[scality-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/cert-manager/cert-manager	v1.19.3 → v1.20.4

---

Release Notes

cert-manager/cert-manager (github.com/cert-manager/cert-manager)

v1.20.4

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

This patch release updates Go and several dependencies to fix reported security vulnerabilities, and fixes a bug where ingress-shim removed the applyset label from cached Ingress and Gateway objects.

All users should upgrade.

[!NOTE]
Security scanners still report three golang.org/x/crypto findings. None of them affects cert-manager and we do not plan to fix them in the 1.20 line.

• CVE-2026-56855 and CVE-2026-78662 are deadlocks in the golang.org/x/crypto/ssh connection multiplexer, triggered by a malicious SSH peer after a connection is established. cert-manager never opens an SSH connection. Only the controller links the ssh package, through vcert, which uses it to format a public key. The fix, golang.org/x/crypto v0.56.0, requires Go language version 1.26, which we will not adopt in a patch release. govulncheck confirms the vulnerable functions are not called.
• GO-2026-5932 marks golang.org/x/crypto/openpgp as unmaintained. cert-manager does not import that package and there is no fixed version.

cert-manager 1.21 already uses golang.org/x/crypto v0.56.0, so upgrade to 1.21 if you need a clean scan.

Changes by Kind

Bug or Regression

• Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects (#​9315, @​KR-Ravindra)

Other (Cleanup or Flake)

• Update Go to 1.26.5 and then 1.26.6, which include security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages (#​8995, @​wallrj-cyberark; #​9152, @​wallrj)
• Bump golang.org/x/net to v0.58.0, golang.org/x/text to v0.41.0 and golang.org/x/crypto to v0.55.0 to fix CVE-2026-46600, CVE-2026-56852 and CVE-2026-56854 (#​9040, @​wallrj-cyberark)
• Bump google.golang.org/grpc to v1.83.2 to fix CVE-2026-84304, CVE-2026-84445, CVE-2026-84303 and one further advisory (#​9062, #​9257, #​9316)
• Bump github.com/google/cel-go to v0.30.0 to fix a reported vulnerability (#​9070, #​9186)
• Bump software.sslmate.com/src/go-pkcs12 to v0.7.2 to fix a reported vulnerability (#​8988)
• Bump golang.org/x/mod, go.opentelemetry.io/otel and go.etcd.io/etcd/client/pkg/v3 to versions flagged by security scanners (#​9143, #​9071, #​9185)
• Update the distroless base images (#​8991, #​9024, #​9055, #​9325)
• The release staging process now signs metadata.json with cosign so the publish step can verify its authenticity (#​9090, @​FelixPhipps)

v1.20.3

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

This patch release fixes a security issue (GHSA-8rvj-mm4h-c258, HIGH) where the default cert-manager-edit aggregate ClusterRole granted namespace users permission to create ACME Challenge and Order resources directly. A user who could create a Challenge referencing a ClusterIssuer could supply attacker-controlled solver configuration while cert-manager loaded credentials from the ClusterIssuer's namespace, bypassing Issuer solver selectors (dnsZones, dnsNames, matchLabels). With the acme-dns provider specifically, this could disclose DNS credentