feat(helm): update chart external-secrets (2.8.0 → 2.11.0)

[bot-akira]

This PR contains the following updates:

Package	Update	Change
external-secrets	minor	2.8.0 → 2.11.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

external-secrets/external-secrets (external-secrets)

v2.11.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.11.0
Image: ghcr.io/external-secrets/external-secrets:v2.11.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.11.0-ubi-boringssl

What's Changed

General

• chore: release helm chart for 2.10.0 by @​Skarlso in #​6882
• docs: use --hostname all in the Bitwarden webhook example by @​ggiesen in #​6850
• fix(ci): zizmor no-op blocks gates by @​evrardj-roche in #​6889
• feat(barbican): Support OpenStack Barbican authentication via Application Credentials by @​JaviMore in #​6082
• clean: replace k8s.io/utils pointer helpers with the new builtin by @​alekc in #​6902
• feat(webhook): return not supported error for GetAllSecrets by @​Abderraoufzekkour in #​6817
• fix(keepersecurity): return NoSecretErr for missing records by @​alliasgher in #​6816
• fix: doc builds may set different user/group ownership on git repo objects by @​evrardj-roche in #​6901
• fix: Use local GCP import for Vault modules by @​evrardj-roche in #​6904
• fix: guarantee replaces by @​evrardj-roche in #​6905
• chore: bump grpc by @​evrardj-roche in #​6909
• fix: bump Makefile license-eye image to 0.9.0 by @​dronenb in #​6855
• feat(infisical): add option to keep duplicate secret keys by @​mathnogueira in #​6908
• ref: move provider constants by @​evrardj-roche in #​6883
• feat: allow specifying namespace for grafana dashboard ConfigMap by @​okwilkins in #​6920
• fix(keepersecurity): make folderID optional except when creating new records via push by @​LGKentang in #​6921
• docs(templating): remove duplicate a in TemplateFrom Literal note by @​mrchatam in #​6953
• feat(ci): close pull requests that drop a template section by @​alekc in #​6881
• feat(charts): add global.imageRegistry to the external-secrets chart by @​alekc in #​6983
• chore: update skywalking-eyes by @​evrardj-roche in #​6970
• ref: fix Sonarqube linting alerts by @​evrardj-roche in #​6974
• chore: Revert #​6908 by @​evrardj-roche in #​6991
• chore: prepare release support matrix by @​evrardj-roche in #​6993

Dependencies

• chore(deps): bump golang from 484ef60 to ded31c6 in /e2e by @​dependabot[bot] in #​6892
• chore(deps): bump ubi9/ubi from 5426a8f to 25a147d by @​dependabot[bot] in #​6890
• chore(deps): bump anchore/sbom-action/download-syft from 0.24.0 to 0.24.2 by @​dependabot[bot] in #​6895
• chore(deps): bump the codeql group across 1 directory with 3 updates by @​dependabot[bot] in #​6893
• chore(deps): bump azure/login from 3.0.1 to 3.0.2 by @​dependabot[bot] in #​6896
• chore(deps): bump golang from 1.27.0-bookworm to 1.27.1-bookworm in /e2e by @​dependabot[bot] in #​6923
• chore(deps): bump aws-actions/configure-aws-credentials from 6.2.3 to 6.2.4 by @​dependabot[bot] in #​6925
• chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 by @​dependabot[bot] in #​6927
• chore(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3 by @​dependabot[bot] in #​6924
• chore(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1 by @​dependabot[bot] in #​6926
• chore(deps): bump helm/kind-action from 1.14.0 to 1.15.0 by @​dependabot[bot] in #​6928
• chore(deps): bump docker/setup-qemu-action from 4.2.0 to 4.3.0 by @​dependabot[bot] in #​6929
• chore(deps): bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 by @​dependabot[bot] in #​6960
• chore(deps): bump ubi9/ubi from 25a147d to c5cc9c2 by @​dependabot[bot] in #​6956

New Contributors

• @​ggiesen made their first contribution in #​6850
• @​JaviMore made their first contribution in #​6082
• @​Abderraoufzekkour made their first contribution in #​6817
• @​okwilkins made their first contribution in #​6920
• @​LGKentang made their first contribution in #​6921
• @​mrchatam made their first contribution in #​6953

Full Changelog: external-secrets/external-secrets@v2.10.0...v2.11.0

v2.10.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.10.0
Image: ghcr.io/external-secrets/external-secrets:v2.10.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.10.0-ubi-boringssl

What's Changed

General

• chore: release helm chart for 2.9.0 by @​Skarlso in #​6808
• docs: correct the design type in the PR template by @​sanchpet in #​6813
• fix(aws): redact credentials in aws auth config logs by @​hixichen in #​6683
• fix(gcp): preserve workload identity token expiry by @​jakobtfr in #​6772
• feat(conjur): Conjur PushSecret by @​aidy in #​6272
• fix(infisical): scope dataFrom.find.path in list requests by @​thc1006 in #​6821
• chore: bump golangci-lint and fix new linting issues by @​evrardj-roche in #​6740
• feat(openbao): add auth.kubernetes auth method by @​Nerkho in #​6591
• docs: add OpenChoreo to the adopters list by @​kavishkafernando in #​6820
• feat(passbolt): add support for custom fields by @​saknopper in #​6696
• chore: update go version to 1.26.6 by @​alekc in #​6835
• feat(core): report safe reconcile errors in status conditions by @​alekc in #​6834
• fix(secretserver): missing field siteId in secret creation by @​pr0ton11 in #​6649
• fix: Reconcile sha and version by @​evrardj-roche in #​6843
• chore(deps): bump aws acm by @​evrardj-roche in #​6705
• chore(deps): update go-ntlmssp to v0.1.1 by @​evrardj-roche in #​6701
• clean: Get rid of tests importing provider deps by @​evrardj-roche in #​6846
• chore(deps): bump GitLab API client to v1.46.0 by @​evrardj-roche in #​6700
• docs(webhook): escape Go template examples with {% raw %} by @​atobaum in #​6852
• fix(ci): put CODEOWNERS at a path GitHub actually reads by @​alekc in #​6853
• feat(passbolt): PB-53915 - Surface custom field functions in SDK by @​cedricherzog-passbolt in #​6848
• design: Guarantee module import boundaries by @​evrardj-roche in #​6851
• feat(providers): Nebius MysteryBox SA token federation auth option added by @​greenmapc in #​6784
• fix: Unblock CI by @​evrardj-roche in #​6874
• fix(vault): only apply deprecated token-cache flags when explicitly set by @​markof88 in #​6827
• feat: apply TLS security profile to the external-secrets deployment by @​siddhibhor-56 in #​6617
• feat(github): support Dependabot secrets by @​SanderKnape in #​6878

Dependencies

• chore(deps): bump golang from 0178a64 to 0178a64 by @​dependabot[bot] in #​6818
• chore(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 by @​dependabot[bot] in #​6819
• chore(deps): bump setuptools from 83.0.0 to 84.0.0 in /hack/api-docs by @​dependabot[bot] in #​6826
• chore(deps): bump golang from af8d674 to 3889b42 by @​dependabot[bot] in #​6838
• chore(deps): bump step-security/harden-runner from 2.20.1 to 2.21.0 by @​dependabot[bot] in #​6840
• chore(deps): bump the codeql group across 1 directory with 3 updates by @​dependabot[bot] in #​6839
• chore(deps): bump the codeql group with 3 updates by @​dependabot[bot] in #​6867
• chore(deps): bump ubi9/ubi from 2a6bd69 to 5426a8f by @​dependabot[bot] in #​6865
• chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @​dependabot[bot] in #​6868
• chore(deps): bump golang from 1.26.6-bookworm to 1.27.0-bookworm in /e2e by @​dependabot[bot] in #​6866
• chore(deps): bump golang from 3889b42 to 4c9fe60 by @​dependabot[bot] in #​6864
• chore(deps): bump distroless/static from 9197324 to f2ea270 by @​dependabot[bot] in #​6863

New Contributors

• @​sanchpet made their first contribution in #​6813
• @​hixichen made their first contribution in #​6683
• @​jakobtfr made their first contribution in #​6772
• @​aidy made their first contribution in #​6272
• @​thc1006 made their first contribution in #​6821
• @​Nerkho made their first contribution in #​6591
• @​kavishkafernando made their first contribution in #​6820
• @​saknopper made their first contribution in #​6696
• @​atobaum made their first contribution in #​6852
• @​markof88 made their first contribution in #​6827
• @​SanderKnape made their first contribution in #​6878

Full Changelog: external-secrets/external-secrets@v2.9.0...v2.10.0

v2.9.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.9.0
Image: ghcr.io/external-secrets/external-secrets:v2.9.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.9.0-ubi-boringssl

What's Changed

General

• chore: release helm chart 2.8.0 by @​Skarlso in #​6656
• fix(conjur): add InstallTimeout to helm chart installation and pin server image version by @​alekc in #​6658
• fix(deps): bump grpc-go for GHSA-hrxh-6v49-42gf by @​evrardj-roche in #​6695
• feat(charts): add opt-in schedulerName and runtimeClassName to the pods by @​somaz94 in #​6675
• fix(webhookconfig): use a constant Eventf format by @​evrardj-roche in #​6699
• fix: bump codeqls together by @​evrardj-roche in #​6707
• fix(security): install crane in a reliable way and fix code scanning issue by @​Skarlso in #​6712
• chore: Fix cve-2026-56852 by bump golang.org/x/text@​0.40 by @​evrardj-roche in #​6734
• chore(fix): template abuse for secret values by @​Skarlso in #​6730
• chore: Bump controller runtime by @​evrardj-roche in #​6703
• chore(fix): moved the validation further up the chain by @​Skarlso in #​6735
• fix: pin all dependencies by @​evrardj-roche in #​6727
• feat(e2e): implement fan-out matrix validation and credential scoping by @​alekc in #​6660
• fix(akeyless): use local errors.As target to avoid data race by @​HYPERVAPOR in #​6749
• test(crd): add e2e suite and CI leg for the CRD provider by @​alekc in #​6742
• docs(webhook): add debugging guide and fix stale secret-label claim by @​alekc in #​6746
• test(e2e): skip the global addon uninstall on disposable clusters by @​alekc in #​6780
• feat: add environments support to 1Password SDK by @​Skarlso in #​6318
• fix(akeyless): stop reporting API failures as a missing item by @​alekc in #​6753
• fix(makefile): harden clean worktree check by @​evrardj-roche in #​6702
• fix: support docs builds from worktrees by @​evrardj-roche in #​6741
• feat(cache): add atomic ContainsOrAdd by @​evrardj-roche in #​6706
• fix: omit empty AWS secret replica regions by @​goutamadwant in #​6596
• fix: Follow up PR6318 by @​evrardj-roche in #​6782
• feat: Show sponsoring of Roche by @​evrardj-roche in #​6790
• fix(e2e): make the oracle suite runnable by @​alekc in #​6770
• chore: temporarily allow GHSA-gcjh-h69q-9w9g by @​evrardj-roche in #​6795
• fix(api): stop defaulting optional ExternalSecret strategy fields by @​alekc in #​6798
• chore: remove/cleanup remaining tools from tools.go. by @​evrardj-roche in #​6786
• chore: Cleanup sponsors dead links by @​evrardj-roche in #​6791
• fix(aws): detach replicated regions before deleting AWS SecretsManager secret by @​cmoscofian in #​6687
• chore: fix enable cache being removed on installCRD=false by @​Skarlso in #​6799

Dependencies

• chore(deps): bump golang from 0178a64 to 0178a64 by @​dependabot[bot] in #​6663
• chore(deps): bump mkdocs-material from 9.7.6 to 9.7.7 in /hack/api-docs by @​dependabot[bot] in #​6669
• chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.1 by @​dependabot[bot] in #​6674
• chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 by @​dependabot[bot] in #​6667
• chore(deps): bump fkirc/skip-duplicate-actions from 5.3.1 to 5.3.2 by @​dependabot[bot] in #​6671
• chore(deps): bump actions/stale from 10.3.0 to 10.4.0 by @​dependabot[bot] in #​6673
• chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by @​dependabot[bot] in #​6672
• chore(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 6.2.2 by @​dependabot[bot] in #​6670
• chore(deps): bump distroless/static from d5f030c to 9197324 by @​dependabot[bot] in #​6662
• chore(deps): bump ubi9/ubi from 8bf0e8f to 2a6bd69 by @​dependabot[bot] in #​6661
• chore(deps): bump actions/setup-go from 6.0.0 to 7.0.0 by @​dependabot[bot] in #​6664
• chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by @​dependabot[bot] in #​6665
• chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.3 by @​dependabot[bot] in #​6666
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​6715
• chore(deps): bump aws-actions/configure-aws-credentials from 6.2.2 to 6.2.3 by @​dependabot[bot] in #​6717
• chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @​dependabot[bot] in #​6722
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.3 in the codeql group across 1 directory by @​dependabot[bot] in #​6713
• chore(deps): bump google-github-actions/auth from fc21748 to cd3439a by @​dependabot[bot] in #​6714
• chore(deps): bump actions/cache from 4.2.4 to 6.1.0 by @​dependabot[bot] in #​6716
• chore(deps): bump actions/labeler from 6.1.0 to 7.0.0 by @​dependabot[bot] in #​6718
• chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.2.0 by @​dependabot[bot] in #​6719
• chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 by @​dependabot[bot] in #​6720
• chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0 by @​dependabot[bot] in #​6723
• chore(deps): bump docker/login-action from 4.4.0 to 4.5.2 by @​dependabot[bot] in #​6736
• chore(deps): bump actions/stale from 10.4.0 to 11.0.0 by @​dependabot[bot] in #​6738
• chore(deps): bump the codeql group with 3 updates by @​dependabot[bot] in #​6751
• chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 by @​dependabot[bot] in #​6752
• chore(deps): bump the codeql group with 3 updates by @​dependabot[bot] in #​6801
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​6802
• chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 by @​dependabot[bot] in #​6805
• chore(deps): bump azure/login from 3.0.0 to 3.0.1 by @​dependabot[bot] in #​6804
• chore(deps): bump google-github-actions/auth from cd3439a to 1206044 by @​dependabot[bot] in #​6737
• chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.1 by @​dependabot[bot] in #​6803

New Contributors

• @​HYPERVAPOR made their first contribution in #​6749
• @​goutamadwant made their first contribution in #​6596

Full Changelog: external-secrets/external-secrets@v2.8.0...v2.9.0

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[bot-akira]

Note

18 resources changed across 2 apps · 14 CRDs

Blast radius

• Kustomization kube-system/external-secrets: 15 dependents (kube-system/external-secrets-stores +14 more)

image	from	to	upstream
ghcr.io/external-secrets/external-secrets	v2.8.0	v2.11.0	❔

_{konflate 0.6.4 · rendered ac6c254 · full diff →}

[axeII]

Do not merge yet — this reintroduces a known crash.

We hit this exact chart version before: #3793 reverted external-secrets 2.9.0 → 2.8.0 on 2026-08-20 after all 37 ExternalSecrets in the cluster failed to sync with:

could not get secret data from provider: wasm error: out of bounds memory access
op_extism_core.wasm ... extism_pdk::input_bytes

Root cause: the onepasswordSDK provider's WASM plugin (Extism) crashing on every fetch. This cluster uses onepasswordSDK (stores/onepassword/clustersecretstore.yaml), so it's directly exposed.

Confirmed via go.mod across tags — the dependency bump that caused it has not moved since:

Chart version	1Password/onepassword-sdk-go
2.8.0 (known-good)	v0.3.1
2.9.0 (crashed, reverted in #3793)	v0.4.1
2.10.0 (this PR)	v0.4.1 — unchanged
upstream main (current tip)	v0.4.1 — still unchanged

Nothing in the 2.9.0→2.10.0 changelog touches the 1Password SDK WASM invocation path (#6318/#6782 only add a mutually-exclusive environment field, which doesn't affect our vault-only config). No upstream issue exists yet for this crash string in either external-secrets/external-secrets or 1Password/onepassword-sdk-go — it looks unreported.

Because deletionPolicy: Retain keeps existing target Secrets serving their last-good values, a repeat of this wouldn't be immediately visible — it would just silently block all secret rotation and new ExternalSecrets again.

Hold until onepassword-sdk-go moves past v0.4.1 upstream (or the crash gets root-caused another way). Leaving needs-review/do not merge in place.