCredentials provider by @sdahal-bt in #5999
fix(charts): truncate component names to stay within 63-char DNS limit by @alekc in #6428
docs(gitops-fluxcd): fix webhook race condition in Flux deployment guide by @alekc in #6455
fix: no need for the field to have a default if it can be omitted by @knelasevero in #6453
fix(templating): preserve mixed-case in generic target paths by @alekc in #6459
docs(generator): document Password secretKeys for multiple keys by @alekc in #6440
docs: Update deprecated field in docs by @evrardj-roche in #6456
chore(deps): Bump passbolt SDK to v0.8.0 by @cedricherzog-passbolt in #6447
chore(charts): Expose storeRequeueInterval in helm charts by @jfhcagip in #6140
feat(openbao): support custom CAs via caBundle and caProvider by @phil9909 in #6461
feat(ngrok): use API filtering for vault and secret lookups by @jonstacks in #6376
fix: remove broken link from blog section by @riccardomc in #6465
chore: fix the template parser for resolving slice notations by @Skarlso in #6449
fix: bump docs deps for python3.13 by @evrardj-roche in #6475
fix(kubernetes): replace entire remote secret when pushing rather than merging by @riccardomc in #6485
feat(infisical): return NoSecretErr on 404 and add PushSecret support by @alekc in #6434
feat(AWS): add replicationLocations to AWS SecretsManager provider by @cmoscofian in #6451
feat(openbao): add auth.userPass auth method by @phil9909 in #6492
chore(deps): Bump github.com/pulumi/esc-sdk/sdk to v0.14.0 by @phil9909 in #6495
chore(onepasswordsdk): fix the caching logic and cleanup the code a bit by @Skarlso in #6466
feat(charts): scope cert-controller RBAC to managed CRDs and webhook secret by @somaz94 in #6481
test(ngrok): Remove over complicated mocks by @jonstacks in #6483
chore: Unpin mike by @evrardj-roche in #6477
docs(akeyless): fix errors and expand provider documentation by @alekc in #6506
chore: update go sys net and crypto libs by @Skarlso in #6511
chore(onepasswordsdk): enable the GetAllSecrets and GetSecret unit test and fix it by @Skarlso in #6513
feat(infisical): allow organization slug to be set in secret scope by @mathnogueira in #6508
feat(templating): decode templateFrom values by @evrardj-roche in #6482
chore(bug): fix missing lgtm runner script from the workflow by @Skarlso in #6512
fix(akeyless): return ReadWrite so PushSecret is routed by @alekc in #6515
feat(openbao): add auth.appRole auth method by @phil9909 in #6497
feat(externalsecret): add SyncWindows to gate periodic refresh by @alekc in #6452
docs(azure): correct Azure Stack example version and note expiry limit by @alekc in #6522
feat(openbao): add support for OpenBao Namespaces by @phil9909 in #6527
fix(github): preserve selected repositories on org secret update by @alekc in #6519
docs(azure): list WorkloadIdentity in authType field description by @alekc in #6523
feat(doppler): include HTTP status in API errors by @alekc in #6489

Dependencies

chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #6437
chore(deps): bump github/codeql-action from 4.36.0 to 4.36.2 by @dependabot[bot] in #6438
chore(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 by @dependabot[bot] in #6435
chore(deps): bump idna from 3.17 to 3.18 in /hack/api-docs by @dependabot[bot] in #6439
chore(deps): bump ubi9/ubi from 8942b73 to 46d19c1 by @dependabot[bot] in #6436
chore(deps): bump platformdirs from 4.9.6 to 4.10.0 in /hack/api-docs by @dependabot[bot] in #6410
chore(deps): bump golang from f23e8b2 to 7a3e500 by @dependabot[bot] in #6468
chore(deps): bump golang from 5d2b868 to 5f68ec6 in /e2e by @dependabot[bot] in #6471
chore(deps): bump tornado from 6.5.6 to 6.5.7 in /hack/api-docs by @dependabot[bot] in #6473
chore(deps): bump alpine from 3.23.4 to 3.24.0 in /e2e by @dependabot[bot] in #6470
chore(deps): bump alpine from 5b10f43 to a2d49ea by @dependabot[bot] in #6469
chore(deps): bump ubi9/ubi from 46d19c1 to 1b99266 by @dependabot[bot] in #6467
chore(deps): bump alpine from a2d49ea to 28bd5fe in /hack/api-docs by @dependabot[bot] in #6472
chore(deps): bump alpine from 3.24.0 to 3.24.1 in /e2e by @dependabot[bot] in #6498
chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #6500
chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 by @dependabot[bot] in #6502
chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @dependabot[bot] in #6503
chore(deps): bump alpine from a2d49ea to 28bd5fe by @dependabot[bot] in #6499
chore(deps): bump golang from 7a3e500 to 3ad5730 by @dependabot[bot] in #6501

New Contributors

@tstenner made their first contribution in #6422
@ruslan-rm made their first contribution in #6423
@calebmckay made their first contribution in #6445
@sdahal-bt made their first contribution in #5999
@jfhcagip made their first contribution in #6140
@somaz94 made their first contribution in #6481
@mathnogueira made their first contribution in #6508

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.6.0...v2.7.0

`v2.6.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.6.0
Image: ghcr.io/external-secrets/external-secrets:v2.6.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.6.0-ubi-boringssl

What's Changed

General

chore: release helm chart 2.5.0 by @Skarlso in #6352
feat(keeper): implement provider_api_calls_count metric by @m-k8s in #6345
docs(gcpsm): updates Google Secret Manager authentication guide with WIF usage by @bharath-b-rh in #6356
feat(release): PB-51302 - External secret should support v5-custom-fields resource type by @cedricherzog-passbolt in #6377
feat(testing): OpenBao e2e test by @phil9909 in #6396
docs: Explanation of our labels by @evrardj-roche in #6306
docs: add AGENTS.md and AI setup guide for ESO by @rowanruseler in #6141
fix(makefile): clean up cross-submodule go.mod churn after make test by @alekc in #6378
fix(provider): align TokenRequest body namespace with URL namespace by @alekc in #6420
fix(build): use buildx --load and non-registry image tag by @alekc in #6419
fix(charts): render PDB spec when minAvailable or maxUnavailable is zero by @blindrood in #6360
chore: update go version 1.26.4 by @Skarlso in #6426

Dependencies

chore(deps): bump golang from 91eda97 to 91eda97 by @dependabot[bot] in #6363
chore(deps): bump pymdown-extensions from 10.21.2 to 10.21.3 in /hack/api-docs by @dependabot[bot] in #6370
chore(deps): bump hashicorp/setup-terraform from 4.0.0 to 4.0.1 by @dependabot[bot] in #6364
chore(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 by @dependabot[bot] in #6365
chore(deps): bump step-security/harden-runner from 2.19.1 to 2.19.4 by @dependabot[bot] in #6366
chore(deps): bump github/codeql-action from 4.35.4 to 4.36.0 by @dependabot[bot] in #6368
chore(deps): bump distroless/static from 47b2d72 to 3592aa8 by @dependabot[bot] in #6362
chore(deps): bump ubi9/ubi from 2323fcf to 151fc1b by @dependabot[bot] in #6361
chore(deps): bump actions/create-github-app-token from 3.1.1 to 3.2.0 by @dependabot[bot] in #6367
chore(deps): bump idna from 3.14 to 3.16 in /hack/api-docs by @dependabot[bot] in #6369
chore(deps): bump golang from 91eda97 to 91eda97 by @dependabot[bot] in #6383
chore(deps): bump golang from 252599a to 386d475 in /e2e by @dependabot[bot] in #6389
chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 by @dependabot[bot] in #6384
chore(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 by @dependabot[bot] in #6387
chore(deps): bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6386
chore(deps): bump actions/stale from 10.2.0 to 10.3.0 by @dependabot[bot] in #6388
chore(deps): bump zipp from 3.23.1 to 4.1.0 in /hack/api-docs by @dependabot[bot] in #6390
chore(deps): bump click from 8.3.3 to 8.4.1 in /hack/api-docs by @dependabot[bot] in #6391
chore(deps): bump certifi from 2026.4.22 to 2026.5.20 in /hack/api-docs by @dependabot[bot] in #6392
chore(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6385
chore(deps): bump requests from 2.33.1 to 2.34.2 in /hack/api-docs by @dependabot[bot] in #6372
chore(deps): bump tornado from 6.5.5 to 6.5.6 in /hack/api-docs by @dependabot[bot] in #6412
chore(deps): bump ubi9/ubi from 151fc1b to 8942b73 by @dependabot[bot] in #6407
chore(deps): bump aws-actions/configure-aws-credentials from 6.1.1 to 6.2.0 by @dependabot[bot] in #6408
chore(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6409
chore(deps): bump idna from 3.16 to 3.17 in /hack/api-docs by @dependabot[bot] in #6411

New Contributors

@m-k8s made their first contribution in #6345
@phil9909 made their first contribution in #6396
@blindrood made their first contribution in #6360

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.5.0...v2.6.0

`v2.5.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.5.0
Image: ghcr.io/external-secrets/external-secrets:v2.5.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.5.0-ubi-boringssl

What's Changed

General

chore: release chart for v2.4.1 by @Skarlso in #6293
fix(doc): Adds missing doc reference for VaultDynamicSecret example using GET by @bharath-b-rh in #6296
feat(charts): make serviceaccounts/token create RBAC rule conditional by @kriszkern in #6295
ref: delete duplication of applyOwnership logic by @jaruwat-panturat in #6301
feat: add Pulumi OIDC-based authentication by @johnstonmatt in #5893
fix: datarace in fake runtime test and push secret test by @Skarlso in #6300
docs(release): Update docs to build for arm for bitwarden-cli by @Senk02 in #6312
feat: add healthz check for liveness probe to cert and webhook by @Skarlso in #6319
chore: bump go version 1.26.3 by @Skarlso in #6339
fix(charts): gate externalsecrets write RBAC on processClusterExternalSecret by @kriszkern in #6332
feat(gcp): issue-5790: optional GCP service account email for WIF impersonation by @bharath-b-rh in #6273
ref(beyondtrust): BIPS-32651 add API v3.2 support for create Secrets by @btfhernandez in #6309
fix(onepassword): return fresh provider instance from NewClient to avoid wrong-vault race by @duizabojul in #6334
docs: add Rootline to ADOPTERS.md by @daanschipper in #6342
feat(charts): default scopedNamespace to .Release.Namespace when scopedRBAC is true by @kriszkern in #6343
docs: add blank lines before lists by @chlab in #6336
chore(doc): fix Azure role name typo by @hobti01 in #6335
feat(security): Enable Authentication and Authorization for Metrics Endpoint using FilterProvider by @Zacky3181V in #5574
feat: inject kube context as STS session tags by @robertchildresscfa in #6311
fix(charts): remove stale args guard in controller deployment by @kriszkern in #6347
fix: provider/infisical provider sub-folder references in remoteRef.key by @varonix0 in #6338

Dependencies

chore(deps): bump golang from 4f4ab2c to 47ce563 in /e2e by @dependabot[bot] in #6286
chore(deps): bump click from 8.3.2 to 8.3.3 in /hack/api-docs by @dependabot[bot] in #6287
chore(deps): bump certifi from 2026.2.25 to 2026.4.22 in /hack/api-docs by @dependabot[bot] in #6288
chore(deps): bump pathspec from 1.0.4 to 1.1.1 in /hack/api-docs by @dependabot[bot] in #6291
chore(deps): bump idna from 3.11 to 3.13 in /hack/api-docs by @dependabot[bot] in #6290
chore(deps): bump packaging from 26.1 to 26.2 in /hack/api-docs by @dependabot[bot] in #6289
chore(deps): bump step-security/harden-runner from 2.19.0 to 2.19.1 by @dependabot[bot] in #6304
chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by @dependabot[bot] in #6305
chore(deps): bump golang from 1.26.2 to 1.26.3 by @dependabot[bot] in #6320
chore(deps): bump golang from 1.26.2-bookworm to 1.26.3-bookworm in /e2e by @dependabot[bot] in #6327
chore(deps): bump ubi9/ubi from fd3612e to 2323fcf by @dependabot[bot] in #6321
chore(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @dependabot[bot] in #6322
chore(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 by @dependabot[bot] in #6323
chore(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2 by @dependabot[bot] in #6325
chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by @dependabot[bot] in #6324
chore(deps): bump actions/labeler from 6.0.1 to 6.1.0 by @dependabot[bot] in #6326
chore(deps): bump idna from 3.13 to 3.14 in /hack/api-docs by @dependabot[bot] in #6328
chore(deps): bump urllib3 from 2.6.3 to 2.7.0 in /hack/api-docs by @dependabot[bot] in #6329
chore(deps): bump regex from 2026.4.4 to 2026.5.9 in /hack/api-docs by @dependabot[bot] in #6330

New Contributors

@kriszkern made their first contribution in #6295
@johnstonmatt made their first contribution in #5893
@Senk02 made their first contribution in #6312
@duizabojul made their first contribution in #6334
@daanschipper made their first contribution in #6342
@chlab made their first contribution in #6336
@hobti01 made their first contribution in #6335
@Zacky3181V made their first contribution in #5574
@robertchildresscfa made their first contribution in #6311

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.4.1...v2.5.0

`v2.4.1`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.4.1
Image: ghcr.io/external-secrets/external-secrets:v2.4.1-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.4.1-ubi-boringssl

What's Changed

General

chore: release chart for v2.4.0 by @Skarlso in #6277
feat(gcp): support multiple replicationLocations on PushSecret by @alliasgher in #6225
feat(passbolt): add custom CA bundle / CA provider support by @alliasgher in #6224
feat(azure): add contentType support for PushSecret by @ppatel1604 in #6249
feat(charts): add liveness probes to cert-controller and webhook by @mattcarp12 in #6147
fix: prevent creation of specific type of secrets by @Skarlso in #6280

Dependencies

chore(deps): bump golang from f853308 to f853308 by @dependabot[bot] in #6282
chore(deps): bump alpine from 2510918 to 5b10f43 in /hack/api-docs by @dependabot[bot] in #6285
chore(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 by @dependabot[bot] in #6283
chore(deps): bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 by @dependabot[bot] in #6284
chore(deps): bump ubi9/ubi from cf13fe2 to fd3612e by @dependabot[bot] in #6281

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.4.0...v2.4.1

`v2.4.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.4.0
Image: ghcr.io/external-secrets/external-secrets:v2.4.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.4.0-ubi-boringssl

What's Changed

General

chore: release helm chart for v2.3.0 by @Skarlso in #6204
fix(docs): hide Scarf tracking pixel to remove page whitespace by @ppatel1604 in #6209
docs: Add Grafana generator documentation by @jaruwat-panturat in #6227
docs: add TLS certificate authentication example for Vault provider by @alliasgher in #6212
docs(cloudsmith): Improve cloudsmith generator documentation by @cloudsmith-iduffy in #6232
docs: add missing specs to GeneratorSpec example by @jaruwat-panturat in #6236
feat(keeper): implement get secret by id or name by @tiberiuv in #6163
chore(secretserver): update dependencies to accept new DelineaXPM/tss-sdk-go by @DelineaSahilWankhede in #6240
docs(release): update documentation links from /main to /latest by @cinpol in #6210
fix: CAProvider cm access by @moolen in #6246
fix(chart): add failurePolicy to ClusterSecretStore webhook by @ryanjwong in #6247
feat(dvls): add name support for entries by @rbstp in #6099
fix(akeyless): upgrade akeyless-go-cloud-id to v0.3.7 by @alikdolg in #6248
chore(deps): bump azure/setup-helm from 3.5 to 5 by @dependabot[bot] in #6258
fix: do not set tags if undefined by @Skarlso in #6103
fix(conjur): return error for unimplemented PushSecret and DeleteSecret by @antonio-mazzini in #6266
docs: Enhance ClusterExternalSecret documentation with "fan-out" approach by @jaruwat-panturat in #6241
feat: add --leader-election-id flag to support HA deployments by @mattcarp12 in #6148
feat(bug): Fix CVE-2026-34165, CVE-2026-33762 and GHSA-3xc5-wrhm-f963 by @othomann in #6271
feat: enhance VaultDynamicSecret GET method to support parameters from the spec by @samm-git in #6267
fix: use a separate parameter for GET calls in VaultDynamicSecrets by @Skarlso in #6275

Dependencies

chore(deps): bump golang from c2a1f7b to c2a1f7b by @dependabot[bot] in #6214
chore(deps): bump platformdirs from 4.9.4 to 4.9.6 in /hack/api-docs by @dependabot[bot] in #6219
chore(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1 by @dependabot[bot] in #6216
chore(deps): bump codelytv/pr-size-labeler from 1.10.3 to 1.10.4 by @dependabot[bot] in #6221
chore(deps): bump ubi9/ubi from 9e6e193 to 039095f by @dependabot[bot] in #6213
chore(deps): bump importlib-resources from 6.5.2 to 7.1.0 in /hack/api-docs by @dependabot[bot] in #6220
chore(deps): bump actions/github-script from 8.0.0 to 9.0.0 by @dependabot[bot] in #6215
chore(deps): bump step-security/harden-runner from 2.16.1 to 2.17.0 by @dependabot[bot] in #6217
chore(deps): bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0 by @dependabot[bot] in #6218
chore(deps): bump azure/setup-helm from 3.4 to 3.5 by @dependabot[bot] in #6222
chore(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0 by @dependabot[bot] in #6223
chore(deps): bump golang from c2a1f7b to f853308 by @dependabot[bot] in #6252
chore(deps): bump alpine from 3.23.3 to 3.23.4 in /e2e by @dependabot[bot] in #6261
chore(deps): bump step-security/harden-runner from 2.17.0 to 2.19.0 by @dependabot[bot] in #6254
chore(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3 by @dependabot[bot] in #6257
chore(deps): bump actions/cache from 5.0.4 to 5.0.5 by @dependabot[bot] in #6259
chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by @dependabot[bot] in #6255
chore(deps): bump packaging from 26.0 to 26.1 in /hack/api-docs by @dependabot[bot] in #6263
chore(deps): bump zipp from 3.23.0 to 3.23.1 in /hack/api-docs by @dependabot[bot] in #6262
chore(deps): bump alpine from 2510918 to 5b10f43 by @dependabot[bot] in #6251
chore(deps): bump ubi9/ubi from 039095f to cf13fe2 by @dependabot[bot] in #6253
chore(deps): bump dependabot/fetch-metadata from 3.0.0 to 3.1.0 by @dependabot[bot] in #6260
chore(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.1.0 by @dependabot[bot] in #6256

New Contributors

@alliasgher made their first contribution in #6212
@tiberiuv made their first contribution in #6163
@cinpol made their first contribution in #6210
@ryanjwong made their first contribution in #6247
@alikdolg made their first contribution in #6248
@antonio-mazzini made their first contribution in #6266
@mattcarp12 made their first contribution in #6148

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.3.0...v2.4.0

`v2.3.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.3.0
Image: ghcr.io/external-secrets/external-secrets:v2.3.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.3.0-ubi-boringssl

What's Changed

General

chore: release charts v2.2.0 by @riccardomc in #6115
ref(modernize): modernize go code by @ivankatliarchuk in #6114
chore: bump bitwarden helm chart version to v0.6.0 by @Skarlso in #6118
chore: fix EoL in compatiblity table for version 2.2 by @riccardomc in #6128
docs: add missing jinja2 tags by @MindTooth in #6136
fix: cached uid after deleting a store by @Skarlso in #6138
feat(doppler): add ETag-based caching by @mikesellitto in #5997
fix(docs): fix metadata structure in Google Secrets Manager docs by @mruoss in #6139
feat: ovh provider implementation by @ldesauw in #6101
feat(providers): Implement PushSecret for Delinea Secret Server by @pr0ton11 in #6031
fix: propagate objectMeta and ownerReferences to target resources by @jaruwat-panturat in #6132
fix(release): remove docs.check and all relative calls by @jaruwat-panturat in #6146
feat: support service account impersonation when using Workload Identity Federation with a k8s service account by @zoomoid in #5707
fix: remove getHostByName from template funcs by @moolen in #6164
ref(kubernetes): move auth package from kubernetes to esutils by @alekc in #6149
docs: fix templating.md by @dangbert in #6168
fix(onepasswordsdk): support native 1Password item IDs in findItem by @LeahArmstrong in #6167
docs(ovhcloud): fix heterogeneous configuration documentation by @ldesauw in #6169
docs: add OVHcloud in ADOPTERS by @scraly in #6172
fix(docs): resolve macro syntax error in templating guide by @ManvithaP-hub in #6171
chore: rip out sprig dependency by @Skarlso in #6170
chore: fix jose cve by @Skarlso in #6178
docs: document correct htpasswd function usage by @Atomsoldat in #6177
feat(pushsecret): add dataTo support for bulk secret pushing by @mohamed-rekiba in #5850
docs: add existing blog post: ESO integration with ovhcloud secret manager with vault provider by @scraly in #6190
feat: move experimental-enable-vault-token-cache out of experimental and add expiry to validation by @sfotony in #5397
fix: prevent feedback loop by @moolen in #6021
fix: code scanning issues by @Skarlso in #6063
feat: add source null byte policy by @knelasevero in #6194
fix(test): fix broken test from automerge rebase by @knelasevero in #6199
fix(aws): handle empty resource policy in PushSecret for SecretsManager by @maks3201 in #6145
feat(github): add orgSecretVisibility field to GithubProvider by @iamnoah in #6202
feat(onepasswordSDK): multi-field and complete PushSecret by @Dariusch in #6187
feat(vault): add VaultRole attribute for TLS auth by @RicoGunawan12 in #6160
chore: bump go version to 1.26.2 by @Skarlso in #6203

Dependencies

chore(deps): bump actions/cache from 5.0.3 to 5.0.4 by @dependabot[bot] in #6121
chore(deps): bump mkdocs-material from 9.7.5 to 9.7.6 in /hack/api-docs by @dependabot[bot] in #6125
chore(deps): bump ubi9/ubi from 6ed9f6f to 1fc04e8 by @dependabot[bot] in #6119
chore(deps): bump azure/login from 2.3.0 to 3.0.0 by @dependabot[bot] in #6120
chore(deps): bump codecov/codecov-action from 5.5.2 to 5.5.3 by @dependabot[bot] in #6124
chore(deps): bump github/codeql-action from 4.32.6 to 4.34.1 by @dependabot[bot] in #6122
chore(deps): bump anchore/sbom-action from 0.23.1 to 0.24.0 by @dependabot[bot] in #6123
chore(deps): bump importlib-metadata from 8.7.1 to 9.0.0 in /hack/api-docs by @dependabot[bot] in #6126
chore(deps): bump sigstore/cosign-installer from 4.1.0 to 4.1.1 by @dependabot[bot] in #6154
chore(deps): bump pymdown-extensions from 10.21 to 10.21.2 in /hack/api-docs by @dependabot[bot] in #6157
chore(deps): bump actions/setup-go from 6.3.0 to 6.4.0 by @dependabot[bot] in #6151
chore(deps): bump github/codeql-action from 4.34.1 to 4.35.1 by @dependabot[bot] in #6152
chore(deps): bump dependabot/fetch-metadata from 2.5.0 to 3.0.0 by @dependabot[bot] in #6153
chore(deps): bump pygments from 2.19.2 to 2.20.0 in /hack/api-docs by @dependabot[bot] in #6155
chore(deps): bump regex from 2026.2.28 to 2026.3.32 in /hack/api-docs by @dependabot[bot] in #6156
chore(deps): bump requests from 2.32.5 to 2.33.0 in /hack/api-docs by @dependabot[bot] in #6158
chore(deps): bump ubi9/ubi from 1fc04e8 to 9e6e193 by @dependabot[bot] in #6150
chore(deps): bump step-security/harden-runner from 2.16.0 to 2.16.1 by @dependabot[bot] in #6180
chore(deps): bump charset-normalizer from 3.4.6 to 3.4.7 in /hack/api-docs by @dependabot[bot] in #6183
chore(deps): bump click from 8.3.1 to 8.3.2 in /hack/api-docs by @dependabot[bot] in #6185
chore(deps): bump fossas/fossa-action from 1.8.0 to 1.9.0 by @dependabot[bot] in #6181
chore(deps): bump docker/login-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6182
chore(deps): bump regex from 2026.3.32 to 2026.4.4 in /hack/api-docs by @dependabot[bot] in #6184

New Contributors

@MindTooth made their first contribution in #6136
@ldesauw made their first contribution in #6101
@pr0ton11 made their first contribution in #6031
@zoomoid made their first contribution in #5707
@dangbert made their first contribution in #6168
@LeahArmstrong made their first contribution in #6167
@scraly made their first contribution in #6172
@ManvithaP-hub made their first contribution in #6171
@Atomsoldat made their first contribution in #6177
@mohamed-rekiba made their first contribution in #5850
@sfotony made their first contribution in #5397
@maks3201 made their first contribution in #6145
@iamnoah made their first contribution in #6202
@RicoGunawan12 made their first contribution in #6160

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.2.0...v2.3.0

`v2.2.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.2.0
Image: ghcr.io/external-secrets/external-secrets:v2.2.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.2.0-ubi-boringssl

Breaking change

If you are using Flux + OCIRepository to fetch External Secrets Operator charts, please update your object to use a Layer selector:

  apiVersion: source.toolkit.fluxcd.io/v1
  kind: OCIRepository
  metadata:
    name: eso-oci
  spec:
    interval: 1m0s
    provider: generic
    ref:
      tag: 2.2.0
    url: oci://ghcr.io/external-secrets/charts/external-secrets
    layerSelector:
      mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip"
      operation: extract

