chore(deps): update helm release external-secrets to v2

[devex-sa]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change	Pending
external-secrets	major	0.20.4 → 2.6.0	2.7.0

---

Release Notes

external-secrets/external-secrets (external-secrets)

v2.6.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.6.0
Image: ghcr.io/external-secrets/external-secrets:v2.6.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.6.0-ubi-boringssl

What's Changed

General

• chore: release helm chart 2.5.0 by @​Skarlso in #​6352
• feat(keeper): implement provider_api_calls_count metric by @​m-k8s in #​6345
• docs(gcpsm): updates Google Secret Manager authentication guide with WIF usage by @​bharath-b-rh in #​6356
• feat(release): PB-51302 - External secret should support v5-custom-fields resource type by @​cedricherzog-passbolt in #​6377
• feat(testing): OpenBao e2e test by @​phil9909 in #​6396
• docs: Explanation of our labels by @​evrardj-roche in #​6306
• docs: add AGENTS.md and AI setup guide for ESO by @​rowanruseler in #​6141
• fix(makefile): clean up cross-submodule go.mod churn after make test by @​alekc in #​6378
• fix(provider): align TokenRequest body namespace with URL namespace by @​alekc in #​6420
• fix(build): use buildx --load and non-registry image tag by @​alekc in #​6419
• fix(charts): render PDB spec when minAvailable or maxUnavailable is zero by @​blindrood in #​6360
• chore: update go version 1.26.4 by @​Skarlso in #​6426

Dependencies

• chore(deps): bump golang from 91eda97 to 91eda97 by @​dependabot[bot] in #​6363
• chore(deps): bump pymdown-extensions from 10.21.2 to 10.21.3 in /hack/api-docs by @​dependabot[bot] in #​6370
• chore(deps): bump hashicorp/setup-terraform from 4.0.0 to 4.0.1 by @​dependabot[bot] in #​6364
• chore(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 by @​dependabot[bot] in #​6365
• chore(deps): bump step-security/harden-runner from 2.19.1 to 2.19.4 by @​dependabot[bot] in #​6366
• chore(deps): bump github/codeql-action from 4.35.4 to 4.36.0 by @​dependabot[bot] in #​6368
• chore(deps): bump distroless/static from 47b2d72 to 3592aa8 by @​dependabot[bot] in #​6362
• chore(deps): bump ubi9/ubi from 2323fcf to 151fc1b by @​dependabot[bot] in #​6361
• chore(deps): bump actions/create-github-app-token from 3.1.1 to 3.2.0 by @​dependabot[bot] in #​6367
• chore(deps): bump idna from 3.14 to 3.16 in /hack/api-docs by @​dependabot[bot] in #​6369
• chore(deps): bump golang from 91eda97 to 91eda97 by @​dependabot[bot] in #​6383
• chore(deps): bump golang from 252599a to 386d475 in /e2e by @​dependabot[bot] in #​6389
• chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 by @​dependabot[bot] in #​6384
• chore(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 by @​dependabot[bot] in #​6387
• chore(deps): bump docker/login-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​6386
• chore(deps): bump actions/stale from 10.2.0 to 10.3.0 by @​dependabot[bot] in #​6388
• chore(deps): bump zipp from 3.23.1 to 4.1.0 in /hack/api-docs by @​dependabot[bot] in #​6390
• chore(deps): bump click from 8.3.3 to 8.4.1 in /hack/api-docs by @​dependabot[bot] in #​6391
• chore(deps): bump certifi from 2026.4.22 to 2026.5.20 in /hack/api-docs by @​dependabot[bot] in #​6392
• chore(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @​dependabot[bot] in #​6385
• chore(deps): bump requests from 2.33.1 to 2.34.2 in /hack/api-docs by @​dependabot[bot] in #​6372
• chore(deps): bump tornado from 6.5.5 to 6.5.6 in /hack/api-docs by @​dependabot[bot] in #​6412
• chore(deps): bump ubi9/ubi from 151fc1b to 8942b73 by @​dependabot[bot] in #​6407
• chore(deps): bump aws-actions/configure-aws-credentials from 6.1.1 to 6.2.0 by @​dependabot[bot] in #​6408
• chore(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0 by @​dependabot[bot] in #​6409
• chore(deps): bump idna from 3.16 to 3.17 in /hack/api-docs by @​dependabot[bot] in #​6411

New Contributors

• @​m-k8s made their first contribution in #​6345
• @​phil9909 made their first contribution in #​6396
• @​blindrood made their first contribution in #​6360

Full Changelog: external-secrets/external-secrets@v2.5.0...v2.6.0

v2.5.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.5.0
Image: ghcr.io/external-secrets/external-secrets:v2.5.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.5.0-ubi-boringssl

What's Changed

General

• chore: release chart for v2.4.1 by @​Skarlso in #​6293
• fix(doc): Adds missing doc reference for VaultDynamicSecret example using GET by @​bharath-b-rh in #​6296
• feat(charts): make serviceaccounts/token create RBAC rule conditional by @​kriszkern in #​6295
• ref: delete duplication of applyOwnership logic by @​jaruwat-panturat in #​6301
• feat: add Pulumi OIDC-based authentication by @​johnstonmatt in #​5893
• fix: datarace in fake runtime test and push secret test by @​Skarlso in #​6300
• docs(release): Update docs to build for arm for bitwarden-cli by @​Senk02 in #​6312
• feat: add healthz check for liveness probe to cert and webhook by @​Skarlso in #​6319
• chore: bump go version 1.26.3 by @​Skarlso in #​6339
• fix(charts): gate externalsecrets write RBAC on processClusterExternalSecret by @​kriszkern in #​6332
• feat(gcp): issue-5790: optional GCP service account email for WIF impersonation by @​bharath-b-rh in #​6273
• ref(beyondtrust): BIPS-32651 add API v3.2 support for create Secrets by @​btfhernandez in #​6309
• fix(onepassword): return fresh provider instance from NewClient to avoid wrong-vault race by @​duizabojul in #​6334
• docs: add Rootline to ADOPTERS.md by @​daanschipper in #​6342
• feat(charts): default scopedNamespace to .Release.Namespace when scopedRBAC is true by @​kriszkern in #​6343
• docs: add blank lines before lists by @​chlab in #​6336
• chore(doc): fix Azure role name typo by @​hobti01 in #​6335
• feat(security): Enable Authentication and Authorization for Metrics Endpoint using FilterProvider by @​Zacky3181V in #​5574
• feat: inject kube context as STS session tags by @​robertchildresscfa in #​6311
• fix(charts): remove stale args guard in controller deployment by @​kriszkern in #​6347
• fix: provider/infisical provider sub-folder references in remoteRef.key by @​varonix0 in #​6338

Dependencies

• chore(deps): bump golang from 4f4ab2c to 47ce563 in /e2e by @​dependabot[bot] in #​6286
• chore(deps): bump click from 8.3.2 to 8.3.3 in /hack/api-docs by @​dependabot[bot] in #​6287
• chore(deps): bump certifi from 2026.2.25 to 2026.4.22 in /hack/api-docs by @​dependabot[bot] in #​6288
• chore(deps): bump pathspec from 1.0.4 to 1.1.1 in /hack/api-docs by @​dependabot[bot] in #​6291
• chore(deps): bump idna from 3.11 to 3.13 in /hack/api-docs by @​dependabot[bot] in #​6290
• chore(deps): bump packaging from 26.1 to 26.2 in /hack/api-docs by @​dependabot[bot] in #​6289
• chore(deps): bump step-security/harden-runner from 2.19.0 to 2.19.1 by @​dependabot[bot] in #​6304
• chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by @​dependabot[bot] in #​6305
• chore(deps): bump golang from 1.26.2 to 1.26.3 by @​dependabot[bot] in #​6320
• chore(deps): bump golang from 1.26.2-bookworm to 1.26.3-bookworm in /e2e by @​dependabot[bot] in #​6327
• chore(deps): bump ubi9/ubi from fd3612e to 2323fcf by @​dependabot[bot] in #​6321
• chore(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @​dependabot[bot] in #​6322
• chore(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 by @​dependabot[bot] in #​6323
• chore(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2 by @​dependabot[bot] in #​6325
• chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by @​dependabot[bot] in #​6324
• chore(deps): bump actions/labeler from 6.0.1 to 6.1.0 by @​dependabot[bot] in #​6326
• chore(deps): bump idna from 3.13 to 3.14 in /hack/api-docs by @​dependabot[bot] in #​6328
• chore(deps): bump urllib3 from 2.6.3 to 2.7.0 in /hack/api-docs by @​dependabot[bot] in #​6329
• chore(deps): bump regex from 2026.4.4 to 2026.5.9 in /hack/api-docs by @​dependabot[bot] in #​6330

