External Secrets Files

Image: ghcr.io/external-secrets/external-secrets:v2.9.0 Image: ghcr.io/external-secrets/external-secrets:v2.9.0-ubi Image: ghcr.io/external-secrets/external-secrets:v2.9.0-ubi-boringssl

What's Changed

General

• chore: release helm chart 2.8.0 by @Skarlso in https://github.com/external-secrets/external-secrets/pull/6656
• fix(conjur): add InstallTimeout to helm chart installation and pin server image version by @alekc in https://github.com/external-secrets/external-secrets/pull/6658
• fix(deps): bump grpc-go for GHSA-hrxh-6v49-42gf by @evrardj-roche in https://github.com/external-secrets/external-secrets/pull/6695
• feat(charts): add opt-in schedulerName and runtimeClassName to the pods by @somaz94 in https://github.com/external-secrets/external-secrets/pull/6675
• fix(webhookconfig): use a constant Eventf format by @evrardj-roche in https://github.com/external-secrets/external-secrets/pull/6699
• fix: bump codeqls together by @evrardj-roche in https://github.com/external-secrets/external-secrets/pull/6707
• fix(security): install crane in a reliable way and fix code scanning issue by @Skarlso in https://github.com/external-secrets/external-secrets/pull/6712
• chore: Fix cve-2026-56852 by bump golang.org/x/text@0.40 by @evrardj-roche in https://github.com/external-secrets/external-secrets/pull/6734
• chore(fix): template abuse for secret values by @Skarlso in https://github.com/external-secrets/external-secrets/pull/6730
• chore: Bump controller runtime by @evrardj-roche in https://github.com/external-secrets/external-secrets/pull/6703
• chore(fix): moved the validation further up the chain by @Skarlso in https://github.com/external-secrets/external-secrets/pull/6735
• fix: pin all dependencies by @evrardj-roche in https://github.com/external-secrets/external-secrets/pull/6727
• feat(e2e): implement fan-out matrix validation and credential scoping by @alekc in https://github.com/external-secrets/external-secrets/pull/6660
• fix(akeyless): use local errors.As target to avoid data race by @HYPERVAPOR in https://github.com/external-secrets/external-secrets/pull/6749
• test(crd): add e2e suite and CI leg for the CRD provider by @alekc in https://github.com/external-secrets/external-secrets/pull/6742
• docs(webhook): add debugging guide and fix stale secret-label claim by @alekc in https://github.com/external-secrets/external-secrets/pull/6746
• test(e2e): skip the global addon uninstall on disposable clusters by @alekc in https://github.com/external-secrets/external-secrets/pull/6780
• feat: add environments support to 1Password SDK by @Skarlso in https://github.com/external-secrets/external-secrets/pull/6318
• fix(akeyless): stop reporting API failures as a missing item by @alekc in https://github.com/external-secrets/external-secrets/pull/6753
• fix(makefile): harden clean worktree check by @evrardj-roche in https://github.com/external-secrets/external-secrets/pull/6702
• fix: support docs builds from worktrees by @evrardj-roche in https://github.com/external-secrets/external-secrets/pull/6741
• feat(cache): add atomic ContainsOrAdd by @evrardj-roche in https://github.com/external-secrets/external-secrets/pull/6706
• fix: omit empty AWS secret replica regions by @goutamadwant in https://github.com/external-secrets/external-secrets/pull/6596
• fix: Follow up PR6318 by @evrardj-roche in https://github.com/external-secrets/external-secrets/pull/6782
• feat: Show sponsoring of Roche by @evrardj-roche in https://github.com/external-secrets/external-secrets/pull/6790
• fix(e2e): make the oracle suite runnable by @alekc in https://github.com/external-secrets/external-secrets/pull/6770
• chore: temporarily allow GHSA-gcjh-h69q-9w9g by @evrardj-roche in https://github.com/external-secrets/external-secrets/pull/6795
• fix(api): stop defaulting optional ExternalSecret strategy fields by @alekc in https://github.com/external-secrets/external-secrets/pull/6798
• chore: remove/cleanup remaining tools from tools.go. by @evrardj-roche in https://github.com/external-secrets/external-secrets/pull/6786
• chore: Cleanup sponsors dead links by @evrardj-roche in https://github.com/external-secrets/external-secrets/pull/6791
• fix(aws): detach replicated regions before deleting AWS SecretsManager secret by @cmoscofian in https://github.com/external-secrets/external-secrets/pull/6687
• chore: fix enable cache being removed on installCRD=false by @Skarlso in https://github.com/external-secrets/external-secrets/pull/6799

Dependencies

• chore(deps): bump golang from 0178a64 to 0178a64 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6663
• chore(deps): bump mkdocs-material from 9.7.6 to 9.7.7 in /hack/api-docs by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6669
• chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.1 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6674
• chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6667
• chore(deps): bump fkirc/skip-duplicate-actions from 5.3.1 to 5.3.2 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6671
• chore(deps): bump actions/stale from 10.3.0 to 10.4.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6673
• chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6672
• chore(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 6.2.2 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6670
• chore(deps): bump distroless/static from d5f030c to 9197324 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6662
• chore(deps): bump ubi9/ubi from 8bf0e8f to 2a6bd69 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6661
• chore(deps): bump actions/setup-go from 6.0.0 to 7.0.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6664
• chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6665
• chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.3 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6666
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6715
• chore(deps): bump aws-actions/configure-aws-credentials from 6.2.2 to 6.2.3 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6717
• chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6722
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.3 in the codeql group across 1 directory by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6713
• chore(deps): bump google-github-actions/auth from [fc2174] to [cd3439] by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6714
• chore(deps): bump actions/cache from 4.2.4 to 6.1.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6716
• chore(deps): bump actions/labeler from 6.1.0 to 7.0.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6718
• chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.2.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6719
• chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6720
• chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6723
• chore(deps): bump docker/login-action from 4.4.0 to 4.5.2 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6736
• chore(deps): bump actions/stale from 10.4.0 to 11.0.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6738
• chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6751
• chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6752
• chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6801
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6802
• chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6805
• chore(deps): bump azure/login from 3.0.0 to 3.0.1 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6804
• chore(deps): bump google-github-actions/auth from [cd3439] to [120604] by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6737
• chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.1 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6803

New Contributors

• @HYPERVAPOR made their first contribution in https://github.com/external-secrets/external-secrets/pull/6749
• @goutamadwant made their first contribution in https://github.com/external-secrets/external-secrets/pull/6596

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.8.0...v2.9.0