chore(deps): update external-secrets to v2 by bde-dev · Pull Request #327 · bde-dev/homelab

bde-dev · 2026-07-27T19:09:29Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
external-secrets	major	`0.18.2` → `2.8.0`
external-secrets/external-secrets	major	`v0.18.2` → `v2.8.0`

Release Notes

external-secrets/external-secrets (external-secrets)

`v2.8.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.8.0
Image: ghcr.io/external-secrets/external-secrets:v2.8.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.8.0-ubi-boringssl

What's Changed

General

chore: release helm chart 2.7.0 by @Skarlso in #6529
docs(barbican): correct find semantics and document property/extract by @alekc in #6531
docs(gcp): use external-secrets.io/v1 in SecretStore examples by @alekc in #6563
feat(generators): add GitLab deploy token generator by @alekc in #6493
fix(barbican): validate store config and fix SecretExists error message by @alekc in #6534
docs(beyondtrust): fix capability matrix and document decrypt/separator by @alekc in #6535
feat: Make SecondsToLive optional for Grafana generator by @jaruwat-panturat in #6479
docs: add missing generators to ClusterGenerator spec snippet by @jaruwat-panturat in #6590
docs(doppler): fix download format list and heading levels by @alekc in #6559
docs(fortanix): add to support matrix and tidy provider page by @alekc in #6562
docs(yandex): fix Lockbox referent cell and add Certificate Manager rows by @alekc in #6585
docs(volcengine): mark referent authentication as supported by @alekc in #6584
docs(senhasegura): mark deletion + referent in matrix and fix title by @alekc in #6583
docs(scaleway): mark referent auth in matrix and fix headings by @alekc in #6581
docs(pulumi): correct find/referent matrix cells and fix headings by @alekc in #6578
docs(previder): correct find/referent matrix cells and fix headings by @alekc in #6577
docs(1password): mark SDK find support in matrix and promote titles by @alekc in #6568
feat(charts): Add aggregateToAdmin toggle by @illrill in #6586
docs(providers): consolidate 11 conflicting provider-doc PRs by @alekc in #6592
feat(charts): add startupProbe support to webhook deployment by @alpcanaydin in #6612
feat(akeyless): support azure_ad Workload Identity via serviceAccountRef by @baraka-akeyless in #6530
docs(kubernetes): fix invalid tab indentation and heading levels by @alekc in #6565
docs(dvls): mark DeletionPolicy supported and fix page title by @alekc in #6557
docs(bitwarden): fix find behaviour, find-by-name rules, and admonitions by @alekc in #6551
docs(github): add to support matrix, fix auth field, tidy page by @alekc in #6564
docs: Improve explanations of pem_chain by @evrardjp in #6623
feat: Make our stance regarding AI usage more explicit. by @evrardj-roche in #6621
fix(barbican): treat find.name.regexp as a regexp, not an exact match by @arpitjain099 in #6614
chore: update go version 1.26.5 - Fix CVE-2026-39822 by @alekc in #6631
ref(testing): change the e2e workflow to separate building stage from e2e stage (and free up resources) by @alekc in #6634
chore: updating ok-to-test to allow interim maintainers by @gusfcarvalho in #6638
fix(onepassword): support PushSecret IfNotExists by @civilizedBaboon in #6646
fix(testing): check out PR head in fork e2e instead of main by @alekc in #6647
fix(secretserver): validate store and map fields correctly by @dbinger in #6616
feat(charts): Add optional networkPolicy by @jcpunk in #5779
feat(akeyless): add SecretStore ignoreCache to bypass Gateway cache by @baraka-akeyless in #6507
feat(provider): implement AWS Certificate Manager provider by @dsp0x4 in #6117
feat: expose more values for custom metadata for vault v2 by @Skarlso in #6652
clean: Remove duplicate code by @evrardj-roche in #6629
feat: configurable leader election lease timings by @izz-linux in #6644
fix(akeyless): support dataFrom.extract.property for nested JSON by @baraka-akeyless in #6633
feat(conjur): Certificate Auth support by @hdabrowski in #6393
docs(aws): restore dropped access section and document missing fields by @alekc in #6517
feat(secretserver): support authentication via access token by @sumanpal97 in #6597
docs(secretserver): document authentication, key formats, property behavior, and limitations by @dbinger in #6619
feat(release): Support reading values from kubernetes CRD by @alekc in #6211
clean: Standardize and friendly name for validations policies by @evrardj-roche in #6630
feat: add CreateOrMerge creation policy for ExternalSecrets by @alekc in #6641
feat(core): accept duration string for SecretStore refreshInterval by @alekc in #6594
fix(beyondtrust): validate store without panicking on API key auth by @emmayusufu in #6553
fix(oracle): cache default WorkloadIdentity provider to prevent tcp port exhaustion by @Ashutosh-3601 in #6421

Dependencies

chore(deps): bump golang from 3ad5730 to 3ad5730 by @dependabot[bot] in #6538
chore(deps): bump ubi9/ubi from 1b99266 to 37a1589 by @dependabot[bot] in #6537
chore(deps): bump golang from 5f68ec6 to b305420 in /e2e by @dependabot[bot] in #6539
chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 by @dependabot[bot] in #6540
chore(deps): bump aws-actions/configure-aws-credentials from 6.2.0 to 6.2.1 by @dependabot[bot] in #6542
chore(deps): bump actions/attest-build-provenance from 4.1.0 to 4.1.1 by @dependabot[bot] in #6543
chore(deps): bump azure/setup-helm from 5.0.0 to 5.0.1 by @dependabot[bot] in #6544
chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #6541
chore(deps): bump actions/cache from 5.0.5 to 6.1.0 by @dependabot[bot] in #6545
chore(deps): bump golang from 3ad5730 to 3ad5730 by @dependabot[bot] in #6600
chore(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6606
chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6603
chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by @dependabot[bot] in #6607
chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3 by @dependabot[bot] in #6604
chore(deps): bump github/codeql-action/init from 4.36.2 to 4.36.3 by @dependabot[bot] in #6608
chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by @dependabot[bot] in #6605
chore(deps): bump docker/login-action from 4.2.0 to 4.4.0 by @dependabot[bot] in #6602
chore(deps): bump fossas/fossa-action from 1.9.0 to 2.0.0 by @dependabot[bot] in #6601
chore(deps): bump ubi9/ubi from 37a1589 to 8bf0e8f by @dependabot[bot] in #6599
chore(deps): bump golang from 1.26.4 to 1.26.5 by @dependabot[bot] in #6636
chore(deps): bump distroless/static from 3592aa8 to d5f030c by @dependabot[bot] in #6635

New Contributors

@alpcanaydin made their first contribution in #6612
@baraka-akeyless made their first contribution in #6530
@arpitjain099 made their first contribution in #6614
@civilizedBaboon made their first contribution in #6646
@dbinger made their first contribution in #6616
@dsp0x4 made their first contribution in #6117
@izz-linux made their first contribution in #6644
@hdabrowski made their first contribution in #6393
@sumanpal97 made their first contribution in #6597
@emmayusufu made their first contribution in #6553
@Ashutosh-3601 made their first contribution in #6421

Full Changelog: external-secrets/external-secrets@v2.7.0...v2.8.0

`v2.7.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.7.0
Image: ghcr.io/external-secrets/external-secrets:v2.7.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.7.0-ubi-boringssl

