Skip to content

Bump the all group across 1 directory with 9 updates - #62

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/all-d066405fd2
Open

Bump the all group across 1 directory with 9 updates#62
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/all-d066405fd2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the all group with 6 updates in the / directory:

Package From To
github.com/AthenZ/athenz 1.12.43 1.12.44
github.com/cert-manager/cert-manager 1.20.2 1.21.0
github.com/cert-manager/issuer-lib 0.10.0 0.11.0
github.com/go-logr/logr 1.4.3 1.4.4
k8s.io/api 0.36.2 0.36.3
k8s.io/apiextensions-apiserver 0.36.2 0.36.3

Updates github.com/AthenZ/athenz from 1.12.43 to 1.12.44

Release notes

Sourced from github.com/AthenZ/athenz's releases.

Athenz v1.12.44 Release

What's Changed

New Contributors

Full Changelog: AthenZ/athenz@v1.12.43...v1.12.44

Changelog

Sourced from github.com/AthenZ/athenz's changelog.

Athenz v1.12.44 Release / Jul 18, 2026

#3404 extend github actions provider to support multiple enterprises #3405 ui - fix microsegmentation page error and warnings, add functional test #3406 Fix: UI no longer returns an error for the valid external identity during the group member add #3408 Use ON DUPLICATE KEY UPDATE for X.509 cert record insert to avoid spurious errors in DB audit logs #3409 add cached access token client wrappers to athenzutils #3410 Add opt-in local file cache for S3ChangeLogStore #3411 Feat: allow spiffe uri customization #3413 access token go lib update/disk based fallback #3415 add support for IAM Auth candidate regions #3416 Add ignoreCache parameter to Go access token client #3418 make ui session cookie configurable #3419 move db lookup in status response into a separate thread #3420 update java/go/js dependencies to their latest releases

Commits
  • 0c3a7a3 [maven-release-plugin] prepare release v1.12.44
  • 96c716d update java/go/js dependencies to their latest releases (#3420)
  • 4827f92 Add ignoreCache parameter to Go access token client (#3416)
  • 17cd740 Athens 9662/disk based fallback (#3413)
  • 393e54e move db lookup in status response into a separate thread (#3419)
  • cbbd652 add cached access token client wrappers to athenzutils (#3409)
  • 1f3bb8d Add opt-in local file cache for S3ChangeLogStore (#3410)
  • 4363bb4 add support for IAM Auth candidate regions (#3415)
  • d1a05a3 make ui session cookie configurable (#3418)
  • 59140fe Fix: UI no longer returns an error for the valid external identity during the...
  • Additional commits viewable in compare view

Updates github.com/cert-manager/cert-manager from 1.20.2 to 1.21.0

Release notes

Sourced from github.com/cert-manager/cert-manager's releases.

v1.21.0

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values — review them carefully before upgrading.

Known Issues

  • Controller crash-loops when a Certificate sets renewal.policy: Disabled: the new Certificate renewal policies feature (#8258) causes a nil pointer dereference panic in the trigger controller whenever a Certificate's spec.renewal.policy is set to Disabled — pki.RenewalTime() returns (nil, nil) for that policy, but the caller unconditionally dereferences the result. This crashes the controller process (crash-loop) for any cluster with such a Certificate. Workaround: do not set renewal.policy: Disabled on any Certificate until this is fixed; remove the field (or set a different policy) from any Certificate that already has it, and restart the controller if it is currently crash-looping. See #9031 for details.
  • Log spam for non-cert-manager-labelled Secret events: the typed predicates refactoring (#8407) causes filteredEventHandler type assertion failures ("OnAdd missing Object", "OnUpdate missing ObjectOld", "OnDelete missing Object") for every non-cert-manager-labelled Secret event, multiplied by 7 certificate sub-controllers. This is cosmetic only — the affected controllers only need events from cert-manager-labelled Secrets (which arrive via the typed informer); the metadata informer events were always filtered out by predicates in previous versions. Issuer and ClusterIssuer controllers are not affected. See #8994 for details.
  • Issuer/ClusterIssuer can get stuck at Ready: False, Reason: InvalidSolver and never self-correct: new eager validation of ACME solver Secrets (#8255) means an Issuer/ClusterIssuer referencing a solver Secret (e.g. a DNS01 provider credential) that doesn't exist yet will correctly report Ready: False, but creating the missing Secret afterwards does not trigger re-reconciliation — the controller's Secret-watch logic was never updated to recognise solver Secrets. It will only recover on the next 10-hour informer resync, a change to the Issuer/ClusterIssuer's own spec, or a controller restart. Workaround: after creating the missing Secret, make a trivial edit to the Issuer/ClusterIssuer spec (or delete and recreate it) to force reconciliation. See cert-manager/cert-manager#9036 for details and a fix proposal.

Major Themes

Default tokenrequest RBAC removed from Helm chart

⚠️ Breaking change

The Helm chart no longer creates a default Role and RoleBinding granting the cert-manager controller permission to create tokens for its own ServiceAccount (serviceaccounts/token: create). No documented workflow requires this RBAC — the Route53 docs section that motivated it was removed in 2024.