New Contributors

• @​kriszkern made their first contribution in #​6295
• @​johnstonmatt made their first contribution in #​5893
• @​Senk02 made their first contribution in #​6312
• @​duizabojul made their first contribution in #​6334
• @​daanschipper made their first contribution in #​6342
• @​chlab made their first contribution in #​6336
• @​hobti01 made their first contribution in #​6335
• @​Zacky3181V made their first contribution in #​5574
• @​robertchildresscfa made their first contribution in #​6311

Full Changelog: external-secrets/external-secrets@v2.4.1...v2.5.0

v2.4.1

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.4.1
Image: ghcr.io/external-secrets/external-secrets:v2.4.1-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.4.1-ubi-boringssl

What's Changed

General

• chore: release chart for v2.4.0 by @​Skarlso in #​6277
• feat(gcp): support multiple replicationLocations on PushSecret by @​alliasgher in #​6225
• feat(passbolt): add custom CA bundle / CA provider support by @​alliasgher in #​6224
• feat(azure): add contentType support for PushSecret by @​ppatel1604 in #​6249
• feat(charts): add liveness probes to cert-controller and webhook by @​mattcarp12 in #​6147
• fix: prevent creation of specific type of secrets by @​Skarlso in #​6280

Dependencies

• chore(deps): bump golang from f853308 to f853308 by @​dependabot[bot] in #​6282
• chore(deps): bump alpine from 2510918 to 5b10f43 in /hack/api-docs by @​dependabot[bot] in #​6285
• chore(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 by @​dependabot[bot] in #​6283
• chore(deps): bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 by @​dependabot[bot] in #​6284
• chore(deps): bump ubi9/ubi from cf13fe2 to fd3612e by @​dependabot[bot] in #​6281

Full Changelog: external-secrets/external-secrets@v2.4.0...v2.4.1

v2.4.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.4.0
Image: ghcr.io/external-secrets/external-secrets:v2.4.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.4.0-ubi-boringssl

What's Changed

General

• chore: release helm chart for v2.3.0 by @​Skarlso in #​6204
• fix(docs): hide Scarf tracking pixel to remove page whitespace by @​ppatel1604 in #​6209
• docs: Add Grafana generator documentation by @​jaruwat-panturat in #​6227
• docs: add TLS certificate authentication example for Vault provider by @​alliasgher in #​6212
• docs(cloudsmith): Improve cloudsmith generator documentation by @​cloudsmith-iduffy in #​6232
• docs: add missing specs to GeneratorSpec example by @​jaruwat-panturat in #​6236
• feat(keeper): implement get secret by id or name by @​tiberiuv in #​6163
• chore(secretserver): update dependencies to accept new DelineaXPM/tss-sdk-go by @​DelineaSahilWankhede in #​6240
• docs(release): update documentation links from /main to /latest by @​cinpol in #​6210
• fix: CAProvider cm access by @​moolen in #​6246
• fix(chart): add failurePolicy to ClusterSecretStore webhook by @​ryanjwong in #​6247
• feat(dvls): add name support for entries by @​rbstp in #​6099
• fix(akeyless): upgrade akeyless-go-cloud-id to v0.3.7 by @​alikdolg in #​6248
• chore(deps): bump azure/setup-helm from 3.5 to 5 by @​dependabot[bot] in #​6258
• fix: do not set tags if undefined by @​Skarlso in #​6103
• fix(conjur): return error for unimplemented PushSecret and DeleteSecret by @​antonio-mazzini in #​6266
• docs: Enhance ClusterExternalSecret documentation with "fan-out" approach by @​jaruwat-panturat in #​6241
• feat: add --leader-election-id flag to support HA deployments by @​mattcarp12 in #​6148
• feat(bug): Fix CVE-2026-34165, CVE-2026-33762 and GHSA-3xc5-wrhm-f963 by @​othomann in #​6271
• feat: enhance VaultDynamicSecret GET method to support parameters from the spec by @​samm-git in #​6267
• fix: use a separate parameter for GET calls in VaultDynamicSecrets by @​Skarlso in #​6275

Dependencies

• chore(deps): bump golang from c2a1f7b to c2a1f7b by @​dependabot[bot] in #​6214
• chore(deps): bump platformdirs from 4.9.4 to 4.9.6 in /hack/api-docs by @​dependabot[bot] in #​6219
• chore(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1 by @​dependabot[bot] in #​6216
• chore(deps): bump codelytv/pr-size-labeler from 1.10.3 to 1.10.4 by @​dependabot[bot] in #​6221
• chore(deps): bump ubi9/ubi from 9e6e193 to 039095f by @​dependabot[bot] in #​6213
• chore(deps): bump importlib-resources from 6.5.2 to 7.1.0 in /hack/api-docs by @​dependabot[bot] in #​6220
• chore(deps): bump actions/github-script from 8.0.0 to 9.0.0 by @​dependabot[bot] in #​6215
• chore(deps): bump step-security/harden-runner from 2.16.1 to 2.17.0 by @​dependabot[bot] in #​6217
• chore(deps): bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0 by @​dependabot[bot] in #​6218
• chore(deps): bump azure/setup-helm from 3.4 to 3.5 by @​dependabot[bot] in #​6222
• chore(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0 by @​dependabot[bot] in #​6223
• chore(deps): bump golang from c2a1f7b to f853308 by @​dependabot[bot] in #​6252
• chore(deps): bump alpine from 3.23.3 to 3.23.4 in /e2e by @​dependabot[bot] in #​6261
• chore(deps): bump step-security/harden-runner from 2.17.0 to 2.19.0 by @​dependabot[bot] in #​6254
• chore(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3 by @​dependabot[bot] in #​6257
• chore(deps): bump actions/cache from 5.0.4 to 5.0.5 by @​dependabot[bot] in #​6259
• chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by @​dependabot[bot] in #​6255
• chore(deps): bump packaging from 26.0 to 26.1 in /hack/api-docs by @​dependabot[bot] in #​6263
• chore(deps): bump zipp from 3.23.0 to 3.23.1 in /hack/api-docs by @​dependabot[bot] in #​6262
• chore(deps): bump alpine from 2510918 to 5b10f43 by @​dependabot[bot] in #​6251
• chore(deps): bump ubi9/ubi from 039095f to cf13fe2 by @​dependabot[bot] in #​6253
• chore(deps): bump dependabot/fetch-metadata from 3.0.0 to 3.1.0 by @​dependabot[bot] in #​6260
• chore(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.1.0 by @​dependabot[bot] in #​6256

New Contributors

• @​alliasgher made their first contribution in #​6212
• @​tiberiuv made their first contribution in #​6163
• @​cinpol made their first contribution in #​6210
• @​ryanjwong made their first contribution in #​6247
• @​alikdolg made their first contribution in #​6248
• @​antonio-mazzini made their first contribution in #​6266
• @​mattcarp12 made their first contribution in #​6148

Full Changelog: external-secrets/external-secrets@v2.3.0...v2.4.0

v2.3.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.3.0
Image: ghcr.io/external-secrets/external-secrets:v2.3.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.3.0-ubi-boringssl

What's Changed

General

• chore: release charts v2.2.0 by @​riccardomc in #​6115
• ref(modernize): modernize go code by @​ivankatliarchuk in #​6114
• chore: bump bitwarden helm chart version to v0.6.0 by @​Skarlso in #​6118
• chore: fix EoL in compatiblity table for version 2.2 by @​riccardomc in #​6128
• docs: add missing jinja2 tags by @​MindTooth in #​6136
• fix: cached uid after deleting a store by @​Skarlso in #​6138
• feat(doppler): add ETag-based caching by @​mikesellitto in #​5997
• fix(docs): fix metadata structure in Google Secrets Manager docs by @​mruoss in #​6139
• feat: ovh provider implementation by @​ldesauw in #​6101
• feat(providers): Implement PushSecret for Delinea Secret Server by @​pr0ton11 in #​6031
• fix: propagate objectMeta and ownerReferences to target resources by @​jaruwat-panturat in #​6132
• fix(release): remove docs.check and all relative calls by @​jaruwat-panturat in #​6146
• feat: support service account impersonation when using Workload Identity Federation with a k8s service account by @​zoomoid in #​5707
• fix: remove getHostByName from template funcs by @​moolen in #​6164
• ref(kubernetes): move auth package from kubernetes to esutils by @​alekc in #​6149
• docs: fix templating.md by @​dangbert in #​6168
• fix(onepasswordsdk): support native 1Password item IDs in findItem by @​LeahArmstrong in #​6167
• docs(ovhcloud): fix heterogeneous configuration documentation by @​ldesauw in #​6169
• docs: add OVHcloud in ADOPTERS by @​scraly in #​6172
• fix(docs): resolve macro syntax error in templating guide by @​ManvithaP-hub in #​6171
• chore: rip out sprig dependency by @​Skarlso in #​6170
• chore: fix jose cve by @​Skarlso in #​6178
• docs: document correct htpasswd function usage by @​Atomsoldat in #​6177
• feat(pushsecret): add dataTo support for bulk secret pushing by @​mohamed-rekiba in #​5850
• docs: add existing blog post: ESO integration with ovhcloud secret manager with vault provider by @​scraly in #​6190
• feat: move experimental-enable-vault-token-cache out of experimental and add expiry to validation by @​sfotony in #​5397
• fix: prevent feedback loop by @​moolen in #​6021
• fix: code scanning issues by @​Skarlso in #​6063
• feat: add source null byte policy by @​knelasevero in #​6194
• fix(test): fix broken test from automerge rebase by @​knelasevero in #​6199
• fix(aws): handle empty resource policy in PushSecret for SecretsManager by @​maks3201 in #​6145
• feat(github): add orgSecretVisibility field to GithubProvider by @​iamnoah in #​6202
• feat(onepasswordSDK): multi-field and complete PushSecret by @​Dariusch in #​6187
• feat(vault): add VaultRole attribute for TLS auth by @​RicoGunawan12 in #​6160
• chore: bump go version to 1.26.2 by @​Skarlso in #​6203

Dependencies

• chore(deps): bump actions/cache from 5.0.3 to 5.0.4 by @​dependabot[bot] in #​6121
• chore(deps): bump mkdocs-material from 9.7.5 to 9.7.6 in /hack/api-docs by @​dependabot[bot] in #​6125
• chore(deps): bump ubi9/ubi from 6ed9f6f to 1fc04e8 by @​dependabot[bot] in #​6119
• chore(deps): bump azure/login from 2.3.0 to 3.0.0 by @​dependabot[bot] in #​6120
• chore(deps): bump codecov/codecov-action from 5.5.2 to 5.5.3 by @​dependabot[bot] in #​6124
• chore(deps): bump github/codeql-action from 4.32.6 to 4.34.1 by @​dependabot[bot] in #​6122
• chore(deps): bump anchore/sbom-action from 0.23.1 to 0.24.0 by @​dependabot[bot] in #​6123
• chore(deps): bump importlib-metadata from 8.7.1 to 9.0.0 in /hack/api-docs by @​dependabot[bot] in #​6126
• chore(deps): bump sigstore/cosign-installer from 4.1.0 to 4.1.1 by @​dependabot[bot] in #​6154
• chore(deps): bump pymdown-extensions from 10.21 to 10.21.2 in /hack/api-docs by @​dependabot[bot] in #​6157
• chore(deps): bump actions/setup-go from 6.3.0 to 6.4.0 by @​dependabot[bot] in #​6151
• chore(deps): bump github/codeql-action from 4.34.1 to 4.35.1 by @​dependabot[bot] in #​6152
• chore(deps): bump dependabot/fetch-metadata from 2.5.0 to 3.0.0 by @​dependabot[bot] in #​6153
• chore(deps): bump pygments from 2.19.2 to 2.20.0 in /hack/api-docs by @​dependabot[bot] in #​6155
• chore(deps): bump regex from 2026.2.28 to 2026.3.32 in /hack/api-docs by @​dependabot[bot] in #​6156
• chore(deps): bump requests from 2.32.5 to 2.33.0 in /hack/api-docs by @​dependabot[bot] in #​6158
• chore(deps): bump ubi9/ubi from 1fc04e8 to 9e6e193 by @​dependabot[bot] in #​6150
• chore(deps): bump step-security/harden-runner from 2.16.0 to 2.16.1 by @​dependabot[bot] in #​6180
• chore(deps): bump charset-normalizer from 3.4.6 to 3.4.7 in /hack/api-docs by @​dependabot[bot] in #​6183
• chore(deps): bump click from 8.3.1 to 8.3.2 in /hack/api-docs by @​dependabot[bot] in #​6185
• chore(deps): bump fossas/fossa-action from 1.8.0 to 1.9.0 by @​dependabot[bot] in #​6181
• chore(deps): bump docker/login-action from 4.0.0 to 4.1.0 by @​dependabot[bot] in #​6182
• chore(deps): bump regex from 2026.3.32 to 2026.4.4 in /hack/api-docs by @​dependabot[bot] in #​6184

New Contributors

• @​MindTooth made their first contribution in #​6136
• @​ldesauw made their first contribution in #​6101
• @​pr0ton11 made their first contribution in #​6031
• @​zoomoid made their first contribution in #​5707
• @​dangbert made their first contribution in #​6168
• @​LeahArmstrong made their first contribution in #​6167
• @​scraly made their first contribution in #​6172
• @​ManvithaP-hub made their first contribution in #​6171
• @​Atomsoldat made their first contribution in #​6177
• @​mohamed-rekiba made their first contribution in #​5850
• @​sfotony made their first contribution in #​5397
• @​maks3201 made their first contribution in #​6145
• @​iamnoah made their first contribution in #​6202
• @​RicoGunawan12 made their first contribution in #​6160

Full Changelog: external-secrets/external-secrets@v2.2.0...v2.3.0

v2.2.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.2.0
Image: ghcr.io/external-secrets/external-secrets:v2.2.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.2.0-ubi-boringssl

Breaking change

If you are using Flux + OCIRepository to fetch External Secrets Operator charts, please update your object to use a Layer selector:

  apiVersion: source.toolkit.fluxcd.io/v1
  kind: OCIRepository
  metadata:
    name: eso-oci
  spec:
    interval: 1m0s
    provider: generic
    ref:
      tag: 2.2.0
    url: oci://ghcr.io/external-secrets/charts/external-secrets
    layerSelector:
      mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip"
      operation: extract

What's Changed

General

• chore: release charts v2.1.0 by @​Skarlso in #​6030
• chore: fix the stability doc by @​Skarlso in #​6035
• fix(security): Fix vulnerabilities by @​othomann in #​6052
• fix(aws): sync tags and resource policy even when secret value unchanged by @​evs-secops in #​6025
• fix: publish now uses docker build v4 which required some changes by @​Skarlso in #​6062
• feat(gcpsm): auto-detect projectID from GCP metadata server by @​patjlm in #​5922
• chore(templating): Remove years in license and their checks by @​evrardj-roche in #​5955
• docs: Add Roche to official ADOPTERS by @​evrardj-roche in #​6076
• feat: Add Last Sync column to ExternalSecret and PushSecret printers by @​jaruwat-panturat in #​6068
• fix(onepassword): support native item IDs by @​chadxz in #​6073
• feat: extract LGTM processor to external JS file with tests by @​mateenali66 in #​6074
• feat: fail fast if LGTM label does not exist in repository by @​mateenali66 in #​6078
• feat(passbolt): add support for Passbolt V5 API by @​cedricherzog-passbolt in #​5919
• fix(infisical): dataFrom.find.path should filter by secret path not name by @​johnvox in #​6086
• fix: disable the priority queue which misbehaves at scale by @​Skarlso in #​6083
• chore: update go version to 1.26.1 by @​Skarlso in #​6072
• docs(aws): fix PushSecret metadata indentation in resource policy exa... by @​Br1an67 in #​6056
• fix(aws): prevent EC2 IMDS fallback when explicit credentials are pro... by @​Br1an67 in #​6036
• feat(templating): Add certSANs function to extract SANs from certificates by @​mzdeb in #​6058
• docs: document template.metadata labels/annotations behavior by @​lucpas in #​6102
• fix: CODEOWNERS are seriously out of date by @​Skarlso in #​6106
• feat(helm): add readinessProbe support for external-secrets deployment by @​AlexOQ in #​5831
• fix: update grpc for CVE-2026-33186 by [@​Skarlso](https://redirect.github.com/Skar

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[devex-sa]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.