What's Changed

General

chore: release helm charts 2.6.0 by @Skarlso in #6427
test: add Infisical provider e2e suite by @alekc in #6415
docs: fix discrepancies and add missing documentation for GitLab provider by @alekc in #6430
docs: fix discrepancies and add missing documentation for Infisical provider by @alekc in #6431
feat(templating): add hexdec function by @tstenner in #6422
fix(volcengine): honor secretRef.namespace for ClusterSecretStore by @ruslan-rm in #6423
docs(core): correct CRD examples and document missing fields by @alekc in #6441
feat(provider): initial dedicated OpenBao provider by @phil9909 in #6405
feat(onepasswordsdk): implement GetAllSecrets by @calebmckay in #6445
feat(controller): log secret deletions and data-key changes by @alekc in #6443
feat: Add BeyondTrust WorkloadCredentials provider by @sdahal-bt in #5999
fix(charts): truncate component names to stay within 63-char DNS limit by @alekc in #6428
docs(gitops-fluxcd): fix webhook race condition in Flux deployment guide by @alekc in #6455
fix: no need for the field to have a default if it can be omitted by @knelasevero in #6453
fix(templating): preserve mixed-case in generic target paths by @alekc in #6459
docs(generator): document Password secretKeys for multiple keys by @alekc in #6440
docs: Update deprecated field in docs by @evrardj-roche in #6456
chore(deps): Bump passbolt SDK to v0.8.0 by @cedricherzog-passbolt in #6447
chore(charts): Expose storeRequeueInterval in helm charts by @jfhcagip in #6140
feat(openbao): support custom CAs via caBundle and caProvider by @phil9909 in #6461
feat(ngrok): use API filtering for vault and secret lookups by @jonstacks in #6376
fix: remove broken link from blog section by @riccardomc in #6465
chore: fix the template parser for resolving slice notations by @Skarlso in #6449
fix: bump docs deps for python3.13 by @evrardj-roche in #6475
fix(kubernetes): replace entire remote secret when pushing rather than merging by @riccardomc in #6485
feat(infisical): return NoSecretErr on 404 and add PushSecret support by @alekc in #6434
feat(AWS): add replicationLocations to AWS SecretsManager provider by @cmoscofian in #6451
feat(openbao): add auth.userPass auth method by @phil9909 in #6492
chore(deps): Bump github.com/pulumi/esc-sdk/sdk to v0.14.0 by @phil9909 in #6495
chore(onepasswordsdk): fix the caching logic and cleanup the code a bit by @Skarlso in #6466
feat(charts): scope cert-controller RBAC to managed CRDs and webhook secret by @somaz94 in #6481
test(ngrok): Remove over complicated mocks by @jonstacks in #6483
chore: Unpin mike by @evrardj-roche in #6477
docs(akeyless): fix errors and expand provider documentation by @alekc in #6506
chore: update go sys net and crypto libs by @Skarlso in #6511
chore(onepasswordsdk): enable the GetAllSecrets and GetSecret unit test and fix it by @Skarlso in #6513
feat(infisical): allow organization slug to be set in secret scope by @mathnogueira in #6508
feat(templating): decode templateFrom values by @evrardj-roche in #6482
chore(bug): fix missing lgtm runner script from the workflow by @Skarlso in #6512
fix(akeyless): return ReadWrite so PushSecret is routed by @alekc in #6515
feat(openbao): add auth.appRole auth method by @phil9909 in #6497
feat(externalsecret): add SyncWindows to gate periodic refresh by @alekc in #6452
docs(azure): correct Azure Stack example version and note expiry limit by @alekc in #6522
feat(openbao): add support for OpenBao Namespaces by @phil9909 in #6527
fix(github): preserve selected repositories on org secret update by @alekc in #6519
docs(azure): list WorkloadIdentity in authType field description by @alekc in #6523
feat(doppler): include HTTP status in API errors by @alekc in #6489

Dependencies

chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #6437
chore(deps): bump github/codeql-action from 4.36.0 to 4.36.2 by @dependabot[bot] in #6438
chore(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 by @dependabot[bot] in #6435
chore(deps): bump idna from 3.17 to 3.18 in /hack/api-docs by @dependabot[bot] in #6439
chore(deps): bump ubi9/ubi from 8942b73 to 46d19c1 by @dependabot[bot] in #6436
chore(deps): bump platformdirs from 4.9.6 to 4.10.0 in /hack/api-docs by @dependabot[bot] in #6410
chore(deps): bump golang from f23e8b2 to 7a3e500 by @dependabot[bot] in #6468
chore(deps): bump golang from 5d2b868 to 5f68ec6 in /e2e by @dependabot[bot] in #6471
chore(deps): bump tornado from 6.5.6 to 6.5.7 in /hack/api-docs by @dependabot[bot] in #6473
chore(deps): bump alpine from 3.23.4 to 3.24.0 in /e2e by @dependabot[bot] in #6470
chore(deps): bump alpine from 5b10f43 to a2d49ea by @dependabot[bot] in #6469
chore(deps): bump ubi9/ubi from 46d19c1 to 1b99266 by @dependabot[bot] in #6467
chore(deps): bump alpine from a2d49ea to 28bd5fe in /hack/api-docs by @dependabot[bot] in #6472
chore(deps): bump alpine from 3.24.0 to 3.24.1 in /e2e by @dependabot[bot] in #6498
chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #6500
chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 by @dependabot[bot] in #6502
chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @dependabot[bot] in #6503
chore(deps): bump alpine from a2d49ea to 28bd5fe by @dependabot[bot] in #6499
chore(deps): bump golang from 7a3e500 to 3ad5730 by @dependabot[bot] in #6501

New Contributors

@tstenner made their first contribution in #6422
@ruslan-rm made their first contribution in #6423
@calebmckay made their first contribution in #6445
@sdahal-bt made their first contribution in #5999
@jfhcagip made their first contribution in #6140
@somaz94 made their first contribution in #6481
@mathnogueira made their first contribution in #6508

Full Changelog: external-secrets/external-secrets@v2.6.0...v2.7.0

`v2.6.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.6.0
Image: ghcr.io/external-secrets/external-secrets:v2.6.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.6.0-ubi-boringssl

What's Changed

General

chore: release helm chart 2.5.0 by @Skarlso in #6352
feat(keeper): implement provider_api_calls_count metric by @m-k8s in #6345
docs(gcpsm): updates Google Secret Manager authentication guide with WIF usage by @bharath-b-rh in #6356
feat(release): PB-51302 - External secret should support v5-custom-fields resource type by @cedricherzog-passbolt in #6377
feat(testing): OpenBao e2e test by @phil9909 in #6396
docs: Explanation of our labels by @evrardj-roche in #6306
docs: add AGENTS.md and AI setup guide for ESO by @rowanruseler in #6141
fix(makefile): clean up cross-submodule go.mod churn after make test by @alekc in #6378
fix(provider): align TokenRequest body namespace with URL namespace by @alekc in #6420
fix(build): use buildx --load and non-registry image tag by @alekc in #6419
fix(charts): render PDB spec when minAvailable or maxUnavailable is zero by @blindrood in #6360
chore: update go version 1.26.4 by @Skarlso in #6426

Dependencies

chore(deps): bump golang from 91eda97 to 91eda97 by @dependabot[bot] in #6363
chore(deps): bump pymdown-extensions from 10.21.2 to 10.21.3 in /hack/api-docs by @dependabot[bot] in #6370
chore(deps): bump hashicorp/setup-terraform from 4.0.0 to 4.0.1 by @dependabot[bot] in #6364
chore(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 by @dependabot[bot] in #6365
chore(deps): bump step-security/harden-runner from 2.19.1 to 2.19.4 by @dependabot[bot] in #6366
chore(deps): bump github/codeql-action from 4.35.4 to 4.36.0 by @dependabot[bot] in #6368
chore(deps): bump distroless/static from 47b2d72 to 3592aa8 by @dependabot[bot] in #6362
chore(deps): bump ubi9/ubi from 2323fcf to 151fc1b by @dependabot[bot] in #6361
chore(deps): bump actions/create-github-app-token from 3.1.1 to 3.2.0 by @dependabot[bot] in #6367
chore(deps): bump idna from 3.14 to 3.16 in /hack/api-docs by @dependabot[bot] in #6369
chore(deps): bump golang from 91eda97 to 91eda97 by @dependabot[bot] in #6383
chore(deps): bump golang from 252599a to 386d475 in /e2e by @dependabot[bot] in #6389
chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 by @dependabot[bot] in #6384
chore(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 by @dependabot[bot] in #6387
chore(deps): bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6386
chore(deps): bump actions/stale from 10.2.0 to 10.3.0 by @dependabot[bot] in #6388
chore(deps): bump zipp from 3.23.1 to 4.1.0 in /hack/api-docs by @dependabot[bot] in #6390
chore(deps): bump click from 8.3.3 to 8.4.1 in /hack/api-docs by @dependabot[bot] in #6391
chore(deps): bump certifi from 2026.4.22 to 2026.5.20 in /hack/api-docs by @dependabot[bot] in #6392
chore(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6385
chore(deps): bump requests from 2.33.1 to 2.34.2 in /hack/api-docs by @dependabot[bot] in #6372
chore(deps): bump tornado from 6.5.5 to 6.5.6 in /hack/api-docs by @dependabot[bot] in #6412
chore(deps): bump ubi9/ubi from 151fc1b to 8942b73 by @dependabot[bot] in #6407
chore(deps): bump aws-actions/configure-aws-credentials from 6.1.1 to 6.2.0 by @dependabot[bot] in #6408
chore(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6409
chore(deps): bump idna from 3.16 to 3.17 in /hack/api-docs by @dependabot[bot] in #6411

New Contributors

@m-k8s made their first contribution in #6345
@phil9909 made their first contribution in #6396
@blindrood made their first contribution in #6360

Full Changelog: external-secrets/external-secrets@v2.5.0...v2.6.0

`v2.5.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.5.0
Image: ghcr.io/external-secrets/external-secrets:v2.5.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.5.0-ubi-boringssl

What's Changed

General

chore: release chart for v2.4.1 by @Skarlso in #6293
fix(doc): Adds missing doc reference for VaultDynamicSecret example using GET by @bharath-b-rh in #6296
feat(charts): make serviceaccounts/token create RBAC rule conditional by @kriszkern in #6295
ref: delete duplication of applyOwnership logic by @jaruwat-panturat in #6301
feat: add Pulumi OIDC-based authentication by @johnstonmatt in #5893
fix: datarace in fake runtime test and push secret test by @Skarlso in #6300
docs(release): Update docs to build for arm for bitwarden-cli by @Senk02 in #6312
feat: add healthz check for liveness probe to cert and webhook by @Skarlso in #6319
chore: bump go version 1.26.3 by @Skarlso in #6339
fix(charts): gate externalsecrets write RBAC on processClusterExternalSecret by @kriszkern in #6332
feat(gcp): issue-5790: optional GCP service account email for WIF impersonation by @bharath-b-rh in #6273
ref(beyondtrust): BIPS-32651 add API v3.2 support for create Secrets by @btfhernandez in #6309
fix(onepassword): return fresh provider instance from NewClient to avoid wrong-vault race by @duizabojul in #6334
docs: add Rootline to ADOPTERS.md by @daanschipper in #6342
feat(charts): default scopedNamespace to .Release.Namespace when scopedRBAC is true by @kriszkern in #6343
docs: add blank lines before lists by @chlab in #6336
chore(doc): fix Azure role name typo by @hobti01 in #6335
feat(security): Enable Authentication and Authorization for Metrics Endpoint using FilterProvider by @Zacky3181V in #5574
feat: inject kube context as STS session tags by @robertchildresscfa in #6311
fix(charts): remove stale args guard in controller deployment by @kriszkern in #6347
fix: provider/infisical provider sub-folder references in remoteRef.key by @varonix0 in #6338

Dependencies

chore(deps): bump golang from 4f4ab2c to 47ce563 in /e2e by @dependabot[bot] in #6286
chore(deps): bump click from 8.3.2 to 8.3.3 in /hack/api-docs by @dependabot[bot] in #6287
chore(deps): bump certifi from 2026.2.25 to 2026.4.22 in /hack/api-docs by @dependabot[bot] in #6288
chore(deps): bump pathspec from 1.0.4 to 1.1.1 in /hack/api-docs by @dependabot[bot] in #6291
chore(deps): bump idna from 3.11 to 3.13 in /hack/api-docs by @dependabot[bot] in #6290
chore(deps): bump packaging from 26.1 to 26.2 in /hack/api-docs by @dependabot[bot] in #6289
chore(deps): bump step-security/harden-runner from 2.19.0 to 2.19.1 by @dependabot[bot] in #6304
chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by @dependabot[bot] in #6305
chore(deps): bump golang from 1.26.2 to 1.26.3 by @dependabot[bot] in #6320
chore(deps): bump golang from 1.26.2-bookworm to 1.26.3-bookworm in /e2e by @dependabot[bot] in #6327
chore(deps): bump ubi9/ubi from fd3612e to 2323fcf by @dependabot[bot] in #6321
chore(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @dependabot[bot] in #6322
chore(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 by @dependabot[bot] in #6323
chore(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2 by @dependabot[bot] in #6325
chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by @dependabot[bot] in #6324
chore(deps): bump actions/labeler from 6.0.1 to 6.1.0 by @dependabot[bot] in #6326
chore(deps): bump idna from 3.13 to 3.14 in /hack/api-docs by @dependabot[bot] in #6328
chore(deps): bump urllib3 from 2.6.3 to 2.7.0 in /hack/api-docs by @dependabot[bot] in #6329
chore(deps): bump regex from 2026.4.4 to 2026.5.9 in /hack/api-docs by @dependabot[bot] in #6330

New Contributors

@kriszkern made their first contribution in #6295
@johnstonmatt made their first contribution in #5893
@Senk02 made their first contribution in #6312
@duizabojul made their first contribution in #6334
@daanschipper made their first contribution in #6342
@chlab made their first contribution in #6336
@hobti01 made their first contribution in #6335
@Zacky3181V made their first contribution in #5574
@robertchildresscfa made their first contribution in #6311

Full Changelog: external-secrets/external-secrets@v2.4.1...v2.5.0

`v2.4.1`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.4.1
Image: ghcr.io/external-secrets/external-secrets:v2.4.1-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.4.1-ubi-boringssl

What's Changed

General

chore: release chart for v2.4.0 by @Skarlso in #6277
feat(gcp): support multiple replicationLocations on PushSecret by @alliasgher in #6225
feat(passbolt): add custom CA bundle / CA provider support by @alliasgher in #6224
feat(azure): add contentType support for PushSecret by @ppatel1604 in #6249
feat(charts): add liveness probes to cert-controller and webhook by @mattcarp12 in [#6147](https://redirect.gith

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

bde-dev · 2026-07-27T20:01:17Z

AI Assessment

Field	Value
Decision	NEEDS_REVIEW
Risk Level	HIGH
Update Type	MAJOR
Component	external-secrets
Version	0.18.2 -> 2.8.0
Breaking Changes	false

Analysis

This is a major version update to a core infrastructure component (external-secrets for Kubernetes secret management). While release notes don't explicitly list breaking changes, the scope of changes is substantial. The component is listed as HIGH risk in the homelab classification. The jump from v0.18.2 to v2.8.0 suggests significant internal refactoring and API enhancements. A homelab environment should thoroughly validate configuration compatibility and test in a staging environment before applying to production.

Recommendation

MANUAL REVIEW REQUIRED. Before merging: 1) Review existing ExternalSecret and SecretStore configurations for compatibility 2) Test the upgrade in a staging/dev cluster first 3) Check release notes between v0.18.2 and v2.8.0 for any deprecations 4) Validate all secret providers used in the homelab are still supported 5) Plan for a maintenance window during testing. This update is not suitable for automatic merging due to infrastructure criticality.

Analyzed by n8n AI Agent using Claude

chore(deps): update external-secrets to v2

ae92574

bde-dev added the infrastructure label Jul 27, 2026

Navigation Menu

chore(deps): update external-secrets to v2 - #327

chore(deps): update external-secrets to v2#327
bde-dev wants to merge 1 commit into
mainfrom
renovate/major-external-secrets

bde-dev commented Jul 27, 2026

Uh oh!

bde-dev commented Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

bde-dev commented Jul 27, 2026

Release Notes

v2.8.0

What's Changed

General

Dependencies

New Contributors

v2.7.0

What's Changed

General

Dependencies

New Contributors

v2.6.0

What's Changed

General

Dependencies

New Contributors

v2.5.0

What's Changed

General

Dependencies

New Contributors

v2.4.1

What's Changed

General

Configuration

Uh oh!

bde-dev commented Jul 27, 2026

AI Assessment

Analysis

Recommendation

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

`v2.8.0`

`v2.7.0`

`v2.6.0`

`v2.5.0`

`v2.4.1`