If you use serviceAccountRef.name pointing at the controller ServiceAccount, you must now either create your own Role/RoleBinding granting serviceaccounts/token: create, or migrate to a dedicated ServiceAccount (recommended — see the Vault or Route53 documentation).

Restrict Challenge and Order RBAC in cert-manager-edit ClusterRole

⚠️ Potentially breaking change

The cert-manager-edit aggregate ClusterRole no longer grants create for challenges.acme.cert-manager.io or create, patch, update for orders.acme.cert-manager.io (GHSA-8rvj-mm4h-c258). These resources are internal to cert-manager's ACME workflow. Challenge patch and update are retained because users may need them to remove stuck finalizers.

This change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly.

Metrics port name and path Helm values removed

⚠️ Breaking change

The Helm values prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, and prometheus.podmonitor.path have been removed. The controller Service metrics port has been renamed from tcp-prometheus-servicemonitor to http-metrics. Because the Helm values schema uses additionalProperties: false, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade — remove them before upgrading. (#8952)

ACME and Certificate Management

  • ACME Renewal Information (ARI): experimental support for RFC 9773 behind the ACMEUseARI feature gate. When enabled, cert-manager queries the ACME server's renewalInfo endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. (#8798)
  • waitInsteadOfSelfCheck solver option: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See configuration details. (#8858)
  • AWS IAM authentication for Vault: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. (#8422)
  • Certificate renewal policies: a new renewalPolicies field on the Certificate API provides more expressive control over renewal scheduling, complementing renewBefore and renewBeforePercentage. (#8258)
  • Configurable CertificateRequest retry backoff: the new --certificate-request-maximum-backoff-duration flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. (#8893)
  • Modern2026 PKCS#12 profile: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. (#8841)
  • Webhook certificate renewal after system suspend: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. (#8464)

Gateway API and cainjector

  • HTTP01 ListenerSet parentRef fallback: the acme.cert-manager.io/http01-parentreffallback: "true" annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. (#8749)
  • cert-manager.io/ignore-tls-listeners annotation: exclude specific Gateway TLS listeners from certificate management. (#8727)
  • Additional listener protocols: configurable listener protocols beyond the default set. (#8683)

... (truncated)

Commits
  • b8f325e Merge pull request #8984 from cert-manager-bot/cherry-pick-8983-to-release-1.21
  • 6d43c8c Ignore GO-2026-5932 in trivy scans
  • 8eb9d29 Merge pull request #8980 from cert-manager-bot/cherry-pick-8976-to-release-1.21
  • a95f519 Merge pull request #8981 from erikgb/r-1-21-bump-go
  • 5d62fa3 [release-1.21] Update dependency go to v1.26.5
  • 66241e2 Add acmesolver.runtimeClassName
  • 0357ac2 Merge pull request #8967 from cert-manager/release-1.21-disable-klone
  • 2f2bfc3 Disable generate-klone on release-1.21 branch
  • ae67234 Merge pull request #8893 from lunarwhite/max-backoff-duration
  • 35e46aa Respect configured max backoff in trigger controller
  • Additional commits viewable in compare view

Updates github.com/cert-manager/issuer-lib from 0.10.0 to 0.11.0

Release notes

Sourced from github.com/cert-manager/issuer-lib's releases.

v0.11.0

issuer-lib is the best way to write cert-manager issuers!

This release is largely focused around dependency bumps. It should be safe to upgrade straight away!

What's Changed

... (truncated)

Commits
  • 4e5f40b Merge pull request #474 from cert-manager/renovate/makefile-modules
  • 70028c0 chore(deps): update makefile modules to 72b0d34
  • 6c88cee Merge pull request #473 from cert-manager/renovate/makefile-modules
  • a03a4c6 chore(deps): update makefile modules to fb0281c
  • dc299e6 Merge pull request #472 from cert-manager/renovate/makefile-modules
  • 5b74c06 chore(deps): update makefile modules to 3475385
  • e3dd610 Merge pull request #471 from cert-manager/renovate/misc-go-deps
  • 12fe775 fix(deps): update module github.com/cert-manager/cert-manager to v1.20.3
  • 9f1e206 Merge pull request #470 from cert-manager/renovate/makefile-modules
  • 04a9abd Fix new nolintlint lint errors
  • Additional commits viewable in compare view

Updates github.com/go-logr/logr from 1.4.3 to 1.4.4

Release notes

Sourced from github.com/go-logr/logr's releases.

v1.4.4

What's Changed

New Contributors

Full Changelog: go-logr/logr@v1.4.3...v1.4.4

Commits
  • 96a9aba Fix lint
  • 51c6302 Better implementation of pointer recursion checking
  • c667114 funcr: Handle and test recursive values
  • f7ffadb Add benchmark for pointer args
  • e2a3c8e funcr: bound slog.Group nesting depth to prevent stack overflow
  • 2886d2b build(deps): bump actions/setup-go from 6.5.0 to 7.0.0
  • 0b40896 build(deps): bump github/codeql-action/upload-sarif
  • 77f671b Bump to Go 1.26
  • cce283f build(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0
  • 3832a11 build(deps): bump github/codeql-action/upload-sarif
  • Additional commits viewable in compare view

Updates k8s.io/api from 0.36.2 to 0.36.3

Commits
  • 3fde3c4 Update dependencies to v0.36.3 tag
  • 53c47b9 Merge pull request #140296 from jpbetz/cherry-pick-smd-306-revert
  • 1831886 Bump sigs.k8s.io/structured-merge-diff/v6 to v6.3.3
  • See full diff in compare view

Updates k8s.io/apiextensions-apiserver from 0.36.2 to 0.36.3

Commits
  • 2e78d6f Update dependencies to v0.36.3 tag
  • 4b2f007 Merge pull request #140296 from jpbetz/cherry-pick-smd-306-revert
  • c8a9346 Add e2e test for setting maps and slices to null via SSA
  • b387965 Bump sigs.k8s.io/structured-merge-diff/v6 to v6.3.3
  • See full diff in compare view

Updates k8s.io/apimachinery from 0.36.2 to 0.36.3

Commits
  • 40bf4b2 Update dependencies to v0.36.3 tag
  • 34d46be Merge pull request #140296 from jpbetz/cherry-pick-smd-306-revert
  • 66a3724 Bump sigs.k8s.io/structured-merge-diff/v6 to v6.3.3
  • See full diff in compare view

Updates k8s.io/client-go from 0.36.2 to 0.36.3

Commits
  • 44a8af2 Update dependencies to v0.36.3 tag
  • f501ada Merge pull request #140296 from jpbetz/cherry-pick-smd-306-revert
  • a43e1d7 Bump sigs.k8s.io/structured-merge-diff/v6 to v6.3.3
  • See full diff in compare view

Updates k8s.io/utils from 0.0.0-20260617174310-a95e086a2553 to 0.0.0-20260707023825-cf1189d6abe3

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the all group across 1 directory with 9 updates
953fb9a 
Bumps the all group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/AthenZ/athenz](https://github.com/AthenZ/athenz) | `1.12.43` | `1.12.44` |
| [github.com/cert-manager/cert-manager](https://github.com/cert-manager/cert-manager) | `1.20.2` | `1.21.0` |
| [github.com/cert-manager/issuer-lib](https://github.com/cert-manager/issuer-lib) | `0.10.0` | `0.11.0` |
| [github.com/go-logr/logr](https://github.com/go-logr/logr) | `1.4.3` | `1.4.4` |
| [k8s.io/api](https://github.com/kubernetes/api) | `0.36.2` | `0.36.3` |
| [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) | `0.36.2` | `0.36.3` |



Updates `github.com/AthenZ/athenz` from 1.12.43 to 1.12.44
- [Release notes](https://github.com/AthenZ/athenz/releases)
- [Changelog](https://github.com/AthenZ/athenz/blob/master/CHANGELOG)
- [Commits](AthenZ/athenz@v1.12.43...v1.12.44)

Updates `github.com/cert-manager/cert-manager` from 1.20.2 to 1.21.0
- [Release notes](https://github.com/cert-manager/cert-manager/releases)
- [Changelog](https://github.com/cert-manager/cert-manager/blob/master/RELEASE.md)
- [Commits](cert-manager/cert-manager@v1.20.2...v1.21.0)

Updates `github.com/cert-manager/issuer-lib` from 0.10.0 to 0.11.0
- [Release notes](https://github.com/cert-manager/issuer-lib/releases)
- [Commits](cert-manager/issuer-lib@v0.10.0...v0.11.0)

Updates `github.com/go-logr/logr` from 1.4.3 to 1.4.4
- [Release notes](https://github.com/go-logr/logr/releases)
- [Changelog](https://github.com/go-logr/logr/blob/master/CHANGELOG.md)
- [Commits](go-logr/logr@v1.4.3...v1.4.4)

Updates `k8s.io/api` from 0.36.2 to 0.36.3
- [Commits](kubernetes/api@v0.36.2...v0.36.3)

Updates `k8s.io/apiextensions-apiserver` from 0.36.2 to 0.36.3
- [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases)
- [Commits](kubernetes/apiextensions-apiserver@v0.36.2...v0.36.3)

Updates `k8s.io/apimachinery` from 0.36.2 to 0.36.3
- [Commits](kubernetes/apimachinery@v0.36.2...v0.36.3)

Updates `k8s.io/client-go` from 0.36.2 to 0.36.3
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.36.2...v0.36.3)

Updates `k8s.io/utils` from 0.0.0-20260617174310-a95e086a2553 to 0.0.0-20260707023825-cf1189d6abe3
- [Commits](https://github.com/kubernetes/utils/commits)

---
updated-dependencies:
- dependency-name: github.com/AthenZ/athenz
  dependency-version: 1.12.44
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/cert-manager/cert-manager
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/cert-manager/issuer-lib
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/go-logr/logr
  dependency-version: 1.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: k8s.io/api
  dependency-version: 0.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: k8s.io/apiextensions-apiserver
  dependency-version: 0.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: k8s.io/client-go
  dependency-version: 0.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: k8s.io/utils
  dependency-version: 0.0.0-20260707023825-cf1189d6abe3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jul 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants