Skip to content

Update Weekly Updates - #36

Open
stephan271 wants to merge 1 commit into
mainfrom
renovate/weekly-updates
Open

Update Weekly Updates#36
stephan271 wants to merge 1 commit into
mainfrom
renovate/weekly-updates

Conversation

@stephan271

@stephan271 stephan271 commented Jul 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@playwright/test (source) 1.61.1 → 1.62.0 age confidence devDependencies minor
@playwright/test (source) ^1.52.0 → ^1.62.0 age confidence devDependencies minor
cert-manager (source) v1.20.3 → v1.21.1 age confidence minor
docker.io/headscale/headscale v0.29.2 → v0.29.3 age confidence patch
forgejo (source) 17.1.1 → 17.1.3 age confidence HelmChart patch
ghcr.io/bulwarkmail/webmail v1.7.7 → 1.7.8 age confidence patch
ghcr.io/tensorchord/cloudnative-vectorchord 16.13-1.1.1 → 16.14-1.1.1 age confidence minor
github.com/go-git/go-git/v5 v5.16.4 → v5.19.2 age confidence require minor
go 1.25.0 → 1.26.5 age confidence uses-with minor
golang 1.25-alpine → 1.26-alpine age confidence stage minor
golang.org/x/sys v0.46.0 → v0.47.0 age confidence require minor
hcloud (source) 1.66.0 → 1.68.0 age confidence required_provider minor
jitsi-meet 2.20.0 → 2.22.2 age confidence HelmChart minor
keycloakx (source) 7.2.0 → 7.2.2 age confidence HelmChart patch
kube-prometheus-stack (source) 87.10.1 → 87.21.0 age confidence minor
modernc.org/sqlite v1.54.0 → v1.55.0 age confidence require minor
nextcloud (source) 9.2.0 → 9.2.5 age confidence HelmChart patch
python 3.13-alpine → 3.14-alpine age confidence minor
quay.io/keycloak/keycloak 26.6.4 → 26.7.0 age confidence minor
stalwartlabs/stalwart v0.16.12 → v0.16.15 age confidence patch
svelte (source) 5.56.6 → 5.56.8 age confidence devDependencies patch
trivy-operator 0.33.2 → 0.34.0 age confidence minor
org.keycloak:keycloak-services (source) 26.6.4 → 26.7.0 age confidence provided minor
org.keycloak:keycloak-server-spi-private (source) 26.6.4 → 26.7.0 age confidence provided minor
org.keycloak:keycloak-server-spi (source) 26.6.4 → 26.7.0 age confidence provided minor
org.keycloak:keycloak-core (source) 26.6.4 → 26.7.0 age confidence provided minor

Release Notes

microsoft/playwright (@​playwright/test)

v1.62.0

Compare Source

🧱 New component testing model

Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand.
The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);

await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');

// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and [locator.screenshot() (https://playwright.dev/docs/api/class-locator#locator-screenshot) also accept webp as a type, where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded, fixed, or failing through a TestRun object:

class MyReporter {
  async preprocess({ config, suite, testRun }) {
    for (const test of suite.allTests()) {
      if (shouldSkip(test))
        testRun.skip(test);
    }
  }
}
🔁 Isolated retries

New testConfig.retryStrategy controls when failed tests are retried.
The default 'immediate' retries as soon as a worker is free; 'isolated' runs all retries at the end, one by one in a single worker, to minimize interference with the rest of the suite:

// playwright.config.ts
export default defineConfig({
  retries: 2,
  retryStrategy: 'isolated',
});
New APIs
Browser and Context
  • New option credentials includes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.
Actions
  • New scroll option ("auto" | "none") on actions to opt out of Playwright's automatic scroll-into-view.
Network
Evaluation
Command line & MCP
Reporters
  • The HTML report's Merge files grouping — previously only a UI toggle — can now be enabled from the config with the new mergeFiles reporter option:
// playwright.config.ts
export default defineConfig({
  reporter: [['html', { mergeFiles: true }]],
});
Announcements
  • ⚠️ Debian 11 is not supported anymore.
Browser Versions
  • Chromium 151.0.7922.34
  • Mozilla Firefox 153.0
  • WebKit 26.5

This version was also tested against the following stable channels:

  • Google Chrome 151
  • Microsoft Edge 151
cert-manager/cert-manager (cert-manager)

v1.21.1

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.1 fixes a controller panic for Certificates with spec.renewal.policy: Disabled, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at Ready=False (InvalidSolver) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression
  • Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled (#​9038, @​sklirg)
  • Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created (#​9083, @​SebTardif)
  • Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. (#​9037, @​wallrj-cyberark)
  • Fixed the commented Gateway API config example in the Helm chart values to use gatewayAPI.enabled instead of the invalid gatewayAPI.enable. (#​9012, @​mateenali66)
Other (Cleanup or Flake)
  • Bump golang.org/x/text to v0.40.0 to fix a reported security vulnerability (#​9039, @​wallrj-cyberark)
  • Bump google.golang.org/grpc to v1.82.1 to fix a reported security vulnerability (#​9063)
  • Bump github.com/google/cel-go to v0.29.0 to fix a reported security vulnerability (#​9072)
  • Bump go.opentelemetry.io/otel to v1.44.0 to fix a reported security vulnerability (#​9073)
  • Update distroless base images (#​9000, #​9025)

v1.21.0

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values — review them carefully before upgrading.

Known Issues

  • Controller crash-loops when a Certificate sets renewal.policy: Disabled: the new Certificate renewal policies feature (#​8258) causes a nil pointer dereference panic in the trigger controller whenever a Certificate's spec.renewal.policy is set to Disabled — pki.RenewalTime() returns (nil, nil) for that policy, but the caller unconditionally dereferences the result. This crashes the controller process (crash-loop) for any cluster with such a Certificate. Workaround: do not set renewal.policy: Disabled on any Certificate until this is fixed; remove the field (or set a different policy) from any Certificate that already has it, and restart the controller if it is currently crash-looping. See #​9031 for details.
  • Log spam for non-cert-manager-labelled Secret events: the typed predicates refactoring (#​8407) causes filteredEventHandler type assertion failures ("OnAdd missing Object", "OnUpdate missing ObjectOld", "OnDelete missing Object") for every non-cert-manager-labelled Secret event, multiplied by 7 certificate sub-controllers. This is cosmetic only — the affected controllers only need events from cert-manager-labelled Secrets (which arrive via the typed informer); the metadata informer events were always filtered out by predicates in previous versions. Issuer and ClusterIssuer controllers are not affected. See #​8994 for details.
  • Issuer/ClusterIssuer can get stuck at Ready: False, Reason: InvalidSolver and never self-correct: new eager validation of ACME solver Secrets (#​8255) means an Issuer/ClusterIssuer referencing a solver Secret (e.g. a DNS01 provider credential) that doesn't exist yet will correctly report Ready: False, but creating the missing Secret afterwards does not trigger re-reconciliation — the controller's Secret-watch logic was never updated to recognise solver Secrets. It will only recover on the next 10-hour informer resync, a change to the Issuer/ClusterIssuer's own spec, or a controller restart. Workaround: after creating the missing Secret, make a trivial edit to the Issuer/ClusterIssuer spec (or delete and recreate it) to force reconciliation. See #​9036 for details and a fix proposal.

Major Themes

Default tokenrequest RBAC removed from Helm chart

⚠️ Breaking change

The Helm chart no longer creates a default Role and RoleBinding granting the cert-manager controller permission to create tokens for its own ServiceAccount (serviceaccounts/token: create). No documented workflow requires this RBAC — the Route53 docs section that motivated it was removed in 2024.

If you use serviceAccountRef.name pointing at the controller ServiceAccount, you must now either create your own Role/RoleBinding granting serviceaccounts/token: create, or migrate to a dedicated ServiceAccount (recommended — see the Vault or Route53 documentation).

Restrict Challenge and Order RBAC in cert-manager-edit ClusterRole

⚠️ Potentially breaking change

The cert-manager-edit aggregate ClusterRole no longer grants create for challenges.acme.cert-manager.io or create, patch, update for orders.acme.cert-manager.io (GHSA-8rvj-mm4h-c258). These resources are internal to cert-manager's ACME workflow. Challenge patch and update are retained because users may need them to remove stuck finalizers.

This change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly.

Metrics port name and path Helm values removed

⚠️ Breaking change

The Helm values prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, and prometheus.podmonitor.path have been removed. The controller Service metrics port has been renamed from tcp-prometheus-servicemonitor to http-metrics. Because the Helm values schema uses additionalProperties: false, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade — remove them before upgrading. (#​8952)

ACME and Certificate Management
  • ACME Renewal Information (ARI): experimental support for RFC 9773 behind the ACMEUseARI feature gate. When enabled, cert-manager queries the ACME server's renewalInfo endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. (#​8798)
  • waitInsteadOfSelfCheck solver option: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See configuration details. (#​8858)
  • AWS IAM authentication for Vault: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. (#​8422)
  • Certificate renewal policies: a new renewalPolicies field on the Certificate API provides more expressive control over renewal scheduling, complementing renewBefore and renewBeforePercentage. (#​8258)
  • Configurable CertificateRequest retry backoff: the new --certificate-request-maximum-backoff-duration flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. (#​8893)
  • Modern2026 PKCS#12 profile: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. (#​8841)
  • Webhook certificate renewal after system suspend: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. (#​8464)
Gateway API and cainjector
  • HTTP01 ListenerSet parentRef fallback: the acme.cert-manager.io/http01-parentreffallback: "true" annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. (#​8749)
  • cert-manager.io/ignore-tls-listeners annotation: exclude specific Gateway TLS listeners from certificate management. (#​8727)
  • Additional listener protocols: configurable listener protocols beyond the default set. (#​8683)
  • enableGatewayAPI configuration restructure: enableGatewayAPI and enableGatewayAPIListenerSet are deprecated in favor of gatewayAPI.enabled / gatewayAPI.enableListenerSet. The old fields continue to work. (#​8732)
  • CAInjectorMerging promoted to GA: unconditionally enabled; will be removed in a future release. (#​8583)
  • cainjector server-side apply unconditional: the ServerSideApply feature gate is deprecated. (#​8692)
  • cainjector --ignore-namespaces flag: skip specified namespaces when watching Secrets for injection. (#​8614)
Deployment and Observability
  • Venafi OAuth token observability: a new AuthFailed Issuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. (#​8808, #​8779)
  • runtimeClassName support: configurable for cert-manager components and ACME HTTP01 solver pods. (#​8791, #​8976)
  • startupapicheck.ttlSecondsAfterFinished: opt-in automatic cleanup of the startupapicheck Job. (#​8523)
  • --acme-http01-solver-extra-labels: propagate global.commonLabels to dynamically-created ACME HTTP01 solver resources. (#​8761)
Notable Bug Fixes
  • Integer overflow in renewBeforePercentage: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. (#​8947)
  • Infinite re-issuance loop: cert-manager no longer loops when an issuer returns an already-expired certificate. (#​8610)
  • ACME transient network errors: challenges no longer permanently fail on TLS handshake timeouts, DNS resolution failures, or context cancellation during nonce fetches and authorization waits. (#​8760)
  • DNS-over-HTTPS response body cap: response body reads are now bounded at 128 KB to prevent potential OOM. (#​8803)
  • Vault path traversal: the Vault issuer webhook now rejects .. path segments, preventing path.Join from silently resolving relative segments. (#​8930)
  • DNS issuer secrets validated before ready: prevents silent misconfiguration. (#​8255)

Community

As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved.

A special thanks to:

for their contributions, comments and support!

Also, thanks to the cert-manager maintainer team for their help in this release:

And finally, thanks to the cert-manager steering committee for their feedback in this release cycle:

Changes since v1.20.0

Feature
  • Add Venafi OAuth token request observability and a new AuthFailed Issuer condition reason to distinguish bad credentials from transient infrastructure errors. (#​8808, @​FelixPhipps)
  • Add certificateRequestMaximumBackoffDuration controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, --certificate-request-maximum-backoff-duration CLI flag, or Helm value config.certificateRequestMaximumBackoffDuration. Defaults to 32 hours for backward compatibility. (#​8893, @​lunarwhite)
  • Add an optional waitInsteadOfSelfCheck field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. (#​8858, @​wallrj)
  • Add configurable runtimeClassName support for cert-manager components and ACME HTTP01 solver pods. (#​8791, @​jsoref)
  • Add direct configurable runtimeClassName support for ACME HTTP01 solver pods via the acmesolver.runtimeClassName Helm value. (#​8976, @​erikgb)
  • Add new controller flag --acme-http01-solver-extra-labels, allowing Helm's global.commonLabels to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). (#​8761, @​lunarwhite)
  • Add opt-in startupapicheck.ttlSecondsAfterFinished Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. (#​8523, @​dap0am)
  • Added ARI support through the ACMEUseARI feature gate. (#​8798, @​hjoshi123)
  • Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). (#​8422, @​bitloi)
  • Added cert-manager.io/ignore-tls-listeners annotation for ignoring gwapi listeners. (#​8727, @​hjoshi123)
  • Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. (#​8683, @​ThatsMrTalbot)
  • Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 (#​8841, @​seanorama)
  • Cainjector: A new flag --ignore-namespaces was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. (#​8614, @​figaw)
  • Disabled client side rate-limiting if AP&F is enabled. (#​8757, @​hjoshi123)
  • Extend the Venafi/CyberArk integration to also support PANW NGTS. (#​8779, @​FelixPhipps)
  • Adding certificate renewal policies (#​8258, @​hjoshi123)
  • Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate (#​8692, @​erikgb)
  • Processed annotations cert-manager.io/alt-names, cert-manager.io/ip-sans to Certificates generated from ingress like objects in cert-shim controllers. (#​8927, @​jabbrwcky)
  • Promote the CAInjectorMerging feature gate to GA (#​8583, @​Copilot)
  • When using ACME HTTP-01 with a ListenerSet, setting the annotation acme.cert-manager.io/http01-parentreffallback: "true" causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. (#​8749, @​apkatsikas)
Bug or Regression
  • BREAKING: The Helm chart no longer ships a default Role and RoleBinding granting the cert-manager controller ServiceAccount permission to create tokens for itself (serviceaccounts/token: create). This RBAC was added in v1.16 (#​7213) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on serviceAccountRef.name pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own Role and RoleBinding granting serviceaccounts/token: create on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). (#​8931, @​wallrj-cyberark)
  • ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. (#​8760, @​texasich)
  • Add dns issuer secrets validation before marking it as ready (#​8255, @​Peac36)
  • Add missing issuer finalizer RBAC to the order controller to support owner references (#​8654, @​erikgb)
  • ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. (#​8822, @​lunarwhite)
  • Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in #​8808. (#​8843, @​wallrj-cyberark)
  • Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. (#​8651, @​mateenali66)
  • Fix webhook serving certificate not being renewed after system suspend. (#​8464, @​Peac36)
  • Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). (#​8962, @​hjoshi123)
  • Fixed an integer overflow in renewBeforePercentage calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. (#​8947, @​ThatsMrTalbot)
  • Fixed duplicate parentRef bug when both issuer config and annotations are present. (#​8619, @​hjoshi123)
  • Fixed infinite re-issuance loop when issuer returns an already expired certificate (#​8610, @​onurmicoogullari)
  • Fixed local e2e-setup-samplewebhook installation to use the samplewebhook image repository and tag from the saved image tarball manifest. (#​8821, @​wallrj)
  • Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). (#​8803, @​SebTardif)
  • Fixed validation of timezone-prefixed renewal window cron specs without a schedule. (#​8813, @​immanuwell)
  • Helm chart bugfix: rename image helper to avoid umbrella chart conflicts (#​8753, @​FelixPhipps)
  • Helm: Fix invalid YAML generated when both webhook.config and webhook.volumes are defined. (#​8664, @​jnohlgard)
  • Remove ACME Challenge create and Order create/patch/update from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). (#​8958, @​wallrj-cyberark)
  • Remove issuer owner reference from challenges blocking challenge garbage collection (#​8743, @​erikgb)
  • Update logic to identify and preserve the secret matching nextPrivateKeySecretName (#​8577, @​putongyong)
  • Vault Issuer webhook validation now rejects .. path segments in spec.vault.path and auth mount path fields, preventing path.Join from silently resolving relative segments before constructing the Vault API request. (#​8930, @​wallrj-cyberark)
Other (Cleanup or Flake)
  • API cleanup: removed deprecated ObjectReference (#​8625, @​inteon)
  • Remove Helm values prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, and prometheus.podmonitor.path. The metrics path is always /metrics and the target port is always http-metrics. Rename the controller service metrics port from tcp-prometheus-servicemonitor to http-metrics for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. (#​8952, @​erikgb)
  • The enableGatewayAPI and enableGatewayAPIListenerSet fields on ControllerConfiguration are deprecated and moved into the gatewayAPI sub-struct as gatewayAPI.enabled and gatewayAPI.enableListenerSet. The old fields continue to work. (#​8732, @​ThatsMrTalbot)
  • Update base images to Debian 13 (#​8849, @​ltwongaa)
forgejo-helm/forgejo-helm (forgejo)

v17.1.3: 17.1.3

Compare Source

Bug Fixes
Tests
Continuous Integration
Miscellaneous Chores

v17.1.2: 17.1.2

Compare Source

Bug Fixes
Continuous Integration
Miscellaneous Chores

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • "before 4am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@stephan271
stephan271 force-pushed the renovate/weekly-updates branch 3 times, most recently from 97458db to 997f120 Compare July 13, 2026 20:01
@stephan271 stephan271 changed the title chore(deps): update weekly updates Update Weekly Updates Jul 13, 2026
@stephan271
stephan271 force-pushed the renovate/weekly-updates branch from 997f120 to c555dd8 Compare July 13, 2026 21:01
@stephan271
stephan271 force-pushed the renovate/weekly-updates branch from c555dd8 to 7ef03ba Compare July 14, 2026 07:01
@stephan271 stephan271 changed the title Update Weekly Updates fix(deps): update weekly updates Jul 28, 2026
@stephan271

stephan271 commented Jul 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner Author

ℹ️ Artifact update notice

File name: operator-console/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 5 additional dependencies were updated

Details:

Package Change
github.com/cloudflare/circl v1.6.1 -> v1.6.3
github.com/cyphar/filepath-securejoin v0.4.1 -> v0.6.1
github.com/go-git/go-billy/v5 v5.6.2 -> v5.9.0
github.com/pjbgf/sha1cd v0.3.2 -> v0.6.0
golang.org/x/net v0.47.0 -> v0.56.0

@stephan271 stephan271 changed the title fix(deps): update weekly updates Update Weekly Updates Jul 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@stephan271 @renovate-bot