What's Changed

General

chore: release charts v2.1.0 by @Skarlso in #6030
chore: fix the stability doc by @Skarlso in #6035
fix(security): Fix vulnerabilities by @othomann in #6052
fix(aws): sync tags and resource policy even when secret value unchanged by @evs-secops in #6025
fix: publish now uses docker build v4 which required some changes by @Skarlso in #6062
feat(gcpsm): auto-detect projectID from GCP metadata server by @patjlm in #5922
chore(templating): Remove years in license and their checks by @evrardj-roche in #5955
docs: Add Roche to official ADOPTERS by @evrardj-roche in #6076
feat: Add Last Sync column to ExternalSecret and PushSecret printers by @jaruwat-panturat in #6068
fix(onepassword): support native item IDs by @chadxz in #6073
feat: extract LGTM processor to external JS file with tests by @mateenali66 in #6074
feat: fail fast if LGTM label does not exist in repository by @mateenali66 in #6078
feat(passbolt): add support for Passbolt V5 API by @cedricherzog-passbolt in #5919
fix(infisical): dataFrom.find.path should filter by secret path not name by @johnvox in #6086
fix: disable the priority queue which misbehaves at scale by @Skarlso in #6083
chore: update go version to 1.26.1 by @Skarlso in #6072
docs(aws): fix PushSecret metadata indentation in resource policy exa... by @Br1an67 in #6056
fix(aws): prevent EC2 IMDS fallback when explicit credentials are pro... by @Br1an67 in #6036
feat(templating): Add certSANs function to extract SANs from certificates by @mzdeb in #6058
docs: document template.metadata labels/annotations behavior by @lucpas in #6102
fix: CODEOWNERS are seriously out of date by @Skarlso in #6106
feat(helm): add readinessProbe support for external-secrets deployment by @AlexOQ in #5831
fix: update grpc for CVE-2026-33186 by @Skarlso in #6108
feat(azurekv): add expiration time to azure kv secret by @muraliavarma in #5935
feat: add path to cloud.ru provider by @heavyandrew in #5952
fix(add-eso-version): fix separator line pattern in add_eso_version.sh script by @riccardomc in #6113

Dependencies

chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 by @dependabot[bot] in #6038
chore(deps): bump charset-normalizer from 3.4.4 to 3.4.5 in /hack/api-docs by @dependabot[bot] in #6047
chore(deps): bump platformdirs from 4.9.2 to 4.9.4 in /hack/api-docs by @dependabot[bot] in #6050
chore(deps): bump mkdocs-material from 9.7.3 to 9.7.4 in /hack/api-docs by @dependabot[bot] in #6049
chore(deps): bump github/codeql-action from 4.32.4 to 4.32.6 by @dependabot[bot] in #6039
chore(deps): bump step-security/harden-runner from 2.15.0 to 2.15.1 by @dependabot[bot] in #6043
chore(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0 by @dependabot[bot] in #6040
chore(deps): bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 by @dependabot[bot] in #6044
chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 by @dependabot[bot] in #6042
chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by @dependabot[bot] in #6041
chore(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by @dependabot[bot] in #6046
chore(deps): bump aquasecurity/trivy-action from 0.34.1 to 0.35.0 by @dependabot[bot] in #6048
chore(deps): bump anchore/sbom-action from 0.23.0 to 0.23.1 by @dependabot[bot] in #6093
chore(deps): bump distroless/static from 28efbe9 to 47b2d72 by @dependabot[bot] in #6088
chore(deps): bump ubi9/ubi from cecb1cd to 6ed9f6f by @dependabot[bot] in #6087
chore(deps): bump mkdocs-material from 9.7.4 to 9.7.5 in /hack/api-docs by @dependabot[bot] in #6096
chore(deps): bump tornado from 6.5.4 to 6.5.5 in /hack/api-docs by @dependabot[bot] in #6094
chore(deps): bump charset-normalizer from 3.4.5 to 3.4.6 in /hack/api-docs by @dependabot[bot] in #6095
chore(deps): bump step-security/harden-runner from 2.15.1 to 2.16.0 by @dependabot[bot] in #6089
chore(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 by @dependabot[bot] in #6092
chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by @dependabot[bot] in #6090
chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 by @dependabot[bot] in #6091

New Contributors

@othomann made their first contribution in #6052
@evs-secops made their first contribution in #6025
@patjlm made their first contribution in #5922
@jaruwat-panturat made their first contribution in #6068
@chadxz made their first contribution in #6073
@mateenali66 made their first contribution in #6074
@cedricherzog-passbolt made their first contribution in #5919
@johnvox made their first contribution in #6086
@Br1an67 made their first contribution in #6056
@mzdeb made their first contribution in #6058
@lucpas made their first contribution in #6102
@AlexOQ made their first contribution in #5831
@muraliavarma made their first contribution in #5935
@heavyandrew made their first contribution in #5952

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.1.0...v2.2.0

`v2.1.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.1.0
Image: ghcr.io/external-secrets/external-secrets:v2.1.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.1.0-ubi-boringssl

What's Changed

General

chore(release): Update helm chart by @evrardj-roche in #5981
fix: cosign verify does not use signing config by @gusfcarvalho in #5982
docs: Update release process by @evrardj-roche in #5980
fix: allow cross-namespace push with ClusterSecretStore objects by @Skarlso in #5998
feat(charts): add new flag enable leader for cert-manager by @nutmos in #5863
feat(kubernetes): fall back to system CA roots when no CA is configured by @rajsinghtech in #5961
feat: dedup sbom but keep it monolithic by @moolen in #6004
fix: add missing metrics and fundamentally fix the caching logic by @Skarlso in #5894
docs: designate Oracle Vault provider as 'stable' by @anders-swanson in #6020
docs: Oracle Vault provider capabilities by @anders-swanson in #6023
docs(azurekv): cert-manager pushsecret example and cleanups by @illrill in #5972
feat(kubernetes): implement SecretExists by @Saku2 in #5973
fix(charts): Fix wrongly set annotations for cert-controller metrics service by @josemaia in #6029
feat(providers): Nebius MysteryBox integration by @greenmapc in #5868

Dependencies

chore(deps): bump aquasecurity/trivy-action from 0.34.0 to 0.34.1 by @dependabot[bot] in #5986
chore(deps): bump mkdocs-material from 9.7.1 to 9.7.2 in /hack/api-docs by @dependabot[bot] in #5992
chore(deps): bump ubi9/ubi from b8923f5 to cecb1cd by @dependabot[bot] in #5984
chore(deps): bump helm/kind-action from 1.13.0 to 1.14.0 by @dependabot[bot] in #5985
chore(deps): bump actions/dependency-review-action from 4.8.2 to 4.8.3 by @dependabot[bot] in #5990
chore(deps): bump github/codeql-action from 4.32.3 to 4.32.4 by @dependabot[bot] in #5989
chore(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 by @dependabot[bot] in #5987
chore(deps): bump regex from 2026.1.15 to 2026.2.19 in /hack/api-docs by @dependabot[bot] in #5991
chore(deps): bump actions/stale from 10.1.1 to 10.2.0 by @dependabot[bot] in #5988
chore(deps): bump regex from 2026.2.19 to 2026.2.28 in /hack/api-docs by @dependabot[bot] in #6012
chore(deps): bump mkdocs-material from 9.7.2 to 9.7.3 in /hack/api-docs by @dependabot[bot] in #6014
chore(deps): bump step-security/harden-runner from 2.14.2 to 2.15.0 by @dependabot[bot] in #6015
chore(deps): bump anchore/sbom-action from 0.22.2 to 0.23.0 by @dependabot[bot] in #6016
chore(deps): bump certifi from 2026.1.4 to 2026.2.25 in /hack/api-docs by @dependabot[bot] in #6013
chore(deps): bump actions/setup-go from 6.2.0 to 6.3.0 by @dependabot[bot] in #6010
chore(deps): bump hashicorp/setup-terraform from ce70bcf to 5e8dbf3 by @dependabot[bot] in #6011
chore(deps): bump actions/attest-build-provenance from 3.2.0 to 4.1.0 by @dependabot[bot] in #6009
chore(deps): bump distroless/static from 972618c to 28efbe9 by @dependabot[bot] in #6008

New Contributors

@nutmos made their first contribution in #5863
@rajsinghtech made their first contribution in #5961
@illrill made their first contribution in #5972
@Saku2 made their first contribution in #5973
@greenmapc made their first contribution in #5868

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.0.1...v2.1.0

`v2.0.1`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.0.1
Image: ghcr.io/external-secrets/external-secrets:v2.0.1-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.0.1-ubi-boringssl

BREAKING CHANGE

The sprig update is actually a breaking change. It turns out that some of the functions in templating changed with this update.

Looks like it's just the htpasswd function that was renamed.

What's Changed

General

chore: release helm chart for v2.0.0 by @Skarlso in #5932
docs: update the stability doc with the new version by @Skarlso in #5933
chore(doc): add loblaw to adopter md by @FZhg in #5937
chore: bump golang to 1.25.7 because of cve by @Skarlso in #5938
fix: deleting the whole secret when it is empty by @Skarlso in #5927
chore: update controller runtime by @Skarlso in #5930
fix: update cosign and syft for signing by @Skarlso in #5958
fix: the informer can not register use GetInformer instead by @Skarlso in #5931
fix: attempt to fix cosign compatibility issues by @gusfcarvalho in #5959
chore: remove outdated info from stability doc by @Skarlso in #5971
chore(deps): update Masterminds/sprig to 8cb06fe… by @tete17 in #5747
docs(release): Update support matrix by @evrardjp in #5978

Dependencies

chore(deps): bump golang from 20c8a94 to f6751d8 by @dependabot[bot] in #5940
chore(deps): bump ubi9/ubi from c8df11b to b8923f5 by @dependabot[bot] in #5939
chore(deps): bump distroless/static from cd64bec to 972618c by @dependabot[bot] in #5941
chore(deps): bump github/codeql-action from 4.32.0 to 4.32.2 by @dependabot[bot] in #5942
chore(deps): bump anchore/sbom-action from 0.22.1 to 0.22.2 by @dependabot[bot] in #5943
chore(deps): bump step-security/harden-runner from 2.14.1 to 2.14.2 by @dependabot[bot] in #5944
chore(deps): bump zizmorcore/zizmor-action from 0.4.1 to 0.5.0 by @dependabot[bot] in #5945
chore(deps): bump fossas/fossa-action from 1.7.0 to 1.8.0 by @dependabot[bot] in #5946
chore(deps): bump aws-actions/configure-aws-credentials from 5.1.1 to 6.0.0 by @dependabot[bot] in #5947
chore(deps): bump github/codeql-action from 4.32.2 to 4.32.3 by @dependabot[bot] in #5965
chore(deps): bump markdown from 3.10.1 to 3.10.2 in /hack/api-docs by @dependabot[bot] in #5968
chore(deps): bump aquasecurity/trivy-action from 0.33.1 to 0.34.0 by @dependabot[bot] in #5964
chore(deps): bump platformdirs from 4.5.1 to 4.9.2 in /hack/api-docs by @dependabot[bot] in #5967
chore(deps): bump pymdown-extensions from 10.20.1 to 10.21 in /hack/api-docs by @dependabot[bot] in #5969

New Contributors

@FZhg made their first contribution in #5937

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.0.0...v2.0.1

BREAKING CHANGE

Please note that this release removed two of the unsupported and unmaintained providers Alibaba and Device42.

Image: ghcr.io/external-secrets/external-secrets:v2.0.0
Image: ghcr.io/external-secrets/external-secrets:v2.0.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.0.0-ubi-boringssl

What's Changed

General

chore: bump charts to 1.3.2 by @gusfcarvalho in #5923
feat(charts): add hostAliases support by @janlauber in #5866
chore: remove unmaintained secret stores by @Skarlso in #5918
docs(infisical): document al provider auth methods by @varonix0 in #5929
chore: Get validating webhook failurePolicy for Secretstore dynamically by @LochanRn in #5605

New Contributors

@LochanRn made their first contribution in #5605

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v1.3.2...v2.0.0

`v1.3.2`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.3.2
Image: ghcr.io/external-secrets/external-secrets:v1.3.2-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.3.2-ubi-boringssl

What's Changed

General

chore: release helm chart for v1.3.1 by @Skarlso in #5860
chore(chart): Add missing tests for readinessProbe by @jcpunk in #5769
docs: Update FluxCD example by @umizoom in #5862
fix(ci): Removed the unused check for Windows in Makefile by @HauptJ in #5870
docs(release): Add actual dates for EOL of 1.x releases in stability and support page by @n4zukker in #5889
docs: Passbolt provider maintenance ownership by @stripthis in #5886
chore: Update Passbolt MaintenanceStatus to MaintenanceStatusMaintained by @stripthis in #5887
fix(security): sanitize json.Unmarshal errors to prevent secret data … by @moolen in #5884
fix: webhook initialization order by @gusfcarvalho in #5901
chore: Cleanup flags by @evrardj-roche in #5845
fix: onepasswordsdk shared tenant by altering the provider in the client cache by @Skarlso in #5921

Dependencies

chore(deps): bump github/codeql-action from 4.31.10 to 4.31.11 by @dependabot[bot] in #5873
chore(deps): bump pymdown-extensions from 10.20 to 10.20.1 in /hack/api-docs by @dependabot[bot] in #5877
chore(deps): bump markdown from 3.10 to 3.10.1 in /hack/api-docs by @dependabot[bot] in #5880
chore(deps): bump ubi9/ubi from 22e9573 to 1f84f5c by @dependabot[bot] in #5871
chore(deps): bump actions/setup-python from 6.1.0 to 6.2.0 by @dependabot[bot] in #5872
chore(deps): bump hashicorp/setup-terraform from 93d5a27 to dcc3150 by @dependabot[bot] in #5875
chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in #5876
chore(deps): bump step-security/harden-runner from 2.14.0 to 2.14.1 by @dependabot[bot] in #5878
chore(deps): bump anchore/sbom-action from 0.21.1 to 0.22.0 by @dependabot[bot] in #5874
chore(deps): bump packaging from 25.0 to 26.0 in /hack/api-docs by @dependabot[bot] in #5879
chore(deps): bump golang from d9b2e14 to 98e6cff by @dependabot[bot] in #5907
chore(deps): bump alpine from 865b95f to 2510918 in /hack/api-docs by @dependabot[bot] in #5914
chore(deps): bump docker/login-action from 3.6.0 to 3.7.0 by @dependabot[bot] in #5909
chore(deps): bump actions/cache from 5.0.2 to 5.0.3 by @dependabot[bot] in #5912
chore(deps): bump actions/attest-build-provenance from 3.1.0 to 3.2.0 by @dependabot[bot] in #5910
chore(deps): bump hashicorp/setup-terraform from dcc3150 to ce70bcf by @dependabot[bot] in #5911
chore(deps): bump ubi9/ubi from 1f84f5c to c8df11b by @dependabot[bot] in #5908
chore(deps): bump alpine from 3.23.2 to 3.23.3 in /e2e by @dependabot[bot] in #5915
chore(deps): bump alpine from 865b95f to 2510918 by @dependabot[bot] in #5906
chore(deps): bump pathspec from 1.0.3 to 1.0.4 in /hack/api-docs by @dependabot[bot] in #5916
chore(deps): bump babel from 2.17.0 to 2.18.0 in /hack/api-docs by @dependabot[bot] in #5917
chore(deps): bump github/codeql-action from 4.31.11 to 4.32.0 by @dependabot[bot] in #5913

New Contributors

@umizoom made their first contribution in #5862
@HauptJ made their first contribution in #5870
@n4zukker made their first contribution in #5889
@stripthis made their first contribution in #5886

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v1.3.1...v1.3.2

`v1.3.1`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.3.1
Image: ghcr.io/external-secrets/external-secrets:v1.3.1-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.3.1-ubi-boringssl

For a Full release please referre to https://github.com/external-secrets/external-secrets/releases/tag/v1.3.0. This is a fix build for the docker publish flow.

What's Changed

General

fix: ignore the in-toto manifest when promoting the docker build by @Skarlso in #5859

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v1.3.0...v1.3.1

`v1.2.1`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.2.1
Image: ghcr.io/external-secrets/external-secrets:v1.2.1-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.2.1-ubi-boringssl

What's Changed

General

chore(chart): release helm chart 1.2.0 by @jakobmoellerdev in #5751
fix: metrics not being correctly updated and deleted by @Skarlso in #5714
feat(infisical): add caBundle and caProvider support by @wi-adam in #5770
docs(apis): fix inaccurate SecretStore comments (v1 + v1beta1) by @fallmo in #5773
fix: add missing link to the docs by @Skarlso in #5783
fix: for target template parsing for complex matchers by @Skarlso in #5735
fix: a lot of sonar issue fixes by @Skarlso in #5771

Dependencies

chore(deps): bump golang from 2611181 to ac09a5f by @dependabot[bot] in #5758
chore(deps): bump alpine from 3.23.0 to 3.23.2 in /e2e by @dependabot[bot] in #5764
chore(deps): bump importlib-metadata from 8.7.0 to 8.7.1 in /hack/api-docs by @dependabot[bot] in #5768
chore(deps): bump tornado from 6.5.3 to 6.5.4 in /hack/api-docs by @dependabot[bot] in #5767
chore(deps): bump mkdocs-material from 9.7.0 to 9.7.1 in /hack/api-docs by @dependabot[bot] in #5766
chore(deps): bump alpine from 51183f2 to 865b95f in /hack/api-docs by @dependabot[bot] in #5765
chore(deps): bump alpine from 51183f2 to 865b95f by @dependabot[bot] in #5756
chore(deps): bump ubi9/ubi from d4feb57 to 3816d30 by @dependabot[bot] in #5757
chore(deps): bump peter-evans/slash-command-dispatch from 5.0.1 to 5.0.2 by @dependabot[bot] in #5763
chore(deps): bump github/codeql-action from 4.31.8 to 4.31.9 by @dependabot[bot] in #5762
chore(deps): bump actions/attest-build-provenance from 3.0.0 to 3.1.0 by @dependabot[bot] in #5761
chore(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 by @dependabot[bot] in #5760
chore(deps): bump hashicorp/setup-terraform from 071811a to 92e4d08 by @dependabot[bot] in #5759
chore(deps): bump anchore/sbom-action from 0.20.11 to 0.21.0 by @dependabot[bot] in #5784

New Contributors

@wi-adam made their first contribution in #5770
@fallmo made their first contribution in #5773

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v1.2.0...v1.2.1

`v1.2.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.2.0
Image: ghcr.io/external-secrets/external-secrets:v1.2.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.2.0-ubi-boringssl

What's Changed

General

chore: bump 1.1.1 by @gusfcarvalho in #5687
chore: fix the argocd e2e test case by @Skarlso in #5688
feat(provider): add Barbican provider support by @rkferreira in #5398
docs(secretserver): promote secretserver provider to beta by @DelineaSahilWankhede in #5668
feat(controller): add flag to enable/disable secretstore reconcile by @Ilhan-Personal in #5653
fix(aws-secrets-manager): Apply filtering based on both name and tags if provided by @iypetrov in #5685
fix(gcpsm): SecretExists should check for regional secrets when store location is specified by @tokiwong in #5708
feat: introduce store deprecation by @gusfcarvalho in #5711
feat(charts): add global values for common deployment configurations by @Gabryel8818 in #5652
feat: add Doppler OIDC-based authentication by @mikesellitto in #5475
fix: make custom configuration available regardless of environment by @Skarlso in #5713
chore(chart): update bitwarden dependency to v0.5.2 by @Skarlso in #5719
docs(templating): update rbac for generic targets by @lostick in #5736
fix(testing): Breaking changes should not break ci by @evrardjp in #5739
fix(security): Get rid of getSecretKey by @evrardjp in #5738
fix(aws): parse resource policies into canonical JSON (sorted) before comparing by @cmoscofian in #5622
docs: Fix example in GCP documentation by @headcr4sh in #5745
chore(secretserver): update dependencies to accept new DelineaXPM/tss-sdk-go by @DelineaSahilWankhede in #5742
fix(gcpsm): Improve SecretExists method in GCP secret manager provider by @tosih in #5610
chore(docs): add clarification to helm values being disabled by @Skarlso in #5746
fix(release): apply 64dc681 to release by @jakobmoellerdev in #5749
docs(release): 1.2 stability-support.md by @jakobmoellerdev in #5750

Dependencies

chore(deps): bump golang from 1.25.4 to 1.25.5 by @dependabot[bot] in #5693
chore(deps): bump golang from 1.25.4-bookworm to 1.25.5-bookworm in /e2e by @dependabot[bot] in #5702
chore(deps): bump ubi9/ubi from dcd8128 to 75937d9 by @dependabot[bot] in #5655
chore(deps): bump peter-evans/slash-command-dispatch from 5.0.0 to 5.0.1 by @dependabot[bot] in #5695
chore(deps): bump github/codeql-action from 4.31.5 to 4.31.7 by @dependabot[bot] in #5696
chore(deps): bump actions/stale from 10.1.0 to 10.1.1 by @dependabot[bot] in #5697
chore(deps): bump actions/create-github-app-token from 2.2.0 to 2.2.1 by @dependabot[bot] in #5700
chore(deps): bump step-security/harden-runner from 2.13.2 to 2.13.3 by @dependabot[bot] in #5698
chore(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in #5699
chore(deps): bump platformdirs from 4.5.0 to 4.5.1 in /hack/api-docs by @dependabot[bot] in #5705
chore(deps): bump distroless/static from 87bce11 to 4b2a093 by @dependabot[bot] in #5692
chore(deps): bump alpine from 3.22 to 3.23 in /hack/api-docs by @dependabot[bot] in #5703
chore(deps): bump urllib3 from 2.5.0 to 2.6.0 in /hack/api-docs by @dependabot[bot] in #5704
chore(deps): bump pymdown-extensions from 10.17.2 to 10.18 in /hack/api-docs by @dependabot[bot] in #5706
chore(deps): bump alpine from 3.22.2 to 3.23.0 in /e2e by @dependabot[bot] in #5701
chore(deps): bump golang from 2611181 to 2611181 by @dependabot[bot] in #5721
chore(deps): bump codecov/codecov-action from 5.5.1 to 5.5.2 by @dependabot[bot] in #5725
chore(deps): bump urllib3 from 2.6.0 to 2.6.2 in /hack/api-docs by @dependabot[bot] in #5730
chore(deps): bump github/codeql-action from 4.31.7 to 4.31.8 by @dependabot[bot] in #5726
chore(deps): bump anchore/sbom-action from 0.20.10 to 0.20.11 by @dependabot[bot] in #5724
chore(deps): bump tornado from 6.5.2 to 6.5.3 in /hack/api-docs by @dependabot[bot] in #5732
chore(deps): bump ubi9/ubi from 75937d9 to d4feb57 by @dependabot[bot] in #5722
chore(deps): bump golang from 5117d68 to 09f53de in /e2e by @dependabot[bot] in #5729
chore(deps): bump alpine from 4b7ce07 to 51183f2 by @dependabot[bot] in #5694
chore(deps): bump hashicorp/setup-terraform from 712b439 to 071811a by @dependabot[bot] in #5727
chore(deps): bump pymdown-extensions from 10.18 to 10.19.1 in /hack/api-docs by @dependabot[bot] in #5731
chore(deps): bump step-security/harden-runner from 2.13.3 to 2.14.0 by @dependabot[bot] in #5728
chore(deps): bump actions/cache from 4.3.0 to 5.0.1 by @dependabot[bot] in #5723

New Contributors

@iypetrov made their first contribution in #5685
@tokiwong made their first contribution in #5708
@Gabryel8818 made their first contribution in #5652
@mikesellitto made their first contribution in #5475
@lostick made their first contribution in #5736
@cmoscofian made their first contribution in #5622
@headcr4sh made their first contribution in #5745
@tosih made their first contribution in #5610

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v1.1.1...v1.2.0

`v1.1.1`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.1.1
Image: ghcr.io/external-secrets/external-secrets:v1.1.1-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.1.1-ubi-boringssl

What's Changed

General

chore(chart): release helm chart 1.1.0 by @Skarlso in #5619
docs: improve spec.md by exporting generator types by @gusfcarvalho in #5624
chore(deps): remove sprig fork by @Skarlso in #5626
fix: report 404 secrets correctly in Gitlab provider by @alekc in #5104
docs(secretserver): update documentation to include Platform compatibility by @DelineaSahilWankhede in #5546
docs: add llm policy by @Skarlso in #5649
fix: pass in the token to the build and publish container by @Skarlso in #5651
test(secretserver): improve test coverage for SecretServer provider by @DelineaSahilWankhede in #5641
fix: docs pipeline by @rkferreira in #5663
fix: modify the url of the remote to include the token by @Skarlso in #5664
feat(helm): add dynamic labelSelector if not define in topologySpread… by @fe80 in #5065
feat: Support retry settings for Doppler provider by @maduonline in #5608
feat(beyondtrust): enable pushing secrets in BeyondTrust provider by @btfhernandez in #5586
fix: correctly merge map fields during templating by @Skarlso in #5671
fix: use patch instead of update for finalizers addition and removal by @Skarlso in #5670
feat(oracle): implement SecretExists by @anders-swanson in #5672
fix(security): create provider for webhook & fake by @ShimonDarshan in #5628
fix: set client transport to use GitHub Enterprise URL by @fred-gagnon in #5662
feat(generator): Password generator can generate and expose multiple passwords by @Trojanekkk in #5669
fix: run check diff on main by @Skarlso in #5681
feat: bitwardenServerSDKURL is required for bitwardensecretsmanager by @budimanjojo in #5679
fix: update the refreshInterval formatting everywhere by @Skarlso in #5680
clean: Update conjur-api-go; Disable credential storage by @szh in #5648
fix: add live-reload to make docs.serve by @gusfcarvalho in #5676
fix: remove cached artifacts after build by @gusfcarvalho in #5686
fix(keepersecurity): properly handle fields key by @pepordev in #5674

Dependencies

chore(deps): bump golang from d3f0cf7 to d3f0cf7 by @dependabot[bot] in #5630
chore(deps): bump golang from 7419f54 to e174196 in /e2e by @dependabot[bot] in #5638
chore(deps): bump zizmorcore/zizmor-action from 0.2.0 to 0.3.0 by @dependabot[bot] in #5637
chore(deps): bump actions/setup-go from 6.0.0 to 6.1.0 by @dependabot[bot] in #5636
chore(deps): bump anchore/sbom-action from 0.20.9 to 0.20.10 by @dependabot[bot] in #5635
chore(deps): bump actions/create-github-app-token from 2.1.4 to 2.2.0 by @dependabot[bot] in #5634
chore(deps): bump github/codeql-action from 4.31.3 to 4.31.4 by @dependabot[bot] in #5633
chore(deps): bump aws-actions/configure-aws-credentials from f2964c7 to 4a54c24 by @dependabot[bot] in #5632
chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 by @dependabot[bot] in #5631
chore(deps): bump pymdown-extensions from 10.17.1 to 10.17.2 in /hack/api-docs by @dependabot[bot] in #5660
chore(deps): bump softprops/action-gh-release from 2.4.2 to 2.5.0 by @dependabot[bot] in #5656
chore(deps): bump actions/setup-python from 6.0.0 to 6.1.0 by @dependabot[bot] in #5657
chore(deps): bump peter-evans/slash-command-dispatch from 4.0.0 to 5.0.0 by @dependabot[bot] in #5658
chore(deps): bump hashicorp/setup-terraform from 4c5fdab to 712b439 by @dependabot[bot] in #5659

New Contributors

@fe80 made their first contribution in #5065
@maduonline made their first contribution in #5608
@fred-gagnon made their first contribution in #5662
@Trojanekkk made their first contribution in #5669
@budimanjojo made their first contribution in #5679

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v1.1.0...v1.1.1

`v1.1.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.1.0
Image: ghcr.io/external-secrets/external-secrets:v1.1.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.1.0-ubi-boringssl

What's Changed

!NOTE!: During last community meeting we discussed that we are retiring our scarf account. With that, we will be changing back to ghcr.io/external-secrets/external-secrets instead of oci.external-secrets.io/external-secrets/external-secrets.

For now, the old domain will live for a couple months to give people to change back. With this release , the values in the helm chart that define where the image is switched back to ghcr.

The helm-chart itself is served from under github-pages so that does not move.

General

chore(chart): release helm chart 1.0.0 by @Skarlso in #5552
feat(security): add support for ECDSA ssh keys by @bigjazzsound in #5559
fix: minor typo in comment of KeeperSecurity example by @mdjong1 in #5573
docs(gcp): update documentation for using WorkloadIdentityFederation in non-GKE cluster by @jennweir in #5556
chore(release): add darwin_arm64 releases by @lbordowitz in #5583
feat: support override IAM endpoint in IBM provider for APIkey auth by @fidel-ruiz in #5550
feat(security): build tags for all the providers to disable them on d… by @ShimonDarshan in #5578
fix: do not include the last element of the path in the iteration by @Skarlso in #5588
fix(k8s): support deleting whole secret by @tiagolobocastro in #5538
fix(provider): configure TLS for secret server provider by @Lumexralph in #5558
chore(aws): remove any usage of aws-sdk-v1 by @Skarlso in #5590
fix(gcp): check for secret version exists in PushSecret by @bpalko in #5593
feat(vault): add GCP Workload Identity authentication support by @SamuelMolling in #5356
chore: fix sonar cloud issues by @Skarlso in #5405
chore(aws-sdk-v2): update dependencies to accept new aws regions by @damienpuig in #5577
feat(chart): use ghcr.io instead of our own domain by @evrardjp in #5617

Dependencies

chore(deps): bump golang from 1.25.3 to 1.25.4 by @dependabot[bot] in #5560
chore(deps): bump golang from 1.25.3-bookworm to 1.25.4-bookworm in /e2e by @dependabot[bot] in #5568
chore(deps): bump step-security/harden-runner from 2.13.1 to 2.13.2 by @dependabot[bot] in #5561
chore(deps): bump softprops/action-gh-release from 2.4.1 to 2.4.2 by @dependabot[bot] in #5564
chore(deps): bump helm/chart-testing-action from 2.7.0 to 2.8.0 by @dependabot[bot] in #5565
chore(deps): bump aws-actions/configure-aws-credentials from 0d00a56 to 2475ef7 by @dependabot[bot] in #5562
chore(deps): bump helm/kind-action from 1.12.0 to 1.13.0 by @dependabot[bot] in #5563
chore(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 by @dependabot[bot] in #5567
chore(deps): bump regex from 2025.10.23 to 2025.11.3 in /hack/api-docs by @dependabot[bot] in #5570
chore(deps): bump markdown from 3.9 to 3.10 in /hack/api-docs by @dependabot[bot] in #5569
chore(deps): bump hashicorp/setup-terraform from 982f6f0 to 4c5fdab by @dependabot[bot] in #5566
chore(deps): bump golang from d3f0cf7 to d3f0cf7 by @dependabot[bot] in #5595
chore(deps): bump github/codeql-action from 4.31.2 to 4.31.3 by @dependabot[bot] in #5596
chore(deps): bump click from 8.3.0 to 8.3.1 in /hack/api-docs by @dependabot[bot] in #5602
chore(deps): bump ubi9/ubi from dec374e to dcd8128 by @dependabot[bot] in #5594
chore(deps): bump aws-actions/configure-aws-credentials from 2475ef7 to f2964c7 by @dependabot[bot] in #5597
chore(deps): bump actions/dependency-review-action from 4.8.1 to 4.8.2 by @dependabot[bot] in #5598
chore(deps): bump pymdown-extensions from 10.16.1 to 10.17.1 in /hack/api-docs by @dependabot[bot] in #5599
chore(deps): bump certifi from 2025.10.5 to 2025.11.12 in /hack/api-docs by @dependabot[bot] in #5600
chore(deps): bump mkdocs-material from 9.6.23 to 9.7.0 in /hack/api-docs by @dependabot[bot] in #5601
chore(deps): bump mkdocs-macros-plugin from 1.4.1 to 1.5.0 in /hack/api-docs by @dependabot[bot] in #5603

New Contributors

@bigjazzsound made their first contribution in #5559
@mdjong1 made their first contribution in #5573
@jennweir made their first contribution in #5556
@lbordowitz made their first contribution in #5583
@fidel-ruiz made their first contribution in #5550
@ShimonDarshan made their first contribution in #5578
@bpalko made their first contribution in #5593
@SamuelMolling made their first contribution in #5356
@damienpuig made their first contribution in #5577

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v1.0.0...v1.1.0

`v1.0.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.0.0
Image: ghcr.io/external-secrets/external-secrets:v1.0.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.0.0-ubi-boringssl

What's Changed

General

chore: release helm chart for v0.20.4 by @Skarlso in #5502
chore(actions): fix security alerts for github actions by @Skarlso in #5504
chore(release): fix incorrect shas from security alert pinning by @jakobmoellerdev in #5512
chore: update dependencies by @eso-service-account-app[bot] in #5519
fix: upgrade go version by @Skarlso in #5529
fix(charts): normalize certificate duration default value by @aslafy-z in #5497
chore(revive-linter): add revive linter configuration by @Lumexralph in #5515
feat: go module separation by @moolen in #5498
fix: update deps script to reflect new go mod structure by @moolen in #5532
fix: lint by @gusfcarvalho in #5536
feat: dynamic target implementation for external secrets sources by @Skarlso in #5470
fix: codeql should not rebuild the world on every run by @Skarlso in #5540
fix(onepassword): Reduce API usage by @sondrelg in #5410
feat(esoctl): adds bootstrap generator commands by @gusfcarvalho in #5539
fix: adds missing externalsecret_type validation on generatorRef by @gusfcarvalho in #5547
chore(docs): fix the generic resource doc using the incorrect switch by @Skarlso in #5548
docs(adopters): add Topicus.Education to adopters list by @sboschman in #5551
fix(build): use more portable bash by @tiagolobocastro in #5537

Dependencies

chore(deps): bump alpine from 4bcff63 to 4b7ce07 in /hack/api-docs by @dependabot[bot] in #5507
chore(deps): bump golang from 1.25.2 to 1.25.3 by @dependabot[bot] in #5506
chore(deps): bump golang from aee43c3 to aee43c3 by @dependabot[bot] in #5516
chore(deps): bump golang from 1.25.2-bookworm to 1.25.3-bookworm in /e2e by @dependabot[bot] in #5505
chore(deps): bump anchore/sbom-action from 0.20.8 to 0.20.9 by @dependabot[bot] in #5508
chore(deps): bump hashicorp/setup-terraform from c529327 to 982f6f0 by @dependabot[bot] in #5510
chore(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @dependabot[bot] in #5513
chore(deps): bump github/codeql-action from 4.30.9 to 4.31.0 by @dependabot[bot] in #5514
chore(deps): bump actions/cache from 4.2.4 to 4.3.0 by @dependabot[bot] in #5511
chore(deps): bump regex from 2025.9.18 to 2025.10.23 in /hack/api-docs by @dependabot[bot] in #5509
chore(deps): bump mkdocs-macros-plugin from 1.4.0 to 1.4.1 in /hack/api-docs by @dependabot[bot] in #5518
chore(deps): bump termcolor from 3.1.0 to 3.2.0 in /hack/api-docs by @dependabot[bot] in #5517
chore(deps): bump github/codeql-action from 4.31.0 to 4.31.2 by @dependabot[bot] in #5531
chore(deps): bump mkdocs-material from 9.6.22 to 9.6.23 in /hack/api-docs by @dependabot[bot] in #5533

New Contributors

@sondrelg made their first contribution in #5410
@tiagolobocastro made their first contribution in #5537

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v0.20.4...v1.0.0

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 09:00 AM and 10:59 PM (* 9-22 * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | major | `0.20.4` → `2.10.0` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the warning logs for more information. --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v2.10.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.10.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.9.0...v2.10.0) Image: `ghcr.io/external-secrets/external-secrets:v2.10.0` Image: `ghcr.io/external-secrets/external-secrets:v2.10.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.10.0-ubi-boringssl`  #### What's Changed ##### General - chore: release helm chart for 2.9.0 by [@Skarlso](https://github.com/Skarlso) in [#6808](https://github.com/external-secrets/external-secrets/pull/6808) - docs: correct the design type in the PR template by [@sanchpet](https://github.com/sanchpet) in [#6813](https://github.com/external-secrets/external-secrets/pull/6813) - fix(aws): redact credentials in aws auth config logs by [@hixichen](https://github.com/hixichen) in [#6683](https://github.com/external-secrets/external-secrets/pull/6683) - fix(gcp): preserve workload identity token expiry by [@jakobtfr](https://github.com/jakobtfr) in [#6772](https://github.com/external-secrets/external-secrets/pull/6772) - feat(conjur): Conjur PushSecret by [@aidy](https://github.com/aidy) in [#6272](https://github.com/external-secrets/external-secrets/pull/6272) - fix(infisical): scope dataFrom.find.path in list requests by [@thc1006](https://github.com/thc1006) in [#6821](https://github.com/external-secrets/external-secrets/pull/6821) - chore: bump golangci-lint and fix new linting issues by [@evrardj-roche](https://github.com/evrardj-roche) in [#6740](https://github.com/external-secrets/external-secrets/pull/6740) - feat(openbao): add `auth.kubernetes` auth method by [@Nerkho](https://github.com/Nerkho) in [#6591](https://github.com/external-secrets/external-secrets/pull/6591) - docs: add OpenChoreo to the adopters list by [@kavishkafernando](https://github.com/kavishkafernando) in [#6820](https://github.com/external-secrets/external-secrets/pull/6820) - feat(passbolt): add support for custom fields by [@saknopper](https://github.com/saknopper) in [#6696](https://github.com/external-secrets/external-secrets/pull/6696) - chore: update go version to 1.26.6 by [@alekc](https://github.com/alekc) in [#6835](https://github.com/external-secrets/external-secrets/pull/6835) - feat(core): report safe reconcile errors in status conditions by [@alekc](https://github.com/alekc) in [#6834](https://github.com/external-secrets/external-secrets/pull/6834) - fix(secretserver): missing field siteId in secret creation by [@pr0ton11](https://github.com/pr0ton11) in [#6649](https://github.com/external-secrets/external-secrets/pull/6649) - fix: Reconcile sha and version by [@evrardj-roche](https://github.com/evrardj-roche) in [#6843](https://github.com/external-secrets/external-secrets/pull/6843) - chore(deps): bump aws acm by [@evrardj-roche](https://github.com/evrardj-roche) in [#6705](https://github.com/external-secrets/external-secrets/pull/6705) - chore(deps): update go-ntlmssp to v0.1.1 by [@evrardj-roche](https://github.com/evrardj-roche) in [#6701](https://github.com/external-secrets/external-secrets/pull/6701) - clean: Get rid of tests importing provider deps by [@evrardj-roche](https://github.com/evrardj-roche) in [#6846](https://github.com/external-secrets/external-secrets/pull/6846) - chore(deps): bump GitLab API client to v1.46.0 by [@evrardj-roche](https://github.com/evrardj-roche) in [#6700](https://github.com/external-secrets/external-secrets/pull/6700) - docs(webhook): escape Go template examples with {% raw %} by [@atobaum](https://github.com/atobaum) in [#6852](https://github.com/external-secrets/external-secrets/pull/6852) - fix(ci): put CODEOWNERS at a path GitHub actually reads by [@alekc](https://github.com/alekc) in [#6853](https://github.com/external-secrets/external-secrets/pull/6853) - feat(passbolt): PB-53915 - Surface custom field functions in SDK by [@cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) in [#6848](https://github.com/external-secrets/external-secrets/pull/6848) - design: Guarantee module import boundaries by [@evrardj-roche](https://github.com/evrardj-roche) in [#6851](https://github.com/external-secrets/external-secrets/pull/6851) - feat(providers): Nebius MysteryBox SA token federation auth option added by [@greenmapc](https://github.com/greenmapc) in [#6784](https://github.com/external-secrets/external-secrets/pull/6784) - fix: Unblock CI by [@evrardj-roche](https://github.com/evrardj-roche) in [#6874](https://github.com/external-secrets/external-secrets/pull/6874) - fix(vault): only apply deprecated token-cache flags when explicitly set by [@markof88](https://github.com/markof88) in [#6827](https://github.com/external-secrets/external-secrets/pull/6827) - feat: apply TLS security profile to the external-secrets deployment by [@siddhibhor-56](https://github.com/siddhibhor-56) in [#6617](https://github.com/external-secrets/external-secrets/pull/6617) - feat(github): support Dependabot secrets by [@SanderKnape](https://github.com/SanderKnape) in [#6878](https://github.com/external-secrets/external-secrets/pull/6878) ##### Dependencies - chore(deps): bump golang from `0178a64` to `0178a64` by [@dependabot](https://github.com/dependabot)\[bot] in [#6818](https://github.com/external-secrets/external-secrets/pull/6818) - chore(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6819](https://github.com/external-secrets/external-secrets/pull/6819) - chore(deps): bump setuptools from 83.0.0 to 84.0.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6826](https://github.com/external-secrets/external-secrets/pull/6826) - chore(deps): bump golang from `af8d674` to `3889b42` by [@dependabot](https://github.com/dependabot)\[bot] in [#6838](https://github.com/external-secrets/external-secrets/pull/6838) - chore(deps): bump step-security/harden-runner from 2.20.1 to 2.21.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6840](https://github.com/external-secrets/external-secrets/pull/6840) - chore(deps): bump the codeql group across 1 directory with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#6839](https://github.com/external-secrets/external-secrets/pull/6839) - chore(deps): bump the codeql group with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#6867](https://github.com/external-secrets/external-secrets/pull/6867) - chore(deps): bump ubi9/ubi from `2a6bd69` to `5426a8f` by [@dependabot](https://github.com/dependabot)\[bot] in [#6865](https://github.com/external-secrets/external-secrets/pull/6865) - chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6868](https://github.com/external-secrets/external-secrets/pull/6868) - chore(deps): bump golang from 1.26.6-bookworm to 1.27.0-bookworm in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#6866](https://github.com/external-secrets/external-secrets/pull/6866) - chore(deps): bump golang from `3889b42` to `4c9fe60` by [@dependabot](https://github.com/dependabot)\[bot] in [#6864](https://github.com/external-secrets/external-secrets/pull/6864) - chore(deps): bump distroless/static from `9197324` to `f2ea270` by [@dependabot](https://github.com/dependabot)\[bot] in [#6863](https://github.com/external-secrets/external-secrets/pull/6863) #### New Contributors - [@sanchpet](https://github.com/sanchpet) made their first contribution in [#6813](https://github.com/external-secrets/external-secrets/pull/6813) - [@hixichen](https://github.com/hixichen) made their first contribution in [#6683](https://github.com/external-secrets/external-secrets/pull/6683) - [@jakobtfr](https://github.com/jakobtfr) made their first contribution in [#6772](https://github.com/external-secrets/external-secrets/pull/6772) - [@aidy](https://github.com/aidy) made their first contribution in [#6272](https://github.com/external-secrets/external-secrets/pull/6272) - [@thc1006](https://github.com/thc1006) made their first contribution in [#6821](https://github.com/external-secrets/external-secrets/pull/6821) - [@Nerkho](https://github.com/Nerkho) made their first contribution in [#6591](https://github.com/external-secrets/external-secrets/pull/6591) - [@kavishkafernando](https://github.com/kavishkafernando) made their first contribution in [#6820](https://github.com/external-secrets/external-secrets/pull/6820) - [@saknopper](https://github.com/saknopper) made their first contribution in [#6696](https://github.com/external-secrets/external-secrets/pull/6696) - [@atobaum](https://github.com/atobaum) made their first contribution in [#6852](https://github.com/external-secrets/external-secrets/pull/6852) - [@markof88](https://github.com/markof88) made their first contribution in [#6827](https://github.com/external-secrets/external-secrets/pull/6827) - [@SanderKnape](https://github.com/SanderKnape) made their first contribution in [#6878](https://github.com/external-secrets/external-secrets/pull/6878) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.9.0...v2.10.0> ### [`v2.9.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.9.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.8.0...v2.9.0) Image: `ghcr.io/external-secrets/external-secrets:v2.9.0` Image: `ghcr.io/external-secrets/external-secrets:v2.9.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.9.0-ubi-boringssl`  #### What's Changed ##### General - chore: release helm chart 2.8.0 by [@Skarlso](https://github.com/Skarlso) in [#6656](https://github.com/external-secrets/external-secrets/pull/6656) - fix(conjur): add InstallTimeout to helm chart installation and pin server image version by [@alekc](https://github.com/alekc) in [#6658](https://github.com/external-secrets/external-secrets/pull/6658) - fix(deps): bump grpc-go for GHSA-hrxh-6v49-42gf by [@evrardj-roche](https://github.com/evrardj-roche) in [#6695](https://github.com/external-secrets/external-secrets/pull/6695) - feat(charts): add opt-in schedulerName and runtimeClassName to the pods by [@somaz94](https://github.com/somaz94) in [#6675](https://github.com/external-secrets/external-secrets/pull/6675) - fix(webhookconfig): use a constant Eventf format by [@evrardj-roche](https://github.com/evrardj-roche) in [#6699](https://github.com/external-secrets/external-secrets/pull/6699) - fix: bump codeqls together by [@evrardj-roche](https://github.com/evrardj-roche) in [#6707](https://github.com/external-secrets/external-secrets/pull/6707) - fix(security): install crane in a reliable way and fix code scanning issue by [@Skarlso](https://github.com/Skarlso) in [#6712](https://github.com/external-secrets/external-secrets/pull/6712) - chore: Fix cve-2026-56852 by bump golang.org/x/text\@0.40 by [@evrardj-roche](https://github.com/evrardj-roche) in [#6734](https://github.com/external-secrets/external-secrets/pull/6734) - chore(fix): template abuse for secret values by [@Skarlso](https://github.com/Skarlso) in [#6730](https://github.com/external-secrets/external-secrets/pull/6730) - chore: Bump controller runtime by [@evrardj-roche](https://github.com/evrardj-roche) in [#6703](https://github.com/external-secrets/external-secrets/pull/6703) - chore(fix): moved the validation further up the chain by [@Skarlso](https://github.com/Skarlso) in [#6735](https://github.com/external-secrets/external-secrets/pull/6735) - fix: pin all dependencies by [@evrardj-roche](https://github.com/evrardj-roche) in [#6727](https://github.com/external-secrets/external-secrets/pull/6727) - feat(e2e): implement fan-out matrix validation and credential scoping by [@alekc](https://github.com/alekc) in [#6660](https://github.com/external-secrets/external-secrets/pull/6660) - fix(akeyless): use local errors.As target to avoid data race by [@HYPERVAPOR](https://github.com/HYPERVAPOR) in [#6749](https://github.com/external-secrets/external-secrets/pull/6749) - test(crd): add e2e suite and CI leg for the CRD provider by [@alekc](https://github.com/alekc) in [#6742](https://github.com/external-secrets/external-secrets/pull/6742) - docs(webhook): add debugging guide and fix stale secret-label claim by [@alekc](https://github.com/alekc) in [#6746](https://github.com/external-secrets/external-secrets/pull/6746) - test(e2e): skip the global addon uninstall on disposable clusters by [@alekc](https://github.com/alekc) in [#6780](https://github.com/external-secrets/external-secrets/pull/6780) - feat: add environments support to 1Password SDK by [@Skarlso](https://github.com/Skarlso) in [#6318](https://github.com/external-secrets/external-secrets/pull/6318) - fix(akeyless): stop reporting API failures as a missing item by [@alekc](https://github.com/alekc) in [#6753](https://github.com/external-secrets/external-secrets/pull/6753) - fix(makefile): harden clean worktree check by [@evrardj-roche](https://github.com/evrardj-roche) in [#6702](https://github.com/external-secrets/external-secrets/pull/6702) - fix: support docs builds from worktrees by [@evrardj-roche](https://github.com/evrardj-roche) in [#6741](https://github.com/external-secrets/external-secrets/pull/6741) - feat(cache): add atomic ContainsOrAdd by [@evrardj-roche](https://github.com/evrardj-roche) in [#6706](https://github.com/external-secrets/external-secrets/pull/6706) - fix: omit empty AWS secret replica regions by [@goutamadwant](https://github.com/goutamadwant) in [#6596](https://github.com/external-secrets/external-secrets/pull/6596) - fix: Follow up PR6318 by [@evrardj-roche](https://github.com/evrardj-roche) in [#6782](https://github.com/external-secrets/external-secrets/pull/6782) - feat: Show sponsoring of Roche by [@evrardj-roche](https://github.com/evrardj-roche) in [#6790](https://github.com/external-secrets/external-secrets/pull/6790) - fix(e2e): make the oracle suite runnable by [@alekc](https://github.com/alekc) in [#6770](https://github.com/external-secrets/external-secrets/pull/6770) - chore: temporarily allow GHSA-gcjh-h69q-9w9g by [@evrardj-roche](https://github.com/evrardj-roche) in [#6795](https://github.com/external-secrets/external-secrets/pull/6795) - fix(api): stop defaulting optional ExternalSecret strategy fields by [@alekc](https://github.com/alekc) in [#6798](https://github.com/external-secrets/external-secrets/pull/6798) - chore: remove/cleanup remaining tools from tools.go. by [@evrardj-roche](https://github.com/evrardj-roche) in [#6786](https://github.com/external-secrets/external-secrets/pull/6786) - chore: Cleanup sponsors dead links by [@evrardj-roche](https://github.com/evrardj-roche) in [#6791](https://github.com/external-secrets/external-secrets/pull/6791) - fix(aws): detach replicated regions before deleting AWS SecretsManager secret by [@cmoscofian](https://github.com/cmoscofian) in [#6687](https://github.com/external-secrets/external-secrets/pull/6687) - chore: fix enable cache being removed on installCRD=false by [@Skarlso](https://github.com/Skarlso) in [#6799](https://github.com/external-secrets/external-secrets/pull/6799) ##### Dependencies - chore(deps): bump golang from `0178a64` to `0178a64` by [@dependabot](https://github.com/dependabot)\[bot] in [#6663](https://github.com/external-secrets/external-secrets/pull/6663) - chore(deps): bump mkdocs-material from 9.7.6 to 9.7.7 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6669](https://github.com/external-secrets/external-secrets/pull/6669) - chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6674](https://github.com/external-secrets/external-secrets/pull/6674) - chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6667](https://github.com/external-secrets/external-secrets/pull/6667) - chore(deps): bump fkirc/skip-duplicate-actions from 5.3.1 to 5.3.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6671](https://github.com/external-secrets/external-secrets/pull/6671) - chore(deps): bump actions/stale from 10.3.0 to 10.4.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6673](https://github.com/external-secrets/external-secrets/pull/6673) - chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6672](https://github.com/external-secrets/external-secrets/pull/6672) - chore(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 6.2.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6670](https://github.com/external-secrets/external-secrets/pull/6670) - chore(deps): bump distroless/static from `d5f030c` to `9197324` by [@dependabot](https://github.com/dependabot)\[bot] in [#6662](https://github.com/external-secrets/external-secrets/pull/6662) - chore(deps): bump ubi9/ubi from `8bf0e8f` to `2a6bd69` by [@dependabot](https://github.com/dependabot)\[bot] in [#6661](https://github.com/external-secrets/external-secrets/pull/6661) - chore(deps): bump actions/setup-go from 6.0.0 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6664](https://github.com/external-secrets/external-secrets/pull/6664) - chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6665](https://github.com/external-secrets/external-secrets/pull/6665) - chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#6666](https://github.com/external-secrets/external-secrets/pull/6666) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6715](https://github.com/external-secrets/external-secrets/pull/6715) - chore(deps): bump aws-actions/configure-aws-credentials from 6.2.2 to 6.2.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#6717](https://github.com/external-secrets/external-secrets/pull/6717) - chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#6722](https://github.com/external-secrets/external-secrets/pull/6722) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.3 in the codeql group across 1 directory by [@dependabot](https://github.com/dependabot)\[bot] in [#6713](https://github.com/external-secrets/external-secrets/pull/6713) - chore(deps): bump google-github-actions/auth from [`fc21748`](https://github.com/external-secrets/external-secrets/commit/fc2174804b84f912b1f6d334e9463f484f1c552d) to [`cd3439a`](https://github.com/external-secrets/external-secrets/commit/cd3439a4d2c29fd597fb063e209ee2c2d6128dcd) by [@dependabot](https://github.com/dependabot)\[bot] in [#6714](https://github.com/external-secrets/external-secrets/pull/6714) - chore(deps): bump actions/cache from 4.2.4 to 6.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6716](https://github.com/external-secrets/external-secrets/pull/6716) - chore(deps): bump actions/labeler from 6.1.0 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6718](https://github.com/external-secrets/external-secrets/pull/6718) - chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6719](https://github.com/external-secrets/external-secrets/pull/6719) - chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6720](https://github.com/external-secrets/external-secrets/pull/6720) - chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6723](https://github.com/external-secrets/external-secrets/pull/6723) - chore(deps): bump docker/login-action from 4.4.0 to 4.5.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6736](https://github.com/external-secrets/external-secrets/pull/6736) - chore(deps): bump actions/stale from 10.4.0 to 11.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6738](https://github.com/external-secrets/external-secrets/pull/6738) - chore(deps): bump the codeql group with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#6751](https://github.com/external-secrets/external-secrets/pull/6751) - chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6752](https://github.com/external-secrets/external-secrets/pull/6752) - chore(deps): bump the codeql group with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#6801](https://github.com/external-secrets/external-secrets/pull/6801) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6802](https://github.com/external-secrets/external-secrets/pull/6802) - chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6805](https://github.com/external-secrets/external-secrets/pull/6805) - chore(deps): bump azure/login from 3.0.0 to 3.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6804](https://github.com/external-secrets/external-secrets/pull/6804) - chore(deps): bump google-github-actions/auth from [`cd3439a`](https://github.com/external-secrets/external-secrets/commit/cd3439a4d2c29fd597fb063e209ee2c2d6128dcd) to [`1206044`](https://github.com/external-secrets/external-secrets/commit/12060449e87204eca501a11f2f7f1483024afff0) by [@dependabot](https://github.com/dependabot)\[bot] in [#6737](https://github.com/external-secrets/external-secrets/pull/6737) - chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6803](https://github.com/external-secrets/external-secrets/pull/6803) #### New Contributors - [@HYPERVAPOR](https://github.com/HYPERVAPOR) made their first contribution in [#6749](https://github.com/external-secrets/external-secrets/pull/6749) - [@goutamadwant](https://github.com/goutamadwant) made their first contribution in [#6596](https://github.com/external-secrets/external-secrets/pull/6596) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.8.0...v2.9.0> ### [`v2.8.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.8.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.7.0...v2.8.0) Image: `ghcr.io/external-secrets/external-secrets:v2.8.0` Image: `ghcr.io/external-secrets/external-secrets:v2.8.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.8.0-ubi-boringssl`  #### What's Changed ##### General - chore: release helm chart 2.7.0 by [@Skarlso](https://github.com/Skarlso) in [#6529](https://github.com/external-secrets/external-secrets/pull/6529) - docs(barbican): correct find semantics and document property/extract by [@alekc](https://github.com/alekc) in [#6531](https://github.com/external-secrets/external-secrets/pull/6531) - docs(gcp): use external-secrets.io/v1 in SecretStore examples by [@alekc](https://github.com/alekc) in [#6563](https://github.com/external-secrets/external-secrets/pull/6563) - feat(generators): add GitLab deploy token generator by [@alekc](https://github.com/alekc) in [#6493](https://github.com/external-secrets/external-secrets/pull/6493) - fix(barbican): validate store config and fix SecretExists error message by [@alekc](https://github.com/alekc) in [#6534](https://github.com/external-secrets/external-secrets/pull/6534) - docs(beyondtrust): fix capability matrix and document decrypt/separator by [@alekc](https://github.com/alekc) in [#6535](https://github.com/external-secrets/external-secrets/pull/6535) - feat: Make SecondsToLive optional for Grafana generator by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6479](https://github.com/external-secrets/external-secrets/pull/6479) - docs: add missing generators to ClusterGenerator spec snippet by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6590](https://github.com/external-secrets/external-secrets/pull/6590) - docs(doppler): fix download format list and heading levels by [@alekc](https://github.com/alekc) in [#6559](https://github.com/external-secrets/external-secrets/pull/6559) - docs(fortanix): add to support matrix and tidy provider page by [@alekc](https://github.com/alekc) in [#6562](https://github.com/external-secrets/external-secrets/pull/6562) - docs(yandex): fix Lockbox referent cell and add Certificate Manager rows by [@alekc](https://github.com/alekc) in [#6585](https://github.com/external-secrets/external-secrets/pull/6585) - docs(volcengine): mark referent authentication as supported by [@alekc](https://github.com/alekc) in [#6584](https://github.com/external-secrets/external-secrets/pull/6584) - docs(senhasegura): mark deletion + referent in matrix and fix title by [@alekc](https://github.com/alekc) in [#6583](https://github.com/external-secrets/external-secrets/pull/6583) - docs(scaleway): mark referent auth in matrix and fix headings by [@alekc](https://github.com/alekc) in [#6581](https://github.com/external-secrets/external-secrets/pull/6581) - docs(pulumi): correct find/referent matrix cells and fix headings by [@alekc](https://github.com/alekc) in [#6578](https://github.com/external-secrets/external-secrets/pull/6578) - docs(previder): correct find/referent matrix cells and fix headings by [@alekc](https://github.com/alekc) in [#6577](https://github.com/external-secrets/external-secrets/pull/6577) - docs(1password): mark SDK find support in matrix and promote titles by [@alekc](https://github.com/alekc) in [#6568](https://github.com/external-secrets/external-secrets/pull/6568) - feat(charts): Add aggregateToAdmin toggle by [@illrill](https://github.com/illrill) in [#6586](https://github.com/external-secrets/external-secrets/pull/6586) - docs(providers): consolidate 11 conflicting provider-doc PRs by [@alekc](https://github.com/alekc) in [#6592](https://github.com/external-secrets/external-secrets/pull/6592) - feat(charts): add startupProbe support to webhook deployment by [@alpcanaydin](https://github.com/alpcanaydin) in [#6612](https://github.com/external-secrets/external-secrets/pull/6612) - feat(akeyless): support azure\_ad Workload Identity via serviceAccountRef by [@baraka-akeyless](https://github.com/baraka-akeyless) in [#6530](https://github.com/external-secrets/external-secrets/pull/6530) - docs(kubernetes): fix invalid tab indentation and heading levels by [@alekc](https://github.com/alekc) in [#6565](https://github.com/external-secrets/external-secrets/pull/6565) - docs(dvls): mark DeletionPolicy supported and fix page title by [@alekc](https://github.com/alekc) in [#6557](https://github.com/external-secrets/external-secrets/pull/6557) - docs(bitwarden): fix find behaviour, find-by-name rules, and admonitions by [@alekc](https://github.com/alekc) in [#6551](https://github.com/external-secrets/external-secrets/pull/6551) - docs(github): add to support matrix, fix auth field, tidy page by [@alekc](https://github.com/alekc) in [#6564](https://github.com/external-secrets/external-secrets/pull/6564) - docs: Improve explanations of pem\_chain by [@evrardjp](https://github.com/evrardjp) in [#6623](https://github.com/external-secrets/external-secrets/pull/6623) - feat: Make our stance regarding AI usage more explicit. by [@evrardj-roche](https://github.com/evrardj-roche) in [#6621](https://github.com/external-secrets/external-secrets/pull/6621) - fix(barbican): treat find.name.regexp as a regexp, not an exact match by [@arpitjain099](https://github.com/arpitjain099) in [#6614](https://github.com/external-secrets/external-secrets/pull/6614) - chore: update go version 1.26.5 - Fix CVE-2026-39822 by [@alekc](https://github.com/alekc) in [#6631](https://github.com/external-secrets/external-secrets/pull/6631) - ref(testing): change the e2e workflow to separate building stage from e2e stage (and free up resources) by [@alekc](https://github.com/alekc) in [#6634](https://github.com/external-secrets/external-secrets/pull/6634) - chore: updating ok-to-test to allow interim maintainers by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#6638](https://github.com/external-secrets/external-secrets/pull/6638) - fix(onepassword): support PushSecret IfNotExists by [@civilizedBaboon](https://github.com/civilizedBaboon) in [#6646](https://github.com/external-secrets/external-secrets/pull/6646) - fix(testing): check out PR head in fork e2e instead of main by [@alekc](https://github.com/alekc) in [#6647](https://github.com/external-secrets/external-secrets/pull/6647) - fix(secretserver): validate store and map fields correctly by [@dbinger](https://github.com/dbinger) in [#6616](https://github.com/external-secrets/external-secrets/pull/6616) - feat(charts): Add optional networkPolicy by [@jcpunk](https://github.com/jcpunk) in [#5779](https://github.com/external-secrets/external-secrets/pull/5779) - feat(akeyless): add SecretStore ignoreCache to bypass Gateway cache by [@baraka-akeyless](https://github.com/baraka-akeyless) in [#6507](https://github.com/external-secrets/external-secrets/pull/6507) - feat(provider): implement AWS Certificate Manager provider by [@dsp0x4](https://github.com/dsp0x4) in [#6117](https://github.com/external-secrets/external-secrets/pull/6117) - feat: expose more values for custom metadata for vault v2 by [@Skarlso](https://github.com/Skarlso) in [#6652](https://github.com/external-secrets/external-secrets/pull/6652) - clean: Remove duplicate code by [@evrardj-roche](https://github.com/evrardj-roche) in [#6629](https://github.com/external-secrets/external-secrets/pull/6629) - feat: configurable leader election lease timings by [@izz-linux](https://github.com/izz-linux) in [#6644](https://github.com/external-secrets/external-secrets/pull/6644) - fix(akeyless): support dataFrom.extract.property for nested JSON by [@baraka-akeyless](https://github.com/baraka-akeyless) in [#6633](https://github.com/external-secrets/external-secrets/pull/6633) - feat(conjur): Certificate Auth support by [@hdabrowski](https://github.com/hdabrowski) in [#6393](https://github.com/external-secrets/external-secrets/pull/6393) - docs(aws): restore dropped access section and document missing fields by [@alekc](https://github.com/alekc) in [#6517](https://github.com/external-secrets/external-secrets/pull/6517) - feat(secretserver): support authentication via access token by [@sumanpal97](https://github.com/sumanpal97) in [#6597](https://github.com/external-secrets/external-secrets/pull/6597) - docs(secretserver): document authentication, key formats, property behavior, and limitations by [@dbinger](https://github.com/dbinger) in [#6619](https://github.com/external-secrets/external-secrets/pull/6619) - feat(release): Support reading values from kubernetes CRD by [@alekc](https://github.com/alekc) in [#6211](https://github.com/external-secrets/external-secrets/pull/6211) - clean: Standardize and friendly name for validations policies by [@evrardj-roche](https://github.com/evrardj-roche) in [#6630](https://github.com/external-secrets/external-secrets/pull/6630) - feat: add CreateOrMerge creation policy for ExternalSecrets by [@alekc](https://github.com/alekc) in [#6641](https://github.com/external-secrets/external-secrets/pull/6641) - feat(core): accept duration string for SecretStore refreshInterval by [@alekc](https://github.com/alekc) in [#6594](https://github.com/external-secrets/external-secrets/pull/6594) - fix(beyondtrust): validate store without panicking on API key auth by [@emmayusufu](https://github.com/emmayusufu) in [#6553](https://github.com/external-secrets/external-secrets/pull/6553) - fix(oracle): cache default WorkloadIdentity provider to prevent tcp port exhaustion by [@Ashutosh-3601](https://github.com/Ashutosh-3601) in [#6421](https://github.com/external-secrets/external-secrets/pull/6421) ##### Dependencies - chore(deps): bump golang from `3ad5730` to `3ad5730` by [@dependabot](https://github.com/dependabot)\[bot] in [#6538](https://github.com/external-secrets/external-secrets/pull/6538) - chore(deps): bump ubi9/ubi from `1b99266` to `37a1589` by [@dependabot](https://github.com/dependabot)\[bot] in [#6537](https://github.com/external-secrets/external-secrets/pull/6537) - chore(deps): bump golang from `5f68ec6` to `b305420` in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#6539](https://github.com/external-secrets/external-secrets/pull/6539) - chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6540](https://github.com/external-secrets/external-secrets/pull/6540) - chore(deps): bump aws-actions/configure-aws-credentials from 6.2.0 to 6.2.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6542](https://github.com/external-secrets/external-secrets/pull/6542) - chore(deps): bump actions/attest-build-provenance from 4.1.0 to 4.1.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6543](https://github.com/external-secrets/external-secrets/pull/6543) - chore(deps): bump azure/setup-helm from 5.0.0 to 5.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6544](https://github.com/external-secrets/external-secrets/pull/6544) - chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6541](https://github.com/external-secrets/external-secrets/pull/6541) - chore(deps): bump actions/cache from 5.0.5 to 6.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6545](https://github.com/external-secrets/external-secrets/pull/6545) - chore(deps): bump golang from `3ad5730` to `3ad5730` by [@dependabot](https://github.com/dependabot)\[bot] in [#6600](https://github.com/external-secrets/external-secrets/pull/6600) - chore(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6606](https://github.com/external-secrets/external-secrets/pull/6606) - chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6603](https://github.com/external-secrets/external-secrets/pull/6603) - chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#6607](https://github.com/external-secrets/external-secrets/pull/6607) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#6604](https://github.com/external-secrets/external-secrets/pull/6604) - chore(deps): bump github/codeql-action/init from 4.36.2 to 4.36.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#6608](https://github.com/external-secrets/external-secrets/pull/6608) - chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#6605](https://github.com/external-secrets/external-secrets/pull/6605) - chore(deps): bump docker/login-action from 4.2.0 to 4.4.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6602](https://github.com/external-secrets/external-secrets/pull/6602) - chore(deps): bump fossas/fossa-action from 1.9.0 to 2.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6601](https://github.com/external-secrets/external-secrets/pull/6601) - chore(deps): bump ubi9/ubi from `37a1589` to `8bf0e8f` by [@dependabot](https://github.com/dependabot)\[bot] in [#6599](https://github.com/external-secrets/external-secrets/pull/6599) - chore(deps): bump golang from 1.26.4 to 1.26.5 by [@dependabot](https://github.com/dependabot)\[bot] in [#6636](https://github.com/external-secrets/external-secrets/pull/6636) - chore(deps): bump distroless/static from `3592aa8` to `d5f030c` by [@dependabot](https://github.com/dependabot)\[bot] in [#6635](https://github.com/external-secrets/external-secrets/pull/6635) #### New Contributors - [@alpcanaydin](https://github.com/alpcanaydin) made their first contribution in [#6612](https://github.com/external-secrets/external-secrets/pull/6612) - [@baraka-akeyless](https://github.com/baraka-akeyless) made their first contribution in [#6530](https://github.com/external-secrets/external-secrets/pull/6530) - [@arpitjain099](https://github.com/arpitjain099) made their first contribution in [#6614](https://github.com/external-secrets/external-secrets/pull/6614) - [@civilizedBaboon](https://github.com/civilizedBaboon) made their first contribution in [#6646](https://github.com/external-secrets/external-secrets/pull/6646) - [@dbinger](https://github.com/dbinger) made their first contribution in [#6616](https://github.com/external-secrets/external-secrets/pull/6616) - [@dsp0x4](https://github.com/dsp0x4) made their first contribution in [#6117](https://github.com/external-secrets/external-secrets/pull/6117) - [@izz-linux](https://github.com/izz-linux) made their first contribution in [#6644](https://github.com/external-secrets/external-secrets/pull/6644) - [@hdabrowski](https://github.com/hdabrowski) made their first contribution in [#6393](https://github.com/external-secrets/external-secrets/pull/6393) - [@sumanpal97](https://github.com/sumanpal97) made their first contribution in [#6597](https://github.com/external-secrets/external-secrets/pull/6597) - [@emmayusufu](https://github.com/emmayusufu) made their first contribution in [#6553](https://github.com/external-secrets/external-secrets/pull/6553) - [@Ashutosh-3601](https://github.com/Ashutosh-3601) made their first contribution in [#6421](https://github.com/external-secrets/external-secrets/pull/6421) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.7.0...v2.8.0> ### [`v2.7.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.7.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.6.0...v2.7.0) Image: `ghcr.io/external-secrets/external-secrets:v2.7.0` Image: `ghcr.io/external-secrets/external-secrets:v2.7.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.7.0-ubi-boringssl`  #### What's Changed ##### General - chore: release helm charts 2.6.0 by [@Skarlso](https://github.com/Skarlso) in [#6427](https://github.com/external-secrets/external-secrets/pull/6427) - test: add Infisical provider e2e suite by [@alekc](https://github.com/alekc) in [#6415](https://github.com/external-secrets/external-secrets/pull/6415) - docs: fix discrepancies and add missing documentation for GitLab provider by [@alekc](https://github.com/alekc) in [#6430](https://github.com/external-secrets/external-secrets/pull/6430) - docs: fix discrepancies and add missing documentation for Infisical provider by [@alekc](https://github.com/alekc) in [#6431](https://github.com/external-secrets/external-secrets/pull/6431) - feat(templating): add hexdec function by [@tstenner](https://github.com/tstenner) in [#6422](https://github.com/external-secrets/external-secrets/pull/6422) - fix(volcengine): honor secretRef.namespace for ClusterSecretStore by [@ruslan-rm](https://github.com/ruslan-rm) in [#6423](https://github.com/external-secrets/external-secrets/pull/6423) - docs(core): correct CRD examples and document missing fields by [@alekc](https://github.com/alekc) in [#6441](https://github.com/external-secrets/external-secrets/pull/6441) - feat(provider): initial dedicated OpenBao provider by [@phil9909](https://github.com/phil9909) in [#6405](https://github.com/external-secrets/external-secrets/pull/6405) - feat(onepasswordsdk): implement GetAllSecrets by [@calebmckay](https://github.com/calebmckay) in [#6445](https://github.com/external-secrets/external-secrets/pull/6445) - feat(controller): log secret deletions and data-key changes by [@alekc](https://github.com/alekc) in [#6443](https://github.com/external-secrets/external-secrets/pull/6443) - feat: Add BeyondTrust WorkloadCredentials provider by [@sdahal-bt](https://github.com/sdahal-bt) in [#5999](https://github.com/external-secrets/external-secrets/pull/5999) - fix(charts): truncate component names to stay within 63-char DNS limit by [@alekc](https://github.com/alekc) in [#6428](https://github.com/external-secrets/external-secrets/pull/6428) - docs(gitops-fluxcd): fix webhook race condition in Flux deployment guide by [@alekc](https://github.com/alekc) in [#6455](https://github.com/external-secrets/external-secrets/pull/6455) - fix: no need for the field to have a default if it can be omitted by [@knelasevero](https://github.com/knelasevero) in [#6453](https://github.com/external-secrets/external-secrets/pull/6453) - fix(templating): preserve mixed-case in generic target paths by [@alekc](https://github.com/alekc) in [#6459](https://github.com/external-secrets/external-secrets/pull/6459) - docs(generator): document Password secretKeys for multiple keys by [@alekc](https://github.com/alekc) in [#6440](https://github.com/external-secrets/external-secrets/pull/6440) - docs: Update deprecated field in docs by [@evrardj-roche](https://github.com/evrardj-roche) in [#6456](https://github.com/external-secrets/external-secrets/pull/6456) - chore(deps): Bump passbolt SDK to v0.8.0 by [@cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) in [#6447](https://github.com/external-secrets/external-secrets/pull/6447) - chore(charts): Expose storeRequeueInterval in helm charts by [@jfhcagip](https://github.com/jfhcagip) in [#6140](https://github.com/external-secrets/external-secrets/pull/6140) - feat(openbao): support custom CAs via `caBundle` and `caProvider` by [@phil9909](https://github.com/phil9909) in [#6461](https://github.com/external-secrets/external-secrets/pull/6461) - feat(ngrok): use API filtering for vault and secret lookups by [@jonstacks](https://github.com/jonstacks) in [#6376](https://github.com/external-secrets/external-secrets/pull/6376) - fix: remove broken link from blog section by [@riccardomc](https://github.com/riccardomc) in [#6465](https://github.com/external-secrets/external-secrets/pull/6465) - chore: fix the template parser for resolving slice notations by [@Skarlso](https://github.com/Skarlso) in [#6449](https://github.com/external-secrets/external-secrets/pull/6449) - fix: bump docs deps for python3.13 by [@evrardj-roche](https://github.com/evrardj-roche) in [#6475](https://github.com/external-secrets/external-secrets/pull/6475) - fix(kubernetes): replace entire remote secret when pushing rather than merging by [@riccardomc](https://github.com/riccardomc) in [#6485](https://github.com/external-secrets/external-secrets/pull/6485) - feat(infisical): return NoSecretErr on 404 and add PushSecret support by [@alekc](https://github.com/alekc) in [#6434](https://github.com/external-secrets/external-secrets/pull/6434) - feat(AWS): add `replicationLocations` to AWS SecretsManager provider by [@cmoscofian](https://github.com/cmoscofian) in [#6451](https://github.com/external-secrets/external-secrets/pull/6451) - feat(openbao): add `auth.userPass` auth method by [@phil9909](https://github.com/phil9909) in [#6492](https://github.com/external-secrets/external-secrets/pull/6492) - chore(deps): Bump `github.com/pulumi/esc-sdk/sdk` to v0.14.0 by [@phil9909](https://github.com/phil9909) in [#6495](https://github.com/external-secrets/external-secrets/pull/6495) - chore(onepasswordsdk): fix the caching logic and cleanup the code a bit by [@Skarlso](https://github.com/Skarlso) in [#6466](https://github.com/external-secrets/external-secrets/pull/6466) - feat(charts): scope cert-controller RBAC to managed CRDs and webhook secret by [@somaz94](https://github.com/somaz94) in [#6481](https://github.com/external-secrets/external-secrets/pull/6481) - test(ngrok): Remove over complicated mocks by [@jonstacks](https://github.com/jonstacks) in [#6483](https://github.com/external-secrets/external-secrets/pull/6483) - chore: Unpin mike by [@evrardj-roche](https://github.com/evrardj-roche) in [#6477](https://github.com/external-secrets/external-secrets/pull/6477) - docs(akeyless): fix errors and expand provider documentation by [@alekc](https://github.com/alekc) in [#6506](https://github.com/external-secrets/external-secrets/pull/6506) - chore: update go sys net and crypto libs by [@Skarlso](https://github.com/Skarlso) in [#6511](https://github.com/external-secrets/external-secrets/pull/6511) - chore(onepasswordsdk): enable the GetAllSecrets and GetSecret unit test and fix it by [@Skarlso](https://github.com/Skarlso) in [#6513](https://github.com/external-secrets/external-secrets/pull/6513) - feat(infisical): allow organization slug to be set in secret scope by [@mathnogueira](https://github.com/mathnogueira) in [#6508](https://github.com/external-secrets/external-secrets/pull/6508) - feat(templating): decode templateFrom values by [@evrardj-roche](https://github.com/evrardj-roche) in [#6482](https://github.com/external-secrets/external-secrets/pull/6482) - chore(bug): fix missing lgtm runner script from the workflow by [@Skarlso](https://github.com/Skarlso) in [#6512](https://github.com/external-secrets/external-secrets/pull/6512) - fix(akeyless): return ReadWrite so PushSecret is routed by [@alekc](https://github.com/alekc) in [#6515](https://github.com/external-secrets/external-secrets/pull/6515) - feat(openbao): add `auth.appRole` auth method by [@phil9909](https://github.com/phil9909) in [#6497](https://github.com/external-secrets/external-secrets/pull/6497) - feat(externalsecret): add SyncWindows to gate periodic refresh by [@alekc](https://github.com/alekc) in [#6452](https://github.com/external-secrets/external-secrets/pull/6452) - docs(azure): correct Azure Stack example version and note expiry limit by [@alekc](https://github.com/alekc) in [#6522](https://github.com/external-secrets/external-secrets/pull/6522) - feat(openbao): add support for OpenBao Namespaces by [@phil9909](https://github.com/phil9909) in [#6527](https://github.com/external-secrets/external-secrets/pull/6527) - fix(github): preserve selected repositories on org secret update by [@alekc](https://github.com/alekc) in [#6519](https://github.com/external-secrets/external-secrets/pull/6519) - docs(azure): list WorkloadIdentity in authType field description by [@alekc](https://github.com/alekc) in [#6523](https://github.com/external-secrets/external-secrets/pull/6523) - feat(doppler): include HTTP status in API errors by [@alekc](https://github.com/alekc) in [#6489](https://github.com/external-secrets/external-secrets/pull/6489) ##### Dependencies - chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#6437](https://github.com/external-secrets/external-secrets/pull/6437) - chore(deps): bump github/codeql-action from 4.36.0 to 4.36.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6438](https://github.com/external-secrets/external-secrets/pull/6438) - chore(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6435](https://github.com/external-secrets/external-secrets/pull/6435) - chore(deps): bump idna from 3.17 to 3.18 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6439](https://github.com/external-secrets/external-secrets/pull/6439) - chore(deps): bump ubi9/ubi from `8942b73` to `46d19c1` by [@dependabot](https://github.com/dependabot)\[bot] in [#6436](https://github.com/external-secrets/external-secrets/pull/6436) - chore(deps): bump platformdirs from 4.9.6 to 4.10.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6410](https://github.com/external-secrets/external-secrets/pull/6410) - chore(deps): bump golang from `f23e8b2` to `7a3e500` by [@dependabot](https://github.com/dependabot)\[bot] in [#6468](https://github.com/external-secrets/external-secrets/pull/6468) - chore(deps): bump golang from `5d2b868` to `5f68ec6` in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#6471](https://github.com/external-secrets/external-secrets/pull/6471) - chore(deps): bump tornado from 6.5.6 to 6.5.7 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6473](https://github.com/external-secrets/external-secrets/pull/6473) - chore(deps): bump alpine from 3.23.4 to 3.24.0 in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#6470](https://github.com/external-secrets/external-secrets/pull/6470) - chore(deps): bump alpine from `5b10f43` to `a2d49ea` by [@dependabot](https://github.com/dependabot)\[bot] in [#6469](https://github.com/external-secrets/external-secrets/pull/6469) - chore(deps): bump ubi9/ubi from `46d19c1` to `1b99266` by [@dependabot](https://github.com/dependabot)\[bot] in [#6467](https://github.com/external-secrets/external-secrets/pull/6467) - chore(deps): bump alpine from `a2d49ea` to `28bd5fe` in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6472](https://github.com/external-secrets/external-secrets/pull/6472) - chore(deps): bump alpine from 3.24.0 to 3.24.1 in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#6498](https://github.com/external-secrets/external-secrets/pull/6498) - chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6500](https://github.com/external-secrets/external-secrets/pull/6500) - chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6502](https://github.com/external-secrets/external-secrets/pull/6502) - chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by [@dependabot](https://github.com/dependabot)\[bot] in [#6503](https://github.com/external-secrets/external-secrets/pull/6503) - chore(deps): bump alpine from `a2d49ea` to `28bd5fe` by [@dependabot](https://github.com/dependabot)\[bot] in [#6499](https://github.com/external-secrets/external-secrets/pull/6499) - chore(deps): bump golang from `7a3e500` to `3ad5730` by [@dependabot](https://github.com/dependabot)\[bot] in [#6501](https://github.com/external-secrets/external-secrets/pull/6501) #### New Contributors - [@tstenner](https://github.com/tstenner) made their first contribution in [#6422](https://github.com/external-secrets/external-secrets/pull/6422) - [@ruslan-rm](https://github.com/ruslan-rm) made their first contribution in [#6423](https://github.com/external-secrets/external-secrets/pull/6423) - [@calebmckay](https://github.com/calebmckay) made their first contribution in [#6445](https://github.com/external-secrets/external-secrets/pull/6445) - [@sdahal-bt](https://github.com/sdahal-bt) made their first contribution in [#5999](https://github.com/external-secrets/external-secrets/pull/5999) - [@jfhcagip](https://github.com/jfhcagip) made their first contribution in [#6140](https://github.com/external-secrets/external-secrets/pull/6140) - [@somaz94](https://github.com/somaz94) made their first contribution in [#6481](https://github.com/external-secrets/external-secrets/pull/6481) - [@mathnogueira](https://github.com/mathnogueira) made their first contribution in [#6508](https://github.com/external-secrets/external-secrets/pull/6508) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.6.0...v2.7.0> ### [`v2.6.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.6.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.5.0...v2.6.0) Image: `ghcr.io/external-secrets/external-secrets:v2.6.0` Image: `ghcr.io/external-secrets/external-secrets:v2.6.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.6.0-ubi-boringssl`  #### What's Changed ##### General - chore: release helm chart 2.5.0 by [@Skarlso](https://github.com/Skarlso) in [#6352](https://github.com/external-secrets/external-secrets/pull/6352) - feat(keeper): implement provider\_api\_calls\_count metric by [@m-k8s](https://github.com/m-k8s) in [#6345](https://github.com/external-secrets/external-secrets/pull/6345) - docs(gcpsm): updates Google Secret Manager authentication guide with WIF usage by [@bharath-b-rh](https://github.com/bharath-b-rh) in [#6356](https://github.com/external-secrets/external-secrets/pull/6356) - feat(release): PB-51302 - External secret should support v5-custom-fields resource type by [@cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) in [#6377](https://github.com/external-secrets/external-secrets/pull/6377) - feat(testing): OpenBao e2e test by [@phil9909](https://github.com/phil9909) in [#6396](https://github.com/external-secrets/external-secrets/pull/6396) - docs: Explanation of our labels by [@evrardj-roche](https://github.com/evrardj-roche) in [#6306](https://github.com/external-secrets/external-secrets/pull/6306) - docs: add AGENTS.md and AI setup guide for ESO by [@rowanruseler](https://github.com/rowanruseler) in [#6141](https://github.com/external-secrets/external-secrets/pull/6141) - fix(makefile): clean up cross-submodule go.mod churn after make test by [@alekc](https://github.com/alekc) in [#6378](https://github.com/external-secrets/external-secrets/pull/6378) - fix(provider): align TokenRequest body namespace with URL namespace by [@alekc](https://github.com/alekc) in [#6420](https://github.com/external-secrets/external-secrets/pull/6420) - fix(build): use buildx --load and non-registry image tag by [@alekc](https://github.com/alekc) in [#6419](https://github.com/external-secrets/external-secrets/pull/6419) - fix(charts): render PDB spec when minAvailable or maxUnavailable is zero by [@blindrood](https://github.com/blindrood) in [#6360](https://github.com/external-secrets/external-secrets/pull/6360) - chore: update go version 1.26.4 by [@Skarlso](https://github.com/Skarlso) in [#6426](https://github.com/external-secrets/external-secrets/pull/6426) ##### Dependencies - chore(deps): bump golang from `91eda97` to `91eda97` by [@dependabot](https://github.com/dependabot)\[bot] in [#6363](https://github.com/external-secrets/external-secrets/pull/6363) - chore(deps): bump pymdown-extensions from 10.21.2 to 10.21.3 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6370](https://github.com/external-secrets/external-secrets/pull/6370) - chore(deps): bump hashicorp/setup-terraform from 4.0.0 to 4.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6364](https://github.com/external-secrets/external-secrets/pull/6364) - chore(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 by [@dependabot](https://github.com/dependabot)\[bot] in [#6365](https://github.com/external-secrets/external-secrets/pull/6365) - chore(deps): bump step-security/harden-runner from 2.19.1 to 2.19.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#6366](https://github.com/external-secrets/external-secrets/pull/6366) - chore(deps): bump github/codeql-action from 4.35.4 to 4.36.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6368](https://github.com/external-secrets/external-secrets/pull/6368) - chore(deps): bump distroless/static from `47b2d72` to `3592aa8` by [@dependabot](https://github.com/dependabot)\[bot] in [#6362](https://github.com/external-secrets/external-secrets/pull/6362) - chore(deps): bump ubi9/ubi from `2323fcf` to `151fc1b` by [@dependabot](https://github.com/dependabot)\[bot] in [#6361](https://github.com/external-secrets/external-secrets/pull/6361) - chore(deps): bump actions/create-github-app-token from 3.1.1 to 3.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6367](https://github.com/external-secrets/external-secrets/pull/6367) - chore(deps): bump idna from 3.14 to 3.16 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6369](https://github.com/external-secrets/external-secrets/pull/6369) - chore(deps): bump golang from `91eda97` to `91eda97` by [@dependabot](https://github.com/dependabot)\[bot] in [#6383](https://github.com/external-secrets/external-secrets/pull/6383) - chore(deps): bump golang from `252599a` to `386d475` in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#6389](https://github.com/external-secrets/external-secrets/pull/6389) - chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6384](https://github.com/external-secrets/external-secrets/pull/6384) - chore(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6387](https://github.com/external-secrets/external-secrets/pull/6387) - chore(deps): bump docker/login-action from 4.1.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6386](https://github.com/external-secrets/external-secrets/pull/6386) - chore(deps): bump actions/stale from 10.2.0 to 10.3.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6388](https://github.com/external-secrets/external-secrets/pull/6388) - chore(deps): bump zipp from 3.23.1 to 4.1.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6390](https://github.com/external-secrets/external-secrets/pull/6390) - chore(deps): bump click from 8.3.3 to 8.4.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6391](https://github.com/external-secrets/external-secrets/pull/6391) - chore(deps): bump certifi from 2026.4.22 to 2026.5.20 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6392](https://github.com/external-secrets/external-secrets/pull/6392) - chore(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6385](https://github.com/external-secrets/external-secrets/pull/6385) - chore(deps): bump requests from 2.33.1 to 2.34.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6372](https://github.com/external-secrets/external-secrets/pull/6372) - chore(deps): bump tornado from 6.5.5 to 6.5.6 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6412](https://github.com/external-secrets/external-secrets/pull/6412) - chore(deps): bump ubi9/ubi from `151fc1b` to `8942b73` by [@dependabot](https://github.com/dependabot)\[bot] in [#6407](https://github.com/external-secrets/external-secrets/pull/6407) - chore(deps): bump aws-actions/configure-aws-credentials from 6.1.1 to 6.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6408](https://github.com/external-secrets/external-secrets/pull/6408) - chore(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6409](https://github.com/external-secrets/external-secrets/pull/6409) - chore(deps): bump idna from 3.16 to 3.17 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6411](https://github.com/external-secrets/external-secrets/pull/6411) #### New Contributors - [@m-k8s](https://github.com/m-k8s) made their first contribution in [#6345](https://github.com/external-secrets/external-secrets/pull/6345) - [@phil9909](https://github.com/phil9909) made their first contribution in [#6396](https://github.com/external-secrets/external-secrets/pull/6396) - [@blindrood](https://github.com/blindrood) made their first contribution in [#6360](https://github.com/external-secrets/external-secrets/pull/6360) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.5.0...v2.6.0> ### [`v2.5.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.5.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.4.1...v2.5.0) Image: `ghcr.io/external-secrets/external-secrets:v2.5.0` Image: `ghcr.io/external-secrets/external-secrets:v2.5.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.5.0-ubi-boringssl`  #### What's Changed ##### General - chore: release chart for v2.4.1 by [@Skarlso](https://github.com/Skarlso) in [#6293](https://github.com/external-secrets/external-secrets/pull/6293) - fix(doc): Adds missing doc reference for VaultDynamicSecret example using GET by [@bharath-b-rh](https://github.com/bharath-b-rh) in [#6296](https://github.com/external-secrets/external-secrets/pull/6296) - feat(charts): make serviceaccounts/token create RBAC rule conditional by [@kriszkern](https://github.com/kriszkern) in [#6295](https://github.com/external-secrets/external-secrets/pull/6295) - ref: delete duplication of applyOwnership logic by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6301](https://github.com/external-secrets/external-secrets/pull/6301) - feat: add Pulumi OIDC-based authentication by [@johnstonmatt](https://github.com/johnstonmatt) in [#5893](https://github.com/external-secrets/external-secrets/pull/5893) - fix: datarace in fake runtime test and push secret test by [@Skarlso](https://github.com/Skarlso) in [#6300](https://github.com/external-secrets/external-secrets/pull/6300) - docs(release): Update docs to build for arm for bitwarden-cli by [@Senk02](https://github.com/Senk02) in [#6312](https://github.com/external-secrets/external-secrets/pull/6312) - feat: add healthz check for liveness probe to cert and webhook by [@Skarlso](https://github.com/Skarlso) in [#6319](https://github.com/external-secrets/external-secrets/pull/6319) - chore: bump go version 1.26.3 by [@Skarlso](https://github.com/Skarlso) in [#6339](https://github.com/external-secrets/external-secrets/pull/6339) - fix(charts): gate externalsecrets write RBAC on processClusterExternalSecret by [@kriszkern](https://github.com/kriszkern) in [#6332](https://github.com/external-secrets/external-secrets/pull/6332) - feat(gcp): issue-5790: optional GCP service account email for WIF impersonation by [@bharath-b-rh](https://github.com/bharath-b-rh) in [#6273](https://github.com/external-secrets/external-secrets/pull/6273) - ref(beyondtrust): BIPS-32651 add API v3.2 support for create Secrets by [@btfhernandez](https://github.com/btfhernandez) in [#6309](https://github.com/external-secrets/external-secrets/pull/6309) - fix(onepassword): return fresh provider instance from NewClient to avoid wrong-vault race by [@duizabojul](https://github.com/duizabojul) in [#6334](https://github.com/external-secrets/external-secrets/pull/6334) - docs: add Rootline to ADOPTERS.md by [@daanschipper](https://github.com/daanschipper) in [#6342](https://github.com/external-secrets/external-secrets/pull/6342) - feat(charts): default scopedNamespace to .Release.Namespace when scopedRBAC is true by [@kriszkern](https://github.com/kriszkern) in [#6343](https://github.com/external-secrets/external-secrets/pull/6343) - docs: add blank lines before lists by [@chlab](https://github.com/chlab) in [#6336](https://github.com/external-secrets/external-secrets/pull/6336) - chore(doc): fix Azure role name typo by [@hobti01](https://github.com/hobti01) in [#6335](https://github.com/external-secrets/external-secrets/pull/6335) - feat(security): Enable Authentication and Authorization for Metrics Endpoint using FilterProvider by [@Zacky3181V](https://github.com/Zacky3181V) in [#5574](https://github.com/external-secrets/external-secrets/pull/5574) - feat: inject kube context as STS session tags by [@robertchildresscfa](https://github.com/robertchildresscfa) in [#6311](https://github.com/external-secrets/external-secrets/pull/6311) - fix(charts): remove stale args guard in controller deployment by [@kriszkern](https://github.com/kriszkern) in [#6347](https://github.com/external-secrets/external-secrets/pull/6347) - fix: provider/infisical provider sub-folder references in remoteRef.key by [@varonix0](https://github.com/varonix0) in [#6338](https://github.com/external-secrets/external-secrets/pull/6338) ##### Dependencies - chore(deps): bump golang from `4f4ab2c` to `47ce563` in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#6286](https://github.com/external-secrets/external-secrets/pull/6286) - chore(deps): bump click from 8.3.2 to 8.3.3 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6287](https://github.com/external-secrets/external-secrets/pull/6287) - chore(deps): bump certifi from 2026.2.25 to 2026.4.22 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6288](https://github.com/external-secrets/external-secrets/pull/6288) - chore(deps): bump pathspec from 1.0.4 to 1.1.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6291](https://github.com/external-secrets/external-secrets/pull/6291) - chore(deps): bump idna from 3.11 to 3.13 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6290](https://github.com/external-secrets/external-secrets/pull/6290) - chore(deps): bump packaging from 26.1 to 26.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6289](https://github.com/external-secrets/external-secrets/pull/6289) - chore(deps): bump step-security/harden-runner from 2.19.0 to 2.19.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6304](https://github.com/external-secrets/external-secrets/pull/6304) - chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#6305](https://github.com/external-secrets/external-secrets/pull/6305) - chore(deps): bump golang from 1.26.2 to 1.26.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#6320](https://github.com/external-secrets/external-secrets/pull/6320) - chore(deps): bump golang from 1.26.2-bookworm to 1.26.3-bookworm in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#6327](https://github.com/external-secrets/external-secrets/pull/6327) - chore(deps): bump ubi9/ubi from `fd3612e` to `2323fcf` by [@dependabot](https://github.com/dependabot)\[bot] in [#6321](https://github.com/external-secrets/external-secrets/pull/6321) - chore(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6322](https://github.com/external-secrets/external-secrets/pull/6322) - chore(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6323](https://github.com/external-secrets/external-secrets/pull/6323) - chore(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6325](https://github.com/external-secrets/external-secrets/pull/6325) - chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#6324](https://github.com/external-secrets/external-secrets/pull/6324) - chore(deps): bump actions/labeler from 6.0.1 to 6.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6326](https://github.com/external-secrets/external-secrets/pull/6326) - chore(deps): bump idna from 3.13 to 3.14 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6328](https://github.com/external-secrets/external-secrets/pull/6328) - chore(deps): bump urllib3 from 2.6.3 to 2.7.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6329](https://github.com/external-secrets/external-secrets/pull/6329) - chore(deps): bump regex from 2026.4.4 to 2026.5.9 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6330](https://github.com/external-secrets/external-secrets/pull/6330) #### New Contributors - [@kriszkern](https://github.com/kriszkern) made their first contribution in [#6295](https://github.com/external-secrets/external-secrets/pull/6295) - [@johnstonmatt](https://github.com/johnstonmatt) made their first contribution in [#5893](https://github.com/external-secrets/external-secrets/pull/5893) - [@Senk02](https://github.com/Senk02) made their first contribution in [#6312](https://github.com/external-secrets/external-secrets/pull/6312) - [@duizabojul](https://github.com/duizabojul) made their first contribution in [#6334](https://github.com/external-secrets/external-secrets/pull/6334) - [@daanschipper](https://github.com/daanschipper) made their first contribution in [#6342](https://github.com/external-secrets/external-secrets/pull/6342) - [@chlab](https://github.com/chlab) made their first contribution in [#6336](https://github.com/external-secrets/external-secrets/pull/6336) - [@hobti01](https://github.com/hobti01) made their first contribution in [#6335](https://github.com/external-secrets/external-secrets/pull/6335) - [@Zacky3181V](https://github.com/Zacky3181V) made their first contribution in [#5574](https://github.com/external-secrets/external-secrets/pull/5574) - [@robertchildresscfa](https://github.com/robertchildresscfa) made their first contribution in [#6311](https://github.com/external-secrets/external-secrets/pull/6311) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.4.1...v2.5.0> ### [`v2.4.1`](https://github.com/external-secrets/external-secrets/releases/tag/v2.4.1) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.4.0...v2.4.1) Image: `ghcr.io/external-secrets/external-secrets:v2.4.1` Image: `ghcr.io/external-secrets/external-secrets:v2.4.1-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.4.1-ubi-boringssl`  #### What's Changed ##### General - chore: release chart for v2.4.0 by [@Skarlso](https://github.com/Skarlso) in [#6277](https://github.com/external-secrets/external-secrets/pull/6277) - feat(gcp): support multiple replicationLocations on PushSecret by [@alliasgher](https://github.com/alliasgher) in [#6225](https://github.com/external-secrets/external-secrets/pull/6225) - feat(passbolt): add custom CA bundle / CA provider support by [@alliasgher](https://github.com/alliasgher) in [#6224](https://github.com/external-secrets/external-secrets/pull/6224) - feat(azure): add contentType support for PushSecret by [@ppatel1604](https://github.com/ppatel1604) in [#6249](https://github.com/external-secrets/external-secrets/pull/6249) - feat(charts): add liveness probes to cert-controller and webhook by [@mattcarp12](https://github.com/mattcarp12) in [#6147](https://github.com/external-secrets/external-secrets/pull/6147) - fix: prevent creation of specific type of secrets by [@Skarlso](https://github.com/Skarlso) in [#6280](https://github.com/external-secrets/external-secrets/pull/6280) ##### Dependencies - chore(deps): bump golang from `f853308` to `f853308` by [@dependabot](https://github.com/dependabot)\[bot] in [#6282](https://github.com/external-secrets/external-secrets/pull/6282) - chore(deps): bump alpine from `2510918` to `5b10f43` in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6285](https://github.com/external-secrets/external-secrets/pull/6285) - chore(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6283](https://github.com/external-secrets/external-secrets/pull/6283) - chore(deps): bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6284](https://github.com/external-secrets/external-secrets/pull/6284) - chore(deps): bump ubi9/ubi from `cf13fe2` to `fd3612e` by [@dependabot](https://github.com/dependabot)\[bot] in [#6281](https://github.com/external-secrets/external-secrets/pull/6281) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.4.0...v2.4.1> ### [`v2.4.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.4.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.3.0...v2.4.0) Image: `ghcr.io/external-secrets/external-secrets:v2.4.0` Image: `ghcr.io/external-secrets/external-secrets:v2.4.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.4.0-ubi-boringssl`  #### What's Changed ##### General - chore: release helm chart for v2.3.0 by [@Skarlso](https://github.com/Skarlso) in [#6204](https://github.com/external-secrets/external-secrets/pull/6204) - fix(docs): hide Scarf tracking pixel to remove page whitespace by [@ppatel1604](https://github.com/ppatel1604) in [#6209](https://github.com/external-secrets/external-secrets/pull/6209) - docs: Add Grafana generator documentation by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6227](https://github.com/external-secrets/external-secrets/pull/6227) - docs: add TLS certificate authentication example for Vault provider by [@alliasgher](https://github.com/alliasgher) in [#6212](https://github.com/external-secrets/external-secrets/pull/6212) - docs(cloudsmith): Improve cloudsmith generator documentation by [@cloudsmith-iduffy](https://github.com/cloudsmith-iduffy) in [#6232](https://github.com/external-secrets/external-secrets/pull/6232) - docs: add missing specs to GeneratorSpec example by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6236](https://github.com/external-secrets/external-secrets/pull/6236) - feat(keeper): implement get secret by id or name by [@tiberiuv](https://github.com/tiberiuv) in [#6163](https://github.com/external-secrets/external-secrets/pull/6163) - chore(secretserver): update dependencies to accept new DelineaXPM/tss-sdk-go by [@DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#6240](https://github.com/external-secrets/external-secrets/pull/6240) - docs(release): update documentation links from /main to /latest by [@cinpol](https://github.com/cinpol) in [#6210](https://github.com/external-secrets/external-secrets/pull/6210) - fix: CAProvider cm access by [@moolen](https://github.com/moolen) in [#6246](https://github.com/external-secrets/external-secrets/pull/6246) - fix(chart): add failurePolicy to ClusterSecretStore webhook by [@ryanjwong](https://github.com/ryanjwong) in [#6247](https://github.com/external-secrets/external-secrets/pull/6247) - feat(dvls): add name support for entries by [@rbstp](https://github.com/rbstp) in [#6099](https://github.com/external-secrets/external-secrets/pull/6099) - fix(akeyless): upgrade akeyless-go-cloud-id to v0.3.7 by [@alikdolg](https://github.com/alikdolg) in [#6248](https://github.com/external-secrets/external-secrets/pull/6248) - chore(deps): bump azure/setup-helm from 3.5 to 5 by [@dependabot](https://github.com/dependabot)\[bot] in [#6258](https://github.com/external-secrets/external-secrets/pull/6258) - fix: do not set tags if undefined by [@Skarlso](https://github.com/Skarlso) in [#6103](https://github.com/external-secrets/external-secrets/pull/6103) - fix(conjur): return error for unimplemented PushSecret and DeleteSecret by [@antonio-mazzini](https://github.com/antonio-mazzini) in [#6266](https://github.com/external-secrets/external-secrets/pull/6266) - docs: Enhance ClusterExternalSecret documentation with "fan-out" approach by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6241](https://github.com/external-secrets/external-secrets/pull/6241) - feat: add --leader-election-id flag to support HA deployments by [@mattcarp12](https://github.com/mattcarp12) in [#6148](https://github.com/external-secrets/external-secrets/pull/6148) - feat(bug): Fix CVE-2026-34165, CVE-2026-33762 and GHSA-3xc5-wrhm-f963 by [@othomann](https://github.com/othomann) in [#6271](https://github.com/external-secrets/external-secrets/pull/6271) - feat: enhance VaultDynamicSecret GET method to support parameters from the spec by [@samm-git](https://github.com/samm-git) in [#6267](https://github.com/external-secrets/external-secrets/pull/6267) - fix: use a separate parameter for GET calls in VaultDynamicSecrets by [@Skarlso](https://github.com/Skarlso) in [#6275](https://github.com/external-secrets/external-secrets/pull/6275) ##### Dependencies - chore(deps): bump golang from `c2a1f7b` to `c2a1f7b` by [@dependabot](https://github.com/dependabot)\[bot] in [#6214](https://github.com/external-secrets/external-secrets/pull/6214) - chore(deps): bump platformdirs from 4.9.4 to 4.9.6 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6219](https://github.com/external-secrets/external-secrets/pull/6219) - chore(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6216](https://github.com/external-secrets/external-secrets/pull/6216) - chore(deps): bump codelytv/pr-size-labeler from 1.10.3 to 1.10.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#6221](https://github.com/external-secrets/external-secrets/pull/6221) - chore(deps): bump ubi9/ubi from `9e6e193` to `039095f` by [@dependabot](https://github.com/dependabot)\[bot] in [#6213](https://github.com/external-secrets/external-secrets/pull/6213) - chore(deps): bump importlib-resources from 6.5.2 to 7.1.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6220](https://github.com/external-secrets/external-secrets/pull/6220) - chore(deps): bump actions/github-script from 8.0.0 to 9.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6215](https://github.com/external-secrets/external-secrets/pull/6215) - chore(deps): bump step-security/harden-runner from 2.16.1 to 2.17.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6217](https://github.com/external-secrets/external-secrets/pull/6217) - chore(deps): bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6218](https://github.com/external-secrets/external-secrets/pull/6218) - chore(deps): bump azure/setup-helm from 3.4 to 3.5 by [@dependabot](https://github.com/dependabot)\[bot] in [#6222](https://github.com/external-secrets/external-secrets/pull/6222) - chore(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6223](https://github.com/external-secrets/external-secrets/pull/6223) - chore(deps): bump golang from `c2a1f7b` to `f853308` by [@dependabot](https://github.com/dependabot)\[bot] in [#6252](https://github.com/external-secrets/external-secrets/pull/6252) - chore(deps): bump alpine from 3.23.3 to 3.23.4 in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#6261](https://github.com/external-secrets/external-secrets/pull/6261) - chore(deps): bump step-security/harden-runner from 2.17.0 to 2.19.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6254](https://github.com/external-secrets/external-secrets/pull/6254) - chore(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#6257](https://github.com/external-secrets/external-secrets/pull/6257) - chore(deps): bump actions/cache from 5.0.4 to 5.0.5 by [@dependabot](https://github.com/dependabot)\[bot] in [#6259](https://github.com/external-secrets/external-secrets/pull/6259) - chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6255](https://github.com/external-secrets/external-secrets/pull/6255) - chore(deps): bump packaging from 26.0 to 26.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6263](https://github.com/external-secrets/external-secrets/pull/6263) - chore(deps): bump zipp from 3.23.0 to 3.23.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6262](https://github.com/external-secrets/external-secrets/pull/6262) - chore(deps): bump alpine from `2510918` to `5b10f43` by [@dependabot](https://github.com/dependabot)\[bot] in [#6251](https://github.com/external-secrets/external-secrets/pull/6251) - chore(deps): bump ubi9/ubi from `039095f` to `cf13fe2` by [@dependabot](https://github.com/dependabot)\[bot] in [#6253](https://github.com/external-secrets/external-secrets/pull/6253) - chore(deps): bump dependabot/fetch-metadata from 3.0.0 to 3.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6260](https://github.com/external-secrets/external-secrets/pull/6260) - chore(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6256](https://github.com/external-secrets/external-secrets/pull/6256) #### New Contributors - [@alliasgher](https://github.com/alliasgher) made their first contribution in [#6212](https://github.com/external-secrets/external-secrets/pull/6212) - [@tiberiuv](https://github.com/tiberiuv) made their first contribution in [#6163](https://github.com/external-secrets/external-secrets/pull/6163) - [@cinpol](https://github.com/cinpol) made their first contribution in [#6210](https://github.com/external-secrets/external-secrets/pull/6210) - [@ryanjwong](https://github.com/ryanjwong) made their first contribution in [#6247](https://github.com/external-secrets/external-secrets/pull/6247) - [@alikdolg](https://github.com/alikdolg) made their first contribution in [#6248](https://github.com/external-secrets/external-secrets/pull/6248) - [@antonio-mazzini](https://github.com/antonio-mazzini) made their first contribution in [#6266](https://github.com/external-secrets/external-secrets/pull/6266) - [@mattcarp12](https://github.com/mattcarp12) made their first contribution in [#6148](https://github.com/external-secrets/external-secrets/pull/6148) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.3.0...v2.4.0> ### [`v2.3.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.3.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.2.0...v2.3.0) Image: `ghcr.io/external-secrets/external-secrets:v2.3.0` Image: `ghcr.io/external-secrets/external-secrets:v2.3.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.3.0-ubi-boringssl`  #### What's Changed ##### General - chore: release charts v2.2.0 by [@riccardomc](https://github.com/riccardomc) in [#6115](https://github.com/external-secrets/external-secrets/pull/6115) - ref(modernize): modernize go code by [@ivankatliarchuk](https://github.com/ivankatliarchuk) in [#6114](https://github.com/external-secrets/external-secrets/pull/6114) - chore: bump bitwarden helm chart version to v0.6.0 by [@Skarlso](https://github.com/Skarlso) in [#6118](https://github.com/external-secrets/external-secrets/pull/6118) - chore: fix EoL in compatiblity table for version 2.2 by [@riccardomc](https://github.com/riccardomc) in [#6128](https://github.com/external-secrets/external-secrets/pull/6128) - docs: add missing jinja2 tags by [@MindTooth](https://github.com/MindTooth) in [#6136](https://github.com/external-secrets/external-secrets/pull/6136) - fix: cached uid after deleting a store by [@Skarlso](https://github.com/Skarlso) in [#6138](https://github.com/external-secrets/external-secrets/pull/6138) - feat(doppler): add ETag-based caching by [@mikesellitto](https://github.com/mikesellitto) in [#5997](https://github.com/external-secrets/external-secrets/pull/5997) - fix(docs): fix metadata structure in Google Secrets Manager docs by [@mruoss](https://github.com/mruoss) in [#6139](https://github.com/external-secrets/external-secrets/pull/6139) - feat: ovh provider implementation by [@ldesauw](https://github.com/ldesauw) in [#6101](https://github.com/external-secrets/external-secrets/pull/6101) - feat(providers): Implement PushSecret for Delinea Secret Server by [@pr0ton11](https://github.com/pr0ton11) in [#6031](https://github.com/external-secrets/external-secrets/pull/6031) - fix: propagate objectMeta and ownerReferences to target resources by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6132](https://github.com/external-secrets/external-secrets/pull/6132) - fix(release): remove docs.check and all relative calls by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6146](https://github.com/external-secrets/external-secrets/pull/6146) - feat: support service account impersonation when using Workload Identity Federation with a k8s service account by [@zoomoid](https://github.com/zoomoid) in [#5707](https://github.com/external-secrets/external-secrets/pull/5707) - fix: remove getHostByName from template funcs by [@moolen](https://github.com/moolen) in [#6164](https://github.com/external-secrets/external-secrets/pull/6164) - ref(kubernetes): move auth package from kubernetes to esutils by [@alekc](https://github.com/alekc) in [#6149](https://github.com/external-secrets/external-secrets/pull/6149) - docs: fix templating.md by [@dangbert](https://github.com/dangbert) in [#6168](https://github.com/external-secrets/external-secrets/pull/6168) - fix(onepasswordsdk): support native 1Password item IDs in findItem by [@LeahArmstrong](https://github.com/LeahArmstrong) in [#6167](https://github.com/external-secrets/external-secrets/pull/6167) - docs(ovhcloud): fix heterogeneous configuration documentation by [@ldesauw](https://github.com/ldesauw) in [#6169](https://github.com/external-secrets/external-secrets/pull/6169) - docs: add OVHcloud in ADOPTERS by [@scraly](https://github.com/scraly) in [#6172](https://github.com/external-secrets/external-secrets/pull/6172) - fix(docs): resolve macro syntax error in templating guide by [@ManvithaP-hub](https://github.com/ManvithaP-hub) in [#6171](https://github.com/external-secrets/external-secrets/pull/6171) - chore: rip out sprig dependency by [@Skarlso](https://github.com/Skarlso) in [#6170](https://github.com/external-secrets/external-secrets/pull/6170) - chore: fix jose cve by [@Skarlso](https://github.com/Skarlso) in [#6178](https://github.com/external-secrets/external-secrets/pull/6178) - docs: document correct htpasswd function usage by [@Atomsoldat](https://github.com/Atomsoldat) in [#6177](https://github.com/external-secrets/external-secrets/pull/6177) - feat(pushsecret): add dataTo support for bulk secret pushing by [@mohamed-rekiba](https://github.com/mohamed-rekiba) in [#5850](https://github.com/external-secrets/external-secrets/pull/5850) - docs: add existing blog post: ESO integration with ovhcloud secret manager with vault provider by [@scraly](https://github.com/scraly) in [#6190](https://github.com/external-secrets/external-secrets/pull/6190) - feat: move experimental-enable-vault-token-cache out of experimental and add expiry to validation by [@sfotony](https://github.com/sfotony) in [#5397](https://github.com/external-secrets/external-secrets/pull/5397) - fix: prevent feedback loop by [@moolen](https://github.com/moolen) in [#6021](https://github.com/external-secrets/external-secrets/pull/6021) - fix: code scanning issues by [@Skarlso](https://github.com/Skarlso) in [#6063](https://github.com/external-secrets/external-secrets/pull/6063) - feat: add source null byte policy by [@knelasevero](https://github.com/knelasevero) in [#6194](https://github.com/external-secrets/external-secrets/pull/6194) - fix(test): fix broken test from automerge rebase by [@knelasevero](https://github.com/knelasevero) in [#6199](https://github.com/external-secrets/external-secrets/pull/6199) - fix(aws): handle empty resource policy in PushSecret for SecretsManager by [@maks3201](https://github.com/maks3201) in [#6145](https://github.com/external-secrets/external-secrets/pull/6145) - feat(github): add orgSecretVisibility field to GithubProvider by [@iamnoah](https://github.com/iamnoah) in [#6202](https://github.com/external-secrets/external-secrets/pull/6202) - feat(onepasswordSDK): multi-field and complete PushSecret by [@Dariusch](https://github.com/Dariusch) in [#6187](https://github.com/external-secrets/external-secrets/pull/6187) - feat(vault): add VaultRole attribute for TLS auth by [@RicoGunawan12](https://github.com/RicoGunawan12) in [#6160](https://github.com/external-secrets/external-secrets/pull/6160) - chore: bump go version to 1.26.2 by [@Skarlso](https://github.com/Skarlso) in [#6203](https://github.com/external-secrets/external-secrets/pull/6203) ##### Dependencies - chore(deps): bump actions/cache from 5.0.3 to 5.0.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#6121](https://github.com/external-secrets/external-secrets/pull/6121) - chore(deps): bump mkdocs-material from 9.7.5 to 9.7.6 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6125](https://github.com/external-secrets/external-secrets/pull/6125) - chore(deps): bump ubi9/ubi from `6ed9f6f` to `1fc04e8` by [@dependabot](https://github.com/dependabot)\[bot] in [#6119](https://github.com/external-secrets/external-secrets/pull/6119) - chore(deps): bump azure/login from 2.3.0 to 3.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6120](https://github.com/external-secrets/external-secrets/pull/6120) - chore(deps): bump codecov/codecov-action from 5.5.2 to 5.5.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#6124](https://github.com/external-secrets/external-secrets/pull/6124) - chore(deps): bump github/codeql-action from 4.32.6 to 4.34.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6122](https://github.com/external-secrets/external-secrets/pull/6122) - chore(deps): bump anchore/sbom-action from 0.23.1 to 0.24.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6123](https://github.com/external-secrets/external-secrets/pull/6123) - chore(deps): bump importlib-metadata from 8.7.1 to 9.0.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6126](https://github.com/external-secrets/external-secrets/pull/6126) - chore(deps): bump sigstore/cosign-installer from 4.1.0 to 4.1.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6154](https://github.com/external-secrets/external-secrets/pull/6154) - chore(deps): bump pymdown-extensions from 10.21 to 10.21.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6157](https://github.com/external-secrets/external-secrets/pull/6157) - chore(deps): bump actions/setup-go from 6.3.0 to 6.4.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6151](https://github.com/external-secrets/external-secrets/pull/6151) - chore(deps): bump github/codeql-action from 4.34.1 to 4.35.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6152](https://github.com/external-secrets/external-secrets/pull/6152) - chore(deps): bump dependabot/fetch-metadata from 2.5.0 to 3.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6153](https://github.com/external-secrets/external-secrets/pull/6153) - chore(deps): bump pygments from 2.19.2 to 2.20.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6155](https://github.com/external-secrets/external-secrets/pull/6155) - chore(deps): bump regex from 2026.2.28 to 2026.3.32 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6156](https://github.com/external-secrets/external-secrets/pull/6156) - chore(deps): bump requests from 2.32.5 to 2.33.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6158](https://github.com/external-secrets/external-secrets/pull/6158) - chore(deps): bump ubi9/ubi from `1fc04e8` to `9e6e193` by [@dependabot](https://github.com/dependabot)\[bot] in [#6150](https://github.com/external-secrets/external-secrets/pull/6150) - chore(deps): bump step-security/harden-runner from 2.16.0 to 2.16.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6180](https://github.com/external-secrets/external-secrets/pull/6180) - chore(deps): bump charset-normalizer from 3.4.6 to 3.4.7 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6183](https://github.com/external-secrets/external-secrets/pull/6183) - chore(deps): bump click from 8.3.1 to 8.3.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6185](https://github.com/external-secrets/external-secrets/pull/6185) - chore(deps): bump fossas/fossa-action from 1.8.0 to 1.9.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6181](https://github.com/external-secrets/external-secrets/pull/6181) - chore(deps): bump docker/login-action from 4.0.0 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6182](https://github.com/external-secrets/external-secrets/pull/6182) - chore(deps): bump regex from 2026.3.32 to 2026.4.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6184](https://github.com/external-secrets/external-secrets/pull/6184) #### New Contributors - [@MindTooth](https://github.com/MindTooth) made their first contribution in [#6136](https://github.com/external-secrets/external-secrets/pull/6136) - [@ldesauw](https://github.com/ldesauw) made their first contribution in [#6101](https://github.com/external-secrets/external-secrets/pull/6101) - [@pr0ton11](https://github.com/pr0ton11) made their first contribution in [#6031](https://github.com/external-secrets/external-secrets/pull/6031) - [@zoomoid](https://github.com/zoomoid) made their first contribution in [#5707](https://github.com/external-secrets/external-secrets/pull/5707) - [@dangbert](https://github.com/dangbert) made their first contribution in [#6168](https://github.com/external-secrets/external-secrets/pull/6168) - [@LeahArmstrong](https://github.com/LeahArmstrong) made their first contribution in [#6167](https://github.com/external-secrets/external-secrets/pull/6167) - [@scraly](https://github.com/scraly) made their first contribution in [#6172](https://github.com/external-secrets/external-secrets/pull/6172) - [@ManvithaP-hub](https://github.com/ManvithaP-hub) made their first contribution in [#6171](https://github.com/external-secrets/external-secrets/pull/6171) - [@Atomsoldat](https://github.com/Atomsoldat) made their first contribution in [#6177](https://github.com/external-secrets/external-secrets/pull/6177) - [@mohamed-rekiba](https://github.com/mohamed-rekiba) made their first contribution in [#5850](https://github.com/external-secrets/external-secrets/pull/5850) - [@sfotony](https://github.com/sfotony) made their first contribution in [#5397](https://github.com/external-secrets/external-secrets/pull/5397) - [@maks3201](https://github.com/maks3201) made their first contribution in [#6145](https://github.com/external-secrets/external-secrets/pull/6145) - [@iamnoah](https://github.com/iamnoah) made their first contribution in [#6202](https://github.com/external-secrets/external-secrets/pull/6202) - [@RicoGunawan12](https://github.com/RicoGunawan12) made their first contribution in [#6160](https://github.com/external-secrets/external-secrets/pull/6160) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.2.0...v2.3.0> ### [`v2.2.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.2.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.1.0...v2.2.0) Image: `ghcr.io/external-secrets/external-secrets:v2.2.0` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi-boringssl` ### Breaking change If you are using Flux + OCIRepository to fetch External Secrets Operator charts, please update your object to use a Layer selector: ```yaml apiVersion: source.toolkit.fluxcd.io/v1 kind: OCIRepository metadata: name: eso-oci spec: interval: 1m0s provider: generic ref: tag: 2.2.0 url: oci://ghcr.io/external-secrets/charts/external-secrets layerSelector: mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip" operation: extract ```  #### What's Changed ##### General - chore: release charts v2.1.0 by [@Skarlso](https://github.com/Skarlso) in [#6030](https://github.com/external-secrets/external-secrets/pull/6030) - chore: fix the stability doc by [@Skarlso](https://github.com/Skarlso) in [#6035](https://github.com/external-secrets/external-secrets/pull/6035) - fix(security): Fix vulnerabilities by [@othomann](https://github.com/othomann) in [#6052](https://github.com/external-secrets/external-secrets/pull/6052) - fix(aws): sync tags and resource policy even when secret value unchanged by [@evs-secops](https://github.com/evs-secops) in [#6025](https://github.com/external-secrets/external-secrets/pull/6025) - fix: publish now uses docker build v4 which required some changes by [@Skarlso](https://github.com/Skarlso) in [#6062](https://github.com/external-secrets/external-secrets/pull/6062) - feat(gcpsm): auto-detect projectID from GCP metadata server by [@patjlm](https://github.com/patjlm) in [#5922](https://github.com/external-secrets/external-secrets/pull/5922) - chore(templating): Remove years in license and their checks by [@evrardj-roche](https://github.com/evrardj-roche) in [#5955](https://github.com/external-secrets/external-secrets/pull/5955) - docs: Add Roche to official ADOPTERS by [@evrardj-roche](https://github.com/evrardj-roche) in [#6076](https://github.com/external-secrets/external-secrets/pull/6076) - feat: Add Last Sync column to ExternalSecret and PushSecret printers by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6068](https://github.com/external-secrets/external-secrets/pull/6068) - fix(onepassword): support native item IDs by [@chadxz](https://github.com/chadxz) in [#6073](https://github.com/external-secrets/external-secrets/pull/6073) - feat: extract LGTM processor to external JS file with tests by [@mateenali66](https://github.com/mateenali66) in [#6074](https://github.com/external-secrets/external-secrets/pull/6074) - feat: fail fast if LGTM label does not exist in repository by [@mateenali66](https://github.com/mateenali66) in [#6078](https://github.com/external-secrets/external-secrets/pull/6078) - feat(passbolt): add support for Passbolt V5 API by [@cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) in [#5919](https://github.com/external-secrets/external-secrets/pull/5919) - fix(infisical): dataFrom.find.path should filter by secret path not name by [@johnvox](https://github.com/johnvox) in [#6086](https://github.com/external-secrets/external-secrets/pull/6086) - fix: disable the priority queue which misbehaves at scale by [@Skarlso](https://github.com/Skarlso) in [#6083](https://github.com/external-secrets/external-secrets/pull/6083) - chore: update go version to 1.26.1 by [@Skarlso](https://github.com/Skarlso) in [#6072](https://github.com/external-secrets/external-secrets/pull/6072) - docs(aws): fix PushSecret metadata indentation in resource policy exa... by [@Br1an67](https://github.com/Br1an67) in [#6056](https://github.com/external-secrets/external-secrets/pull/6056) - fix(aws): prevent EC2 IMDS fallback when explicit credentials are pro... by [@Br1an67](https://github.com/Br1an67) in [#6036](https://github.com/external-secrets/external-secrets/pull/6036) - feat(templating): Add certSANs function to extract SANs from certificates by [@mzdeb](https://github.com/mzdeb) in [#6058](https://github.com/external-secrets/external-secrets/pull/6058) - docs: document template.metadata labels/annotations behavior by [@lucpas](https://github.com/lucpas) in [#6102](https://github.com/external-secrets/external-secrets/pull/6102) - fix: CODEOWNERS are seriously out of date by [@Skarlso](https://github.com/Skarlso) in [#6106](https://github.com/external-secrets/external-secrets/pull/6106) - feat(helm): add readinessProbe support for external-secrets deployment by [@AlexOQ](https://github.com/AlexOQ) in [#5831](https://github.com/external-secrets/external-secrets/pull/5831) - fix: update grpc for CVE-2026-33186 by [@Skarlso](https://github.com/Skarlso) in [#6108](https://github.com/external-secrets/external-secrets/pull/6108) - feat(azurekv): add expiration time to azure kv secret by [@muraliavarma](https://github.com/muraliavarma) in [#5935](https://github.com/external-secrets/external-secrets/pull/5935) - feat: add path to cloud.ru provider by [@heavyandrew](https://github.com/heavyandrew) in [#5952](https://github.com/external-secrets/external-secrets/pull/5952) - fix(add-eso-version): fix separator line pattern in add\_eso\_version.sh script by [@riccardomc](https://github.com/riccardomc) in [#6113](https://github.com/external-secrets/external-secrets/pull/6113) ##### Dependencies - chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6038](https://github.com/external-secrets/external-secrets/pull/6038) - chore(deps): bump charset-normalizer from 3.4.4 to 3.4.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6047](https://github.com/external-secrets/external-secrets/pull/6047) - chore(deps): bump platformdirs from 4.9.2 to 4.9.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6050](https://github.com/external-secrets/external-secrets/pull/6050) - chore(deps): bump mkdocs-material from 9.7.3 to 9.7.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6049](https://github.com/external-secrets/external-secrets/pull/6049) - chore(deps): bump github/codeql-action from 4.32.4 to 4.32.6 by [@dependabot](https://github.com/dependabot)\[bot] in [#6039](https://github.com/external-secrets/external-secrets/pull/6039) - chore(deps): bump step-security/harden-runner from 2.15.0 to 2.15.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6043](https://github.com/external-secrets/external-secrets/pull/6043) - chore(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6040](https://github.com/external-secrets/external-secrets/pull/6040) - chore(deps): bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6044](https://github.com/external-secrets/external-secrets/pull/6044) - chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6042](https://github.com/external-secrets/external-secrets/pull/6042) - chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6041](https://github.com/external-secrets/external-secrets/pull/6041) - chore(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6046](https://github.com/external-secrets/external-secrets/pull/6046) - chore(deps): bump aquasecurity/trivy-action from 0.34.1 to 0.35.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6048](https://github.com/external-secrets/external-secrets/pull/6048) - chore(deps): bump anchore/sbom-action from 0.23.0 to 0.23.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6093](https://github.com/external-secrets/external-secrets/pull/6093) - chore(deps): bump distroless/static from `28efbe9` to `47b2d72` by [@dependabot](https://github.com/dependabot)\[bot] in [#6088](https://github.com/external-secrets/external-secrets/pull/6088) - chore(deps): bump ubi9/ubi from `cecb1cd` to `6ed9f6f` by [@dependabot](https://github.com/dependabot)\[bot] in [#6087](https://github.com/external-secrets/external-secrets/pull/6087) - chore(deps): bump mkdocs-material from 9.7.4 to 9.7.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6096](https://github.com/external-secrets/external-secrets/pull/6096) - chore(deps): bump tornado from 6.5.4 to 6.5.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6094](https://github.com/external-secrets/external-secrets/pull/6094) - chore(deps): bump charset-normalizer from 3.4.5 to 3.4.6 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6095](https://github.com/external-secrets/external-secrets/pull/6095) - chore(deps): bump step-security/harden-runner from 2.15.1 to 2.16.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6089](https://github.com/external-secrets/external-secrets/pull/6089) - chore(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6092](https://github.com/external-secrets/external-secrets/pull/6092) - chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6090](https://github.com/external-secrets/external-secrets/pull/6090) - chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6091](https://github.com/external-secrets/external-secrets/pull/6091) #### New Contributors - [@othomann](https://github.com/othomann) made their first contribution in [#6052](https://github.com/external-secrets/external-secrets/pull/6052) - [@evs-secops](https://github.com/evs-secops) made their first contribution in [#6025](https://github.com/external-secrets/external-secrets/pull/6025) - [@patjlm](https://github.com/patjlm) made their first contribution in [#5922](https://github.com/external-secrets/external-secrets/pull/5922) - [@jaruwat-panturat](https://github.com/jaruwat-panturat) made their first contribution in [#6068](https://github.com/external-secrets/external-secrets/pull/6068) - [@chadxz](https://github.com/chadxz) made their first contribution in [#6073](https://github.com/external-secrets/external-secrets/pull/6073) - [@mateenali66](https://github.com/mateenali66) made their first contribution in [#6074](https://github.com/external-secrets/external-secrets/pull/6074) - [@cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) made their first contribution in [#5919](https://github.com/external-secrets/external-secrets/pull/5919) - [@johnvox](https://github.com/johnvox) made their first contribution in [#6086](https://github.com/external-secrets/external-secrets/pull/6086) - [@Br1an67](https://github.com/Br1an67) made their first contribution in [#6056](https://github.com/external-secrets/external-secrets/pull/6056) - [@mzdeb](https://github.com/mzdeb) made their first contribution in [#6058](https://github.com/external-secrets/external-secrets/pull/6058) - [@lucpas](https://github.com/lucpas) made their first contribution in [#6102](https://github.com/external-secrets/external-secrets/pull/6102) - [@AlexOQ](https://github.com/AlexOQ) made their first contribution in [#5831](https://github.com/external-secrets/external-secrets/pull/5831) - [@muraliavarma](https://github.com/muraliavarma) made their first contribution in [#5935](https://github.com/external-secrets/external-secrets/pull/5935) - [@heavyandrew](https://github.com/heavyandrew) made their first contribution in [#5952](https://github.com/external-secrets/external-secrets/pull/5952) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.1.0...v2.2.0> ### [`v2.1.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.1.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.0.1...v2.1.0) Image: `ghcr.io/external-secrets/external-secrets:v2.1.0` Image: `ghcr.io/external-secrets/external-secrets:v2.1.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.1.0-ubi-boringssl`  #### What's Changed ##### General - chore(release): Update helm chart by [@evrardj-roche](https://github.com/evrardj-roche) in [#5981](https://github.com/external-secrets/external-secrets/pull/5981) - fix: cosign verify does not use signing config by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5982](https://github.com/external-secrets/external-secrets/pull/5982) - docs: Update release process by [@evrardj-roche](https://github.com/evrardj-roche) in [#5980](https://github.com/external-secrets/external-secrets/pull/5980) - fix: allow cross-namespace push with ClusterSecretStore objects by [@Skarlso](https://github.com/Skarlso) in [#5998](https://github.com/external-secrets/external-secrets/pull/5998) - feat(charts): add new flag enable leader for cert-manager by [@nutmos](https://github.com/nutmos) in [#5863](https://github.com/external-secrets/external-secrets/pull/5863) - feat(kubernetes): fall back to system CA roots when no CA is configured by [@rajsinghtech](https://github.com/rajsinghtech) in [#5961](https://github.com/external-secrets/external-secrets/pull/5961) - feat: dedup sbom but keep it monolithic by [@moolen](https://github.com/moolen) in [#6004](https://github.com/external-secrets/external-secrets/pull/6004) - fix: add missing metrics and fundamentally fix the caching logic by [@Skarlso](https://github.com/Skarlso) in [#5894](https://github.com/external-secrets/external-secrets/pull/5894) - docs: designate Oracle Vault provider as 'stable' by [@anders-swanson](https://github.com/anders-swanson) in [#6020](https://github.com/external-secrets/external-secrets/pull/6020) - docs: Oracle Vault provider capabilities by [@anders-swanson](https://github.com/anders-swanson) in [#6023](https://github.com/external-secrets/external-secrets/pull/6023) - docs(azurekv): cert-manager pushsecret example and cleanups by [@illrill](https://github.com/illrill) in [#5972](https://github.com/external-secrets/external-secrets/pull/5972) - feat(kubernetes): implement SecretExists by [@Saku2](https://github.com/Saku2) in [#5973](https://github.com/external-secrets/external-secrets/pull/5973) - fix(charts): Fix wrongly set annotations for cert-controller metrics service by [@josemaia](https://github.com/josemaia) in [#6029](https://github.com/external-secrets/external-secrets/pull/6029) - feat(providers): Nebius MysteryBox integration by [@greenmapc](https://github.com/greenmapc) in [#5868](https://github.com/external-secrets/external-secrets/pull/5868) ##### Dependencies - chore(deps): bump aquasecurity/trivy-action from 0.34.0 to 0.34.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5986](https://github.com/external-secrets/external-secrets/pull/5986) - chore(deps): bump mkdocs-material from 9.7.1 to 9.7.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5992](https://github.com/external-secrets/external-secrets/pull/5992) - chore(deps): bump ubi9/ubi from `b8923f5` to `cecb1cd` by [@dependabot](https://github.com/dependabot)\[bot] in [#5984](https://github.com/external-secrets/external-secrets/pull/5984) - chore(deps): bump helm/kind-action from 1.13.0 to 1.14.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5985](https://github.com/external-secrets/external-secrets/pull/5985) - chore(deps): bump actions/dependency-review-action from 4.8.2 to 4.8.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5990](https://github.com/external-secrets/external-secrets/pull/5990) - chore(deps): bump github/codeql-action from 4.32.3 to 4.32.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#5989](https://github.com/external-secrets/external-secrets/pull/5989) - chore(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5987](https://github.com/external-secrets/external-secrets/pull/5987) - chore(deps): bump regex from 2026.1.15 to 2026.2.19 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5991](https://github.com/external-secrets/external-secrets/pull/5991) - chore(deps): bump actions/stale from 10.1.1 to 10.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5988](https://github.com/external-secrets/external-secrets/pull/5988) - chore(deps): bump regex from 2026.2.19 to 2026.2.28 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6012](https://github.com/external-secrets/external-secrets/pull/6012) - chore(deps): bump mkdocs-material from 9.7.2 to 9.7.3 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6014](https://github.com/external-secrets/external-secrets/pull/6014) - chore(deps): bump step-security/harden-runner from 2.14.2 to 2.15.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6015](https://github.com/external-secrets/external-secrets/pull/6015) - chore(deps): bump anchore/sbom-action from 0.22.2 to 0.23.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6016](https://github.com/external-secrets/external-secrets/pull/6016) - chore(deps): bump certifi from 2026.1.4 to 2026.2.25 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6013](https://github.com/external-secrets/external-secrets/pull/6013) - chore(deps): bump actions/setup-go from 6.2.0 to 6.3.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6010](https://github.com/external-secrets/external-secrets/pull/6010) - chore(deps): bump hashicorp/setup-terraform from [`ce70bcf`](https://github.com/external-secrets/external-secrets/commit/ce70bcf31a3711a1efd50b61e7216b0196b6f4f1) to [`5e8dbf3`](https://github.com/external-secrets/external-secrets/commit/5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85) by [@dependabot](https://github.com/dependabot)\[bot] in [#6011](https://github.com/external-secrets/external-secrets/pull/6011) - chore(deps): bump actions/attest-build-provenance from 3.2.0 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6009](https://github.com/external-secrets/external-secrets/pull/6009) - chore(deps): bump distroless/static from `972618c` to `28efbe9` by [@dependabot](https://github.com/dependabot)\[bot] in [#6008](https://github.com/external-secrets/external-secrets/pull/6008) #### New Contributors - [@nutmos](https://github.com/nutmos) made their first contribution in [#5863](https://github.com/external-secrets/external-secrets/pull/5863) - [@rajsinghtech](https://github.com/rajsinghtech) made their first contribution in [#5961](https://github.com/external-secrets/external-secrets/pull/5961) - [@illrill](https://github.com/illrill) made their first contribution in [#5972](https://github.com/external-secrets/external-secrets/pull/5972) - [@Saku2](https://github.com/Saku2) made their first contribution in [#5973](https://github.com/external-secrets/external-secrets/pull/5973) - [@greenmapc](https://github.com/greenmapc) made their first contribution in [#5868](https://github.com/external-secrets/external-secrets/pull/5868) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.0.1...v2.1.0> ### [`v2.0.1`](https://github.com/external-secrets/external-secrets/releases/tag/v2.0.1) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v2.0.0...v2.0.1) Image: `ghcr.io/external-secrets/external-secrets:v2.0.1` Image: `ghcr.io/external-secrets/external-secrets:v2.0.1-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.0.1-ubi-boringssl` ### BREAKING CHANGE The sprig update is actually a breaking change. It turns out that some of the functions in templating changed with this update. Looks like it's just the `htpasswd` function that was renamed.  #### What's Changed ##### General - chore: release helm chart for v2.0.0 by [@Skarlso](https://github.com/Skarlso) in [#5932](https://github.com/external-secrets/external-secrets/pull/5932) - docs: update the stability doc with the new version by [@Skarlso](https://github.com/Skarlso) in [#5933](https://github.com/external-secrets/external-secrets/pull/5933) - chore(doc): add loblaw to adopter md by [@FZhg](https://github.com/FZhg) in [#5937](https://github.com/external-secrets/external-secrets/pull/5937) - chore: bump golang to 1.25.7 because of cve by [@Skarlso](https://github.com/Skarlso) in [#5938](https://github.com/external-secrets/external-secrets/pull/5938) - fix: deleting the whole secret when it is empty by [@Skarlso](https://github.com/Skarlso) in [#5927](https://github.com/external-secrets/external-secrets/pull/5927) - chore: update controller runtime by [@Skarlso](https://github.com/Skarlso) in [#5930](https://github.com/external-secrets/external-secrets/pull/5930) - fix: update cosign and syft for signing by [@Skarlso](https://github.com/Skarlso) in [#5958](https://github.com/external-secrets/external-secrets/pull/5958) - fix: the informer can not register use GetInformer instead by [@Skarlso](https://github.com/Skarlso) in [#5931](https://github.com/external-secrets/external-secrets/pull/5931) - fix: attempt to fix cosign compatibility issues by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5959](https://github.com/external-secrets/external-secrets/pull/5959) - chore: remove outdated info from stability doc by [@Skarlso](https://github.com/Skarlso) in [#5971](https://github.com/external-secrets/external-secrets/pull/5971) - chore(deps): update Masterminds/sprig to [`8cb06fe`](https://github.com/external-secrets/external-secrets/commit/8cb06fe3c8b0f1163c26b0a55866)… by [@tete17](https://github.com/tete17) in [#5747](https://github.com/external-secrets/external-secrets/pull/5747) - docs(release): Update support matrix by [@evrardjp](https://github.com/evrardjp) in [#5978](https://github.com/external-secrets/external-secrets/pull/5978) ##### Dependencies - chore(deps): bump golang from `20c8a94` to `f6751d8` by [@dependabot](https://github.com/dependabot)\[bot] in [#5940](https://github.com/external-secrets/external-secrets/pull/5940) - chore(deps): bump ubi9/ubi from `c8df11b` to `b8923f5` by [@dependabot](https://github.com/dependabot)\[bot] in [#5939](https://github.com/external-secrets/external-secrets/pull/5939) - chore(deps): bump distroless/static from `cd64bec` to `972618c` by [@dependabot](https://github.com/dependabot)\[bot] in [#5941](https://github.com/external-secrets/external-secrets/pull/5941) - chore(deps): bump github/codeql-action from 4.32.0 to 4.32.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5942](https://github.com/external-secrets/external-secrets/pull/5942) - chore(deps): bump anchore/sbom-action from 0.22.1 to 0.22.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5943](https://github.com/external-secrets/external-secrets/pull/5943) - chore(deps): bump step-security/harden-runner from 2.14.1 to 2.14.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5944](https://github.com/external-secrets/external-secrets/pull/5944) - chore(deps): bump zizmorcore/zizmor-action from 0.4.1 to 0.5.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5945](https://github.com/external-secrets/external-secrets/pull/5945) - chore(deps): bump fossas/fossa-action from 1.7.0 to 1.8.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5946](https://github.com/external-secrets/external-secrets/pull/5946) - chore(deps): bump aws-actions/configure-aws-credentials from 5.1.1 to 6.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5947](https://github.com/external-secrets/external-secrets/pull/5947) - chore(deps): bump github/codeql-action from 4.32.2 to 4.32.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5965](https://github.com/external-secrets/external-secrets/pull/5965) - chore(deps): bump markdown from 3.10.1 to 3.10.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5968](https://github.com/external-secrets/external-secrets/pull/5968) - chore(deps): bump aquasecurity/trivy-action from 0.33.1 to 0.34.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5964](https://github.com/external-secrets/external-secrets/pull/5964) - chore(deps): bump platformdirs from 4.5.1 to 4.9.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5967](https://github.com/external-secrets/external-secrets/pull/5967) - chore(deps): bump pymdown-extensions from 10.20.1 to 10.21 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5969](https://github.com/external-secrets/external-secrets/pull/5969) #### New Contributors - [@FZhg](https://github.com/FZhg) made their first contribution in [#5937](https://github.com/external-secrets/external-secrets/pull/5937) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v2.0.0...v2.0.1> ### [`v2.0.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.0.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v1.3.2...v2.0.0) ### BREAKING CHANGE Please note that this release removed two of the unsupported and unmaintained providers Alibaba and Device42. Image: `ghcr.io/external-secrets/external-secrets:v2.0.0` Image: `ghcr.io/external-secrets/external-secrets:v2.0.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.0.0-ubi-boringssl`  #### What's Changed ##### General - chore: bump charts to 1.3.2 by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5923](https://github.com/external-secrets/external-secrets/pull/5923) - feat(charts): add hostAliases support by [@janlauber](https://github.com/janlauber) in [#5866](https://github.com/external-secrets/external-secrets/pull/5866) - chore: remove unmaintained secret stores by [@Skarlso](https://github.com/Skarlso) in [#5918](https://github.com/external-secrets/external-secrets/pull/5918) - docs(infisical): document al provider auth methods by [@varonix0](https://github.com/varonix0) in [#5929](https://github.com/external-secrets/external-secrets/pull/5929) - chore: Get validating webhook failurePolicy for Secretstore dynamically by [@LochanRn](https://github.com/LochanRn) in [#5605](https://github.com/external-secrets/external-secrets/pull/5605) #### New Contributors - [@LochanRn](https://github.com/LochanRn) made their first contribution in [#5605](https://github.com/external-secrets/external-secrets/pull/5605) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v1.3.2...v2.0.0> ### [`v1.3.2`](https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v1.3.1...v1.3.2) Image: `ghcr.io/external-secrets/external-secrets:v1.3.2` Image: `ghcr.io/external-secrets/external-secrets:v1.3.2-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.3.2-ubi-boringssl`  #### What's Changed ##### General - chore: release helm chart for v1.3.1 by [@Skarlso](https://github.com/Skarlso) in [#5860](https://github.com/external-secrets/external-secrets/pull/5860) - chore(chart): Add missing tests for readinessProbe by [@jcpunk](https://github.com/jcpunk) in [#5769](https://github.com/external-secrets/external-secrets/pull/5769) - docs: Update FluxCD example by [@umizoom](https://github.com/umizoom) in [#5862](https://github.com/external-secrets/external-secrets/pull/5862) - fix(ci): Removed the unused check for Windows in Makefile by [@HauptJ](https://github.com/HauptJ) in [#5870](https://github.com/external-secrets/external-secrets/pull/5870) - docs(release): Add actual dates for EOL of 1.x releases in stability and support page by [@n4zukker](https://github.com/n4zukker) in [#5889](https://github.com/external-secrets/external-secrets/pull/5889) - docs: Passbolt provider maintenance ownership by [@stripthis](https://github.com/stripthis) in [#5886](https://github.com/external-secrets/external-secrets/pull/5886) - chore: Update Passbolt MaintenanceStatus to MaintenanceStatusMaintained by [@stripthis](https://github.com/stripthis) in [#5887](https://github.com/external-secrets/external-secrets/pull/5887) - fix(security): sanitize json.Unmarshal errors to prevent secret data … by [@moolen](https://github.com/moolen) in [#5884](https://github.com/external-secrets/external-secrets/pull/5884) - fix: webhook initialization order by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5901](https://github.com/external-secrets/external-secrets/pull/5901) - chore: Cleanup flags by [@evrardj-roche](https://github.com/evrardj-roche) in [#5845](https://github.com/external-secrets/external-secrets/pull/5845) - fix: onepasswordsdk shared tenant by altering the provider in the client cache by [@Skarlso](https://github.com/Skarlso) in [#5921](https://github.com/external-secrets/external-secrets/pull/5921) ##### Dependencies - chore(deps): bump github/codeql-action from 4.31.10 to 4.31.11 by [@dependabot](https://github.com/dependabot)\[bot] in [#5873](https://github.com/external-secrets/external-secrets/pull/5873) - chore(deps): bump pymdown-extensions from 10.20 to 10.20.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5877](https://github.com/external-secrets/external-secrets/pull/5877) - chore(deps): bump markdown from 3.10 to 3.10.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5880](https://github.com/external-secrets/external-secrets/pull/5880) - chore(deps): bump ubi9/ubi from `22e9573` to `1f84f5c` by [@dependabot](https://github.com/dependabot)\[bot] in [#5871](https://github.com/external-secrets/external-secrets/pull/5871) - chore(deps): bump actions/setup-python from 6.1.0 to 6.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5872](https://github.com/external-secrets/external-secrets/pull/5872) - chore(deps): bump hashicorp/setup-terraform from [`93d5a27`](https://github.com/external-secrets/external-secrets/commit/93d5a27adc7ac26085422db72568ae486f091042) to [`dcc3150`](https://github.com/external-secrets/external-secrets/commit/dcc3150f6037c0405dd84cb44d1d91ebbaa96514) by [@dependabot](https://github.com/dependabot)\[bot] in [#5875](https://github.com/external-secrets/external-secrets/pull/5875) - chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5876](https://github.com/external-secrets/external-secrets/pull/5876) - chore(deps): bump step-security/harden-runner from 2.14.0 to 2.14.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5878](https://github.com/external-secrets/external-secrets/pull/5878) - chore(deps): bump anchore/sbom-action from 0.21.1 to 0.22.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5874](https://github.com/external-secrets/external-secrets/pull/5874) - chore(deps): bump packaging from 25.0 to 26.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5879](https://github.com/external-secrets/external-secrets/pull/5879) - chore(deps): bump golang from `d9b2e14` to `98e6cff` by [@dependabot](https://github.com/dependabot)\[bot] in [#5907](https://github.com/external-secrets/external-secrets/pull/5907) - chore(deps): bump alpine from `865b95f` to `2510918` in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5914](https://github.com/external-secrets/external-secrets/pull/5914) - chore(deps): bump docker/login-action from 3.6.0 to 3.7.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5909](https://github.com/external-secrets/external-secrets/pull/5909) - chore(deps): bump actions/cache from 5.0.2 to 5.0.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5912](https://github.com/external-secrets/external-secrets/pull/5912) - chore(deps): bump actions/attest-build-provenance from 3.1.0 to 3.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5910](https://github.com/external-secrets/external-secrets/pull/5910) - chore(deps): bump hashicorp/setup-terraform from [`dcc3150`](https://github.com/external-secrets/external-secrets/commit/dcc3150f6037c0405dd84cb44d1d91ebbaa96514) to [`ce70bcf`](https://github.com/external-secrets/external-secrets/commit/ce70bcf31a3711a1efd50b61e7216b0196b6f4f1) by [@dependabot](https://github.com/dependabot)\[bot] in [#5911](https://github.com/external-secrets/external-secrets/pull/5911) - chore(deps): bump ubi9/ubi from `1f84f5c` to `c8df11b` by [@dependabot](https://github.com/dependabot)\[bot] in [#5908](https://github.com/external-secrets/external-secrets/pull/5908) - chore(deps): bump alpine from 3.23.2 to 3.23.3 in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5915](https://github.com/external-secrets/external-secrets/pull/5915) - chore(deps): bump alpine from `865b95f` to `2510918` by [@dependabot](https://github.com/dependabot)\[bot] in [#5906](https://github.com/external-secrets/external-secrets/pull/5906) - chore(deps): bump pathspec from 1.0.3 to 1.0.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5916](https://github.com/external-secrets/external-secrets/pull/5916) - chore(deps): bump babel from 2.17.0 to 2.18.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5917](https://github.com/external-secrets/external-secrets/pull/5917) - chore(deps): bump github/codeql-action from 4.31.11 to 4.32.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5913](https://github.com/external-secrets/external-secrets/pull/5913) #### New Contributors - [@umizoom](https://github.com/umizoom) made their first contribution in [#5862](https://github.com/external-secrets/external-secrets/pull/5862) - [@HauptJ](https://github.com/HauptJ) made their first contribution in [#5870](https://github.com/external-secrets/external-secrets/pull/5870) - [@n4zukker](https://github.com/n4zukker) made their first contribution in [#5889](https://github.com/external-secrets/external-secrets/pull/5889) - [@stripthis](https://github.com/stripthis) made their first contribution in [#5886](https://github.com/external-secrets/external-secrets/pull/5886) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v1.3.1...v1.3.2> ### [`v1.3.1`](https://github.com/external-secrets/external-secrets/releases/tag/v1.3.1) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v1.2.1...v1.3.1) Image: `ghcr.io/external-secrets/external-secrets:v1.3.1` Image: `ghcr.io/external-secrets/external-secrets:v1.3.1-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.3.1-ubi-boringssl`  For a Full release please referre to <https://github.com/external-secrets/external-secrets/releases/tag/v1.3.0>. This is a fix build for the docker publish flow. #### What's Changed ##### General - fix: ignore the in-toto manifest when promoting the docker build by [@Skarlso](https://github.com/Skarlso) in [#5859](https://github.com/external-secrets/external-secrets/pull/5859) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v1.3.0...v1.3.1> ### [`v1.2.1`](https://github.com/external-secrets/external-secrets/releases/tag/v1.2.1) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v1.2.0...v1.2.1) Image: `ghcr.io/external-secrets/external-secrets:v1.2.1` Image: `ghcr.io/external-secrets/external-secrets:v1.2.1-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.2.1-ubi-boringssl`  #### What's Changed ##### General - chore(chart): release helm chart 1.2.0 by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5751](https://github.com/external-secrets/external-secrets/pull/5751) - fix: metrics not being correctly updated and deleted by [@Skarlso](https://github.com/Skarlso) in [#5714](https://github.com/external-secrets/external-secrets/pull/5714) - feat(infisical): add caBundle and caProvider support by [@wi-adam](https://github.com/wi-adam) in [#5770](https://github.com/external-secrets/external-secrets/pull/5770) - docs(apis): fix inaccurate SecretStore comments (v1 + v1beta1) by [@fallmo](https://github.com/fallmo) in [#5773](https://github.com/external-secrets/external-secrets/pull/5773) - fix: add missing link to the docs by [@Skarlso](https://github.com/Skarlso) in [#5783](https://github.com/external-secrets/external-secrets/pull/5783) - fix: for target template parsing for complex matchers by [@Skarlso](https://github.com/Skarlso) in [#5735](https://github.com/external-secrets/external-secrets/pull/5735) - fix: a lot of sonar issue fixes by [@Skarlso](https://github.com/Skarlso) in [#5771](https://github.com/external-secrets/external-secrets/pull/5771) ##### Dependencies - chore(deps): bump golang from `2611181` to `ac09a5f` by [@dependabot](https://github.com/dependabot)\[bot] in [#5758](https://github.com/external-secrets/external-secrets/pull/5758) - chore(deps): bump alpine from 3.23.0 to 3.23.2 in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5764](https://github.com/external-secrets/external-secrets/pull/5764) - chore(deps): bump importlib-metadata from 8.7.0 to 8.7.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5768](https://github.com/external-secrets/external-secrets/pull/5768) - chore(deps): bump tornado from 6.5.3 to 6.5.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5767](https://github.com/external-secrets/external-secrets/pull/5767) - chore(deps): bump mkdocs-material from 9.7.0 to 9.7.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5766](https://github.com/external-secrets/external-secrets/pull/5766) - chore(deps): bump alpine from `51183f2` to `865b95f` in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5765](https://github.com/external-secrets/external-secrets/pull/5765) - chore(deps): bump alpine from `51183f2` to `865b95f` by [@dependabot](https://github.com/dependabot)\[bot] in [#5756](https://github.com/external-secrets/external-secrets/pull/5756) - chore(deps): bump ubi9/ubi from `d4feb57` to `3816d30` by [@dependabot](https://github.com/dependabot)\[bot] in [#5757](https://github.com/external-secrets/external-secrets/pull/5757) - chore(deps): bump peter-evans/slash-command-dispatch from 5.0.1 to 5.0.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5763](https://github.com/external-secrets/external-secrets/pull/5763) - chore(deps): bump github/codeql-action from 4.31.8 to 4.31.9 by [@dependabot](https://github.com/dependabot)\[bot] in [#5762](https://github.com/external-secrets/external-secrets/pull/5762) - chore(deps): bump actions/attest-build-provenance from 3.0.0 to 3.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5761](https://github.com/external-secrets/external-secrets/pull/5761) - chore(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5760](https://github.com/external-secrets/external-secrets/pull/5760) - chore(deps): bump hashicorp/setup-terraform from [`071811a`](https://github.com/external-secrets/external-secrets/commit/071811a16241b026a69d0c8823fc3d7c54385db5) to [`92e4d08`](https://github.com/external-secrets/external-secrets/commit/92e4d08fe1d24283952afa28216efa8f4ed5aeab) by [@dependabot](https://github.com/dependabot)\[bot] in [#5759](https://github.com/external-secrets/external-secrets/pull/5759) - chore(deps): bump anchore/sbom-action from 0.20.11 to 0.21.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5784](https://github.com/external-secrets/external-secrets/pull/5784) #### New Contributors - [@wi-adam](https://github.com/wi-adam) made their first contribution in [#5770](https://github.com/external-secrets/external-secrets/pull/5770) - [@fallmo](https://github.com/fallmo) made their first contribution in [#5773](https://github.com/external-secrets/external-secrets/pull/5773) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v1.2.0...v1.2.1> ### [`v1.2.0`](https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v1.1.1...v1.2.0) Image: `ghcr.io/external-secrets/external-secrets:v1.2.0` Image: `ghcr.io/external-secrets/external-secrets:v1.2.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.2.0-ubi-boringssl`  #### What's Changed ##### General - chore: bump 1.1.1 by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5687](https://github.com/external-secrets/external-secrets/pull/5687) - chore: fix the argocd e2e test case by [@Skarlso](https://github.com/Skarlso) in [#5688](https://github.com/external-secrets/external-secrets/pull/5688) - feat(provider): add Barbican provider support by [@rkferreira](https://github.com/rkferreira) in [#5398](https://github.com/external-secrets/external-secrets/pull/5398) - docs(secretserver): promote secretserver provider to beta by [@DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#5668](https://github.com/external-secrets/external-secrets/pull/5668) - feat(controller): add flag to enable/disable secretstore reconcile by [@Ilhan-Personal](https://github.com/Ilhan-Personal) in [#5653](https://github.com/external-secrets/external-secrets/pull/5653) - fix(aws-secrets-manager): Apply filtering based on both name and tags if provided by [@iypetrov](https://github.com/iypetrov) in [#5685](https://github.com/external-secrets/external-secrets/pull/5685) - fix(gcpsm): SecretExists should check for regional secrets when store location is specified by [@tokiwong](https://github.com/tokiwong) in [#5708](https://github.com/external-secrets/external-secrets/pull/5708) - feat: introduce store deprecation by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5711](https://github.com/external-secrets/external-secrets/pull/5711) - feat(charts): add global values for common deployment configurations by [@Gabryel8818](https://github.com/Gabryel8818) in [#5652](https://github.com/external-secrets/external-secrets/pull/5652) - feat: add Doppler OIDC-based authentication by [@mikesellitto](https://github.com/mikesellitto) in [#5475](https://github.com/external-secrets/external-secrets/pull/5475) - fix: make custom configuration available regardless of environment by [@Skarlso](https://github.com/Skarlso) in [#5713](https://github.com/external-secrets/external-secrets/pull/5713) - chore(chart): update bitwarden dependency to v0.5.2 by [@Skarlso](https://github.com/Skarlso) in [#5719](https://github.com/external-secrets/external-secrets/pull/5719) - docs(templating): update rbac for generic targets by [@lostick](https://github.com/lostick) in [#5736](https://github.com/external-secrets/external-secrets/pull/5736) - fix(testing): Breaking changes should not break ci by [@evrardjp](https://github.com/evrardjp) in [#5739](https://github.com/external-secrets/external-secrets/pull/5739) - fix(security): Get rid of getSecretKey by [@evrardjp](https://github.com/evrardjp) in [#5738](https://github.com/external-secrets/external-secrets/pull/5738) - fix(aws): parse resource policies into canonical JSON (sorted) before comparing by [@cmoscofian](https://github.com/cmoscofian) in [#5622](https://github.com/external-secrets/external-secrets/pull/5622) - docs: Fix example in GCP documentation by [@headcr4sh](https://github.com/headcr4sh) in [#5745](https://github.com/external-secrets/external-secrets/pull/5745) - chore(secretserver): update dependencies to accept new DelineaXPM/tss-sdk-go by [@DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#5742](https://github.com/external-secrets/external-secrets/pull/5742) - fix(gcpsm): Improve SecretExists method in GCP secret manager provider by [@tosih](https://github.com/tosih) in [#5610](https://github.com/external-secrets/external-secrets/pull/5610) - chore(docs): add clarification to helm values being disabled by [@Skarlso](https://github.com/Skarlso) in [#5746](https://github.com/external-secrets/external-secrets/pull/5746) - fix(release): apply [`64dc681`](https://github.com/external-secrets/external-secrets/commit/64dc681c970ae57f2d1fc5d357eff5ccc57381e6) to release by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5749](https://github.com/external-secrets/external-secrets/pull/5749) - docs(release): 1.2 stability-support.md by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5750](https://github.com/external-secrets/external-secrets/pull/5750) ##### Dependencies - chore(deps): bump golang from 1.25.4 to 1.25.5 by [@dependabot](https://github.com/dependabot)\[bot] in [#5693](https://github.com/external-secrets/external-secrets/pull/5693) - chore(deps): bump golang from 1.25.4-bookworm to 1.25.5-bookworm in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5702](https://github.com/external-secrets/external-secrets/pull/5702) - chore(deps): bump ubi9/ubi from `dcd8128` to `75937d9` by [@dependabot](https://github.com/dependabot)\[bot] in [#5655](https://github.com/external-secrets/external-secrets/pull/5655) - chore(deps): bump peter-evans/slash-command-dispatch from 5.0.0 to 5.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5695](https://github.com/external-secrets/external-secrets/pull/5695) - chore(deps): bump github/codeql-action from 4.31.5 to 4.31.7 by [@dependabot](https://github.com/dependabot)\[bot] in [#5696](https://github.com/external-secrets/external-secrets/pull/5696) - chore(deps): bump actions/stale from 10.1.0 to 10.1.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5697](https://github.com/external-secrets/external-secrets/pull/5697) - chore(deps): bump actions/create-github-app-token from 2.2.0 to 2.2.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5700](https://github.com/external-secrets/external-secrets/pull/5700) - chore(deps): bump step-security/harden-runner from 2.13.2 to 2.13.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5698](https://github.com/external-secrets/external-secrets/pull/5698) - chore(deps): bump actions/checkout from 6.0.0 to 6.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5699](https://github.com/external-secrets/external-secrets/pull/5699) - chore(deps): bump platformdirs from 4.5.0 to 4.5.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5705](https://github.com/external-secrets/external-secrets/pull/5705) - chore(deps): bump distroless/static from `87bce11` to `4b2a093` by [@dependabot](https://github.com/dependabot)\[bot] in [#5692](https://github.com/external-secrets/external-secrets/pull/5692) - chore(deps): bump alpine from 3.22 to 3.23 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5703](https://github.com/external-secrets/external-secrets/pull/5703) - chore(deps): bump urllib3 from 2.5.0 to 2.6.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5704](https://github.com/external-secrets/external-secrets/pull/5704) - chore(deps): bump pymdown-extensions from 10.17.2 to 10.18 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5706](https://github.com/external-secrets/external-secrets/pull/5706) - chore(deps): bump alpine from 3.22.2 to 3.23.0 in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5701](https://github.com/external-secrets/external-secrets/pull/5701) - chore(deps): bump golang from `2611181` to `2611181` by [@dependabot](https://github.com/dependabot)\[bot] in [#5721](https://github.com/external-secrets/external-secrets/pull/5721) - chore(deps): bump codecov/codecov-action from 5.5.1 to 5.5.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5725](https://github.com/external-secrets/external-secrets/pull/5725) - chore(deps): bump urllib3 from 2.6.0 to 2.6.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5730](https://github.com/external-secrets/external-secrets/pull/5730) - chore(deps): bump github/codeql-action from 4.31.7 to 4.31.8 by [@dependabot](https://github.com/dependabot)\[bot] in [#5726](https://github.com/external-secrets/external-secrets/pull/5726) - chore(deps): bump anchore/sbom-action from 0.20.10 to 0.20.11 by [@dependabot](https://github.com/dependabot)\[bot] in [#5724](https://github.com/external-secrets/external-secrets/pull/5724) - chore(deps): bump tornado from 6.5.2 to 6.5.3 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5732](https://github.com/external-secrets/external-secrets/pull/5732) - chore(deps): bump ubi9/ubi from `75937d9` to `d4feb57` by [@dependabot](https://github.com/dependabot)\[bot] in [#5722](https://github.com/external-secrets/external-secrets/pull/5722) - chore(deps): bump golang from `5117d68` to `09f53de` in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5729](https://github.com/external-secrets/external-secrets/pull/5729) - chore(deps): bump alpine from `4b7ce07` to `51183f2` by [@dependabot](https://github.com/dependabot)\[bot] in [#5694](https://github.com/external-secrets/external-secrets/pull/5694) - chore(deps): bump hashicorp/setup-terraform from [`712b439`](https://github.com/external-secrets/external-secrets/commit/712b43959e9be7e82c34d18450fa5ec3237af3f1) to [`071811a`](https://github.com/external-secrets/external-secrets/commit/071811a16241b026a69d0c8823fc3d7c54385db5) by [@dependabot](https://github.com/dependabot)\[bot] in [#5727](https://github.com/external-secrets/external-secrets/pull/5727) - chore(deps): bump pymdown-extensions from 10.18 to 10.19.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5731](https://github.com/external-secrets/external-secrets/pull/5731) - chore(deps): bump step-security/harden-runner from 2.13.3 to 2.14.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5728](https://github.com/external-secrets/external-secrets/pull/5728) - chore(deps): bump actions/cache from 4.3.0 to 5.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5723](https://github.com/external-secrets/external-secrets/pull/5723) #### New Contributors - [@iypetrov](https://github.com/iypetrov) made their first contribution in [#5685](https://github.com/external-secrets/external-secrets/pull/5685) - [@tokiwong](https://github.com/tokiwong) made their first contribution in [#5708](https://github.com/external-secrets/external-secrets/pull/5708) - [@Gabryel8818](https://github.com/Gabryel8818) made their first contribution in [#5652](https://github.com/external-secrets/external-secrets/pull/5652) - [@mikesellitto](https://github.com/mikesellitto) made their first contribution in [#5475](https://github.com/external-secrets/external-secrets/pull/5475) - [@lostick](https://github.com/lostick) made their first contribution in [#5736](https://github.com/external-secrets/external-secrets/pull/5736) - [@cmoscofian](https://github.com/cmoscofian) made their first contribution in [#5622](https://github.com/external-secrets/external-secrets/pull/5622) - [@headcr4sh](https://github.com/headcr4sh) made their first contribution in [#5745](https://github.com/external-secrets/external-secrets/pull/5745) - [@tosih](https://github.com/tosih) made their first contribution in [#5610](https://github.com/external-secrets/external-secrets/pull/5610) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v1.1.1...v1.2.0> ### [`v1.1.1`](https://github.com/external-secrets/external-secrets/releases/tag/v1.1.1) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v1.1.0...v1.1.1) Image: `ghcr.io/external-secrets/external-secrets:v1.1.1` Image: `ghcr.io/external-secrets/external-secrets:v1.1.1-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.1.1-ubi-boringssl`  #### What's Changed ##### General - chore(chart): release helm chart 1.1.0 by [@Skarlso](https://github.com/Skarlso) in [#5619](https://github.com/external-secrets/external-secrets/pull/5619) - docs: improve spec.md by exporting generator types by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5624](https://github.com/external-secrets/external-secrets/pull/5624) - chore(deps): remove sprig fork by [@Skarlso](https://github.com/Skarlso) in [#5626](https://github.com/external-secrets/external-secrets/pull/5626) - fix: report 404 secrets correctly in Gitlab provider by [@alekc](https://github.com/alekc) in [#5104](https://github.com/external-secrets/external-secrets/pull/5104) - docs(secretserver): update documentation to include Platform compatibility by [@DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#5546](https://github.com/external-secrets/external-secrets/pull/5546) - docs: add llm policy by [@Skarlso](https://github.com/Skarlso) in [#5649](https://github.com/external-secrets/external-secrets/pull/5649) - fix: pass in the token to the build and publish container by [@Skarlso](https://github.com/Skarlso) in [#5651](https://github.com/external-secrets/external-secrets/pull/5651) - test(secretserver): improve test coverage for SecretServer provider by [@DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#5641](https://github.com/external-secrets/external-secrets/pull/5641) - fix: docs pipeline by [@rkferreira](https://github.com/rkferreira) in [#5663](https://github.com/external-secrets/external-secrets/pull/5663) - fix: modify the url of the remote to include the token by [@Skarlso](https://github.com/Skarlso) in [#5664](https://github.com/external-secrets/external-secrets/pull/5664) - feat(helm): add dynamic labelSelector if not define in topologySpread… by [@fe80](https://github.com/fe80) in [#5065](https://github.com/external-secrets/external-secrets/pull/5065) - feat: Support retry settings for Doppler provider by [@maduonline](https://github.com/maduonline) in [#5608](https://github.com/external-secrets/external-secrets/pull/5608) - feat(beyondtrust): enable pushing secrets in BeyondTrust provider by [@btfhernandez](https://github.com/btfhernandez) in [#5586](https://github.com/external-secrets/external-secrets/pull/5586) - fix: correctly merge map fields during templating by [@Skarlso](https://github.com/Skarlso) in [#5671](https://github.com/external-secrets/external-secrets/pull/5671) - fix: use patch instead of update for finalizers addition and removal by [@Skarlso](https://github.com/Skarlso) in [#5670](https://github.com/external-secrets/external-secrets/pull/5670) - feat(oracle): implement SecretExists by [@anders-swanson](https://github.com/anders-swanson) in [#5672](https://github.com/external-secrets/external-secrets/pull/5672) - fix(security): create provider for webhook & fake by [@ShimonDarshan](https://github.com/ShimonDarshan) in [#5628](https://github.com/external-secrets/external-secrets/pull/5628) - fix: set client transport to use GitHub Enterprise URL by [@fred-gagnon](https://github.com/fred-gagnon) in [#5662](https://github.com/external-secrets/external-secrets/pull/5662) - feat(generator): Password generator can generate and expose multiple passwords by [@Trojanekkk](https://github.com/Trojanekkk) in [#5669](https://github.com/external-secrets/external-secrets/pull/5669) - fix: run check diff on main by [@Skarlso](https://github.com/Skarlso) in [#5681](https://github.com/external-secrets/external-secrets/pull/5681) - feat: `bitwardenServerSDKURL` is required for `bitwardensecretsmanager` by [@budimanjojo](https://github.com/budimanjojo) in [#5679](https://github.com/external-secrets/external-secrets/pull/5679) - fix: update the refreshInterval formatting *everywhere* by [@Skarlso](https://github.com/Skarlso) in [#5680](https://github.com/external-secrets/external-secrets/pull/5680) - clean: Update conjur-api-go; Disable credential storage by [@szh](https://github.com/szh) in [#5648](https://github.com/external-secrets/external-secrets/pull/5648) - fix: add live-reload to make docs.serve by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5676](https://github.com/external-secrets/external-secrets/pull/5676) - fix: remove cached artifacts after build by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5686](https://github.com/external-secrets/external-secrets/pull/5686) - fix(keepersecurity): properly handle fields key by [@pepordev](https://github.com/pepordev) in [#5674](https://github.com/external-secrets/external-secrets/pull/5674) ##### Dependencies - chore(deps): bump golang from `d3f0cf7` to `d3f0cf7` by [@dependabot](https://github.com/dependabot)\[bot] in [#5630](https://github.com/external-secrets/external-secrets/pull/5630) - chore(deps): bump golang from `7419f54` to `e174196` in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5638](https://github.com/external-secrets/external-secrets/pull/5638) - chore(deps): bump zizmorcore/zizmor-action from 0.2.0 to 0.3.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5637](https://github.com/external-secrets/external-secrets/pull/5637) - chore(deps): bump actions/setup-go from 6.0.0 to 6.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5636](https://github.com/external-secrets/external-secrets/pull/5636) - chore(deps): bump anchore/sbom-action from 0.20.9 to 0.20.10 by [@dependabot](https://github.com/dependabot)\[bot] in [#5635](https://github.com/external-secrets/external-secrets/pull/5635) - chore(deps): bump actions/create-github-app-token from 2.1.4 to 2.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5634](https://github.com/external-secrets/external-secrets/pull/5634) - chore(deps): bump github/codeql-action from 4.31.3 to 4.31.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#5633](https://github.com/external-secrets/external-secrets/pull/5633) - chore(deps): bump aws-actions/configure-aws-credentials from [`f2964c7`](https://github.com/external-secrets/external-secrets/commit/f2964c7281262753f549b15ae39f1cbbb033b9e4) to [`4a54c24`](https://github.com/external-secrets/external-secrets/commit/4a54c24244cf4f82abd7d44e7b2024258a8aa041) by [@dependabot](https://github.com/dependabot)\[bot] in [#5632](https://github.com/external-secrets/external-secrets/pull/5632) - chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5631](https://github.com/external-secrets/external-secrets/pull/5631) - chore(deps): bump pymdown-extensions from 10.17.1 to 10.17.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5660](https://github.com/external-secrets/external-secrets/pull/5660) - chore(deps): bump softprops/action-gh-release from 2.4.2 to 2.5.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5656](https://github.com/external-secrets/external-secrets/pull/5656) - chore(deps): bump actions/setup-python from 6.0.0 to 6.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5657](https://github.com/external-secrets/external-secrets/pull/5657) - chore(deps): bump peter-evans/slash-command-dispatch from 4.0.0 to 5.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5658](https://github.com/external-secrets/external-secrets/pull/5658) - chore(deps): bump hashicorp/setup-terraform from [`4c5fdab`](https://github.com/external-secrets/external-secrets/commit/4c5fdabea201636fa7ea13d8babd1ed828687f5d) to [`712b439`](https://github.com/external-secrets/external-secrets/commit/712b43959e9be7e82c34d18450fa5ec3237af3f1) by [@dependabot](https://github.com/dependabot)\[bot] in [#5659](https://github.com/external-secrets/external-secrets/pull/5659) #### New Contributors - [@fe80](https://github.com/fe80) made their first contribution in [#5065](https://github.com/external-secrets/external-secrets/pull/5065) - [@maduonline](https://github.com/maduonline) made their first contribution in [#5608](https://github.com/external-secrets/external-secrets/pull/5608) - [@fred-gagnon](https://github.com/fred-gagnon) made their first contribution in [#5662](https://github.com/external-secrets/external-secrets/pull/5662) - [@Trojanekkk](https://github.com/Trojanekkk) made their first contribution in [#5669](https://github.com/external-secrets/external-secrets/pull/5669) - [@budimanjojo](https://github.com/budimanjojo) made their first contribution in [#5679](https://github.com/external-secrets/external-secrets/pull/5679) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v1.1.0...v1.1.1> ### [`v1.1.0`](https://github.com/external-secrets/external-secrets/releases/tag/v1.1.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v1.0.0...v1.1.0) Image: `ghcr.io/external-secrets/external-secrets:v1.1.0` Image: `ghcr.io/external-secrets/external-secrets:v1.1.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.1.0-ubi-boringssl`  #### What's Changed !*NOTE*!: During last community meeting we discussed that we are retiring our scarf account. With that, we will be changing back to [ghcr.io/external-secrets/external-secrets](http://ghcr.io/external-secrets/external-secrets) instead of [oci.external-secrets.io/external-secrets/external-secrets](http://oci.external-secrets.io/external-secrets/external-secrets). For now, the old domain will live for a couple months to give people to change back. With this release , the values in the helm chart that define where the image is switched back to ghcr. The helm-chart itself is served from under github-pages so that does not move. ##### General - chore(chart): release helm chart 1.0.0 by [@Skarlso](https://github.com/Skarlso) in [#5552](https://github.com/external-secrets/external-secrets/pull/5552) - feat(security): add support for ECDSA ssh keys by [@bigjazzsound](https://github.com/bigjazzsound) in [#5559](https://github.com/external-secrets/external-secrets/pull/5559) - fix: minor typo in comment of KeeperSecurity example by [@mdjong1](https://github.com/mdjong1) in [#5573](https://github.com/external-secrets/external-secrets/pull/5573) - docs(gcp): update documentation for using WorkloadIdentityFederation in non-GKE cluster by [@jennweir](https://github.com/jennweir) in [#5556](https://github.com/external-secrets/external-secrets/pull/5556) - chore(release): add darwin\_arm64 releases by [@lbordowitz](https://github.com/lbordowitz) in [#5583](https://github.com/external-secrets/external-secrets/pull/5583) - feat: support override IAM endpoint in IBM provider for APIkey auth by [@fidel-ruiz](https://github.com/fidel-ruiz) in [#5550](https://github.com/external-secrets/external-secrets/pull/5550) - feat(security): build tags for all the providers to disable them on d… by [@ShimonDarshan](https://github.com/ShimonDarshan) in [#5578](https://github.com/external-secrets/external-secrets/pull/5578) - fix: do not include the last element of the path in the iteration by [@Skarlso](https://github.com/Skarlso) in [#5588](https://github.com/external-secrets/external-secrets/pull/5588) - fix(k8s): support deleting whole secret by [@tiagolobocastro](https://github.com/tiagolobocastro) in [#5538](https://github.com/external-secrets/external-secrets/pull/5538) - fix(provider): configure TLS for secret server provider by [@Lumexralph](https://github.com/Lumexralph) in [#5558](https://github.com/external-secrets/external-secrets/pull/5558) - chore(aws): remove any usage of aws-sdk-v1 by [@Skarlso](https://github.com/Skarlso) in [#5590](https://github.com/external-secrets/external-secrets/pull/5590) - fix(gcp): check for secret version exists in PushSecret by [@bpalko](https://github.com/bpalko) in [#5593](https://github.com/external-secrets/external-secrets/pull/5593) - feat(vault): add GCP Workload Identity authentication support by [@SamuelMolling](https://github.com/SamuelMolling) in [#5356](https://github.com/external-secrets/external-secrets/pull/5356) - chore: fix sonar cloud issues by [@Skarlso](https://github.com/Skarlso) in [#5405](https://github.com/external-secrets/external-secrets/pull/5405) - chore(aws-sdk-v2): update dependencies to accept new aws regions by [@damienpuig](https://github.com/damienpuig) in [#5577](https://github.com/external-secrets/external-secrets/pull/5577) - feat(chart): use ghcr.io instead of our own domain by [@evrardjp](https://github.com/evrardjp) in [#5617](https://github.com/external-secrets/external-secrets/pull/5617) ##### Dependencies - chore(deps): bump golang from 1.25.3 to 1.25.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#5560](https://github.com/external-secrets/external-secrets/pull/5560) - chore(deps): bump golang from 1.25.3-bookworm to 1.25.4-bookworm in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5568](https://github.com/external-secrets/external-secrets/pull/5568) - chore(deps): bump step-security/harden-runner from 2.13.1 to 2.13.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5561](https://github.com/external-secrets/external-secrets/pull/5561) - chore(deps): bump softprops/action-gh-release from 2.4.1 to 2.4.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5564](https://github.com/external-secrets/external-secrets/pull/5564) - chore(deps): bump helm/chart-testing-action from 2.7.0 to 2.8.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5565](https://github.com/external-secrets/external-secrets/pull/5565) - chore(deps): bump aws-actions/configure-aws-credentials from [`0d00a56`](https://github.com/external-secrets/external-secrets/commit/0d00a56e021d460a2d2bb10b9d8f94f6693a71ad) to [`2475ef7`](https://github.com/external-secrets/external-secrets/commit/2475ef7675c7f555fe065dad4cbebafc7f953779) by [@dependabot](https://github.com/dependabot)\[bot] in [#5562](https://github.com/external-secrets/external-secrets/pull/5562) - chore(deps): bump helm/kind-action from 1.12.0 to 1.13.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5563](https://github.com/external-secrets/external-secrets/pull/5563) - chore(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5567](https://github.com/external-secrets/external-secrets/pull/5567) - chore(deps): bump regex from 2025.10.23 to 2025.11.3 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5570](https://github.com/external-secrets/external-secrets/pull/5570) - chore(deps): bump markdown from 3.9 to 3.10 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5569](https://github.com/external-secrets/external-secrets/pull/5569) - chore(deps): bump hashicorp/setup-terraform from [`982f6f0`](https://github.com/external-secrets/external-secrets/commit/982f6f017c89db9dccac8593265de0c382e4c050) to [`4c5fdab`](https://github.com/external-secrets/external-secrets/commit/4c5fdabea201636fa7ea13d8babd1ed828687f5d) by [@dependabot](https://github.com/dependabot)\[bot] in [#5566](https://github.com/external-secrets/external-secrets/pull/5566) - chore(deps): bump golang from `d3f0cf7` to `d3f0cf7` by [@dependabot](https://github.com/dependabot)\[bot] in [#5595](https://github.com/external-secrets/external-secrets/pull/5595) - chore(deps): bump github/codeql-action from 4.31.2 to 4.31.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5596](https://github.com/external-secrets/external-secrets/pull/5596) - chore(deps): bump click from 8.3.0 to 8.3.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5602](https://github.com/external-secrets/external-secrets/pull/5602) - chore(deps): bump ubi9/ubi from `dec374e` to `dcd8128` by [@dependabot](https://github.com/dependabot)\[bot] in [#5594](https://github.com/external-secrets/external-secrets/pull/5594) - chore(deps): bump aws-actions/configure-aws-credentials from [`2475ef7`](https://github.com/external-secrets/external-secrets/commit/2475ef7675c7f555fe065dad4cbebafc7f953779) to [`f2964c7`](https://github.com/external-secrets/external-secrets/commit/f2964c7281262753f549b15ae39f1cbbb033b9e4) by [@dependabot](https://github.com/dependabot)\[bot] in [#5597](https://github.com/external-secrets/external-secrets/pull/5597) - chore(deps): bump actions/dependency-review-action from 4.8.1 to 4.8.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5598](https://github.com/external-secrets/external-secrets/pull/5598) - chore(deps): bump pymdown-extensions from 10.16.1 to 10.17.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5599](https://github.com/external-secrets/external-secrets/pull/5599) - chore(deps): bump certifi from 2025.10.5 to 2025.11.12 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5600](https://github.com/external-secrets/external-secrets/pull/5600) - chore(deps): bump mkdocs-material from 9.6.23 to 9.7.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5601](https://github.com/external-secrets/external-secrets/pull/5601) - chore(deps): bump mkdocs-macros-plugin from 1.4.1 to 1.5.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5603](https://github.com/external-secrets/external-secrets/pull/5603) #### New Contributors - [@bigjazzsound](https://github.com/bigjazzsound) made their first contribution in [#5559](https://github.com/external-secrets/external-secrets/pull/5559) - [@mdjong1](https://github.com/mdjong1) made their first contribution in [#5573](https://github.com/external-secrets/external-secrets/pull/5573) - [@jennweir](https://github.com/jennweir) made their first contribution in [#5556](https://github.com/external-secrets/external-secrets/pull/5556) - [@lbordowitz](https://github.com/lbordowitz) made their first contribution in [#5583](https://github.com/external-secrets/external-secrets/pull/5583) - [@fidel-ruiz](https://github.com/fidel-ruiz) made their first contribution in [#5550](https://github.com/external-secrets/external-secrets/pull/5550) - [@ShimonDarshan](https://github.com/ShimonDarshan) made their first contribution in [#5578](https://github.com/external-secrets/external-secrets/pull/5578) - [@bpalko](https://github.com/bpalko) made their first contribution in [#5593](https://github.com/external-secrets/external-secrets/pull/5593) - [@SamuelMolling](https://github.com/SamuelMolling) made their first contribution in [#5356](https://github.com/external-secrets/external-secrets/pull/5356) - [@damienpuig](https://github.com/damienpuig) made their first contribution in [#5577](https://github.com/external-secrets/external-secrets/pull/5577) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v1.0.0...v1.1.0> ### [`v1.0.0`](https://github.com/external-secrets/external-secrets/releases/tag/v1.0.0) [Compare Source](https://github.com/external-secrets/external-secrets/compare/v0.20.4...v1.0.0) Image: `ghcr.io/external-secrets/external-secrets:v1.0.0` Image: `ghcr.io/external-secrets/external-secrets:v1.0.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.0.0-ubi-boringssl`  #### What's Changed ##### General - chore: release helm chart for v0.20.4 by [@Skarlso](https://github.com/Skarlso) in [#5502](https://github.com/external-secrets/external-secrets/pull/5502) - chore(actions): fix security alerts for github actions by [@Skarlso](https://github.com/Skarlso) in [#5504](https://github.com/external-secrets/external-secrets/pull/5504) - chore(release): fix incorrect shas from security alert pinning by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5512](https://github.com/external-secrets/external-secrets/pull/5512) - chore: update dependencies by [@eso-service-account-app](https://github.com/eso-service-account-app)\[bot] in [#5519](https://github.com/external-secrets/external-secrets/pull/5519) - fix: upgrade go version by [@Skarlso](https://github.com/Skarlso) in [#5529](https://github.com/external-secrets/external-secrets/pull/5529) - fix(charts): normalize certificate duration default value by [@aslafy-z](https://github.com/aslafy-z) in [#5497](https://github.com/external-secrets/external-secrets/pull/5497) - chore(revive-linter): add revive linter configuration by [@Lumexralph](https://github.com/Lumexralph) in [#5515](https://github.com/external-secrets/external-secrets/pull/5515) - feat: go module separation by [@moolen](https://github.com/moolen) in [#5498](https://github.com/external-secrets/external-secrets/pull/5498) - fix: update deps script to reflect new go mod structure by [@moolen](https://github.com/moolen) in [#5532](https://github.com/external-secrets/external-secrets/pull/5532) - fix: lint by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5536](https://github.com/external-secrets/external-secrets/pull/5536) - feat: dynamic target implementation for external secrets sources by [@Skarlso](https://github.com/Skarlso) in [#5470](https://github.com/external-secrets/external-secrets/pull/5470) - fix: codeql should not rebuild the world on every run by [@Skarlso](https://github.com/Skarlso) in [#5540](https://github.com/external-secrets/external-secrets/pull/5540) - fix(onepassword): Reduce API usage by [@sondrelg](https://github.com/sondrelg) in [#5410](https://github.com/external-secrets/external-secrets/pull/5410) - feat(esoctl): adds bootstrap generator commands by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5539](https://github.com/external-secrets/external-secrets/pull/5539) - fix: adds missing externalsecret\_type validation on generatorRef by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5547](https://github.com/external-secrets/external-secrets/pull/5547) - chore(docs): fix the generic resource doc using the incorrect switch by [@Skarlso](https://github.com/Skarlso) in [#5548](https://github.com/external-secrets/external-secrets/pull/5548) - docs(adopters): add Topicus.Education to adopters list by [@sboschman](https://github.com/sboschman) in [#5551](https://github.com/external-secrets/external-secrets/pull/5551) - fix(build): use more portable bash by [@tiagolobocastro](https://github.com/tiagolobocastro) in [#5537](https://github.com/external-secrets/external-secrets/pull/5537) ##### Dependencies - chore(deps): bump alpine from `4bcff63` to `4b7ce07` in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5507](https://github.com/external-secrets/external-secrets/pull/5507) - chore(deps): bump golang from 1.25.2 to 1.25.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5506](https://github.com/external-secrets/external-secrets/pull/5506) - chore(deps): bump golang from `aee43c3` to `aee43c3` by [@dependabot](https://github.com/dependabot)\[bot] in [#5516](https://github.com/external-secrets/external-secrets/pull/5516) - chore(deps): bump golang from 1.25.2-bookworm to 1.25.3-bookworm in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5505](https://github.com/external-secrets/external-secrets/pull/5505) - chore(deps): bump anchore/sbom-action from 0.20.8 to 0.20.9 by [@dependabot](https://github.com/dependabot)\[bot] in [#5508](https://github.com/external-secrets/external-secrets/pull/5508) - chore(deps): bump hashicorp/setup-terraform from [`c529327`](https://github.com/external-secrets/external-secrets/commit/c529327889820530c60b4ce5bbc8d6099e166666) to [`982f6f0`](https://github.com/external-secrets/external-secrets/commit/982f6f017c89db9dccac8593265de0c382e4c050) by [@dependabot](https://github.com/dependabot)\[bot] in [#5510](https://github.com/external-secrets/external-secrets/pull/5510) - chore(deps): bump actions/github-script from 7.0.1 to 8.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5513](https://github.com/external-secrets/external-secrets/pull/5513) - chore(deps): bump github/codeql-action from 4.30.9 to 4.31.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5514](https://github.com/external-secrets/external-secrets/pull/5514) - chore(deps): bump actions/cache from 4.2.4 to 4.3.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5511](https://github.com/external-secrets/external-secrets/pull/5511) - chore(deps): bump regex from 2025.9.18 to 2025.10.23 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5509](https://github.com/external-secrets/external-secrets/pull/5509) - chore(deps): bump mkdocs-macros-plugin from 1.4.0 to 1.4.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5518](https://github.com/external-secrets/external-secrets/pull/5518) - chore(deps): bump termcolor from 3.1.0 to 3.2.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5517](https://github.com/external-secrets/external-secrets/pull/5517) - chore(deps): bump github/codeql-action from 4.31.0 to 4.31.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5531](https://github.com/external-secrets/external-secrets/pull/5531) - chore(deps): bump mkdocs-material from 9.6.22 to 9.6.23 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5533](https://github.com/external-secrets/external-secrets/pull/5533) #### New Contributors - [@sondrelg](https://github.com/sondrelg) made their first contribution in [#5410](https://github.com/external-secrets/external-secrets/pull/5410) - [@tiagolobocastro](https://github.com/tiagolobocastro) made their first contribution in [#5537](https://github.com/external-secrets/external-secrets/pull/5537) **Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v0.20.4...v1.0.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 09:00 AM and 10:59 PM (`* 9-22 * * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-09-10 23:00:59 +02:00

Update Helm release external-secrets to v2

renovate/stability-days Updates have met minimum release age requirement

Details

/ kube-score (push) Successful in -38s

Details

7e862bc28f

renovate-bot force-pushed renovate/major-helm-charts from 7e862bc28f

renovate/stability-days Updates have met minimum release age requirement

Details

/ kube-score (push) Successful in -38s

Details

to 66b2d337d4

renovate/stability-days Updates have met minimum release age requirement

Details

/ kube-score (push) Successful in -39s

Details

2026-09-11 00:01:56 +02:00

Compare

renovate-bot force-pushed renovate/major-helm-charts from 66b2d337d4

renovate/stability-days Updates have met minimum release age requirement

Details

/ kube-score (push) Successful in -39s

Details

to a24d679bf6

renovate/stability-days Updates have met minimum release age requirement

Details

/ kube-score (push) Successful in -39s

Details

2026-09-11 02:01:19 +02:00

Compare

roshless merged commit d1c5863af0 into master

2026-09-11 11:14:23 +02:00

roshless deleted branch renovate/major-helm-charts

2026-09-11 11:14:23 +02:00

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

infra/kubernetes-deploy!3

No description provided.

Rows
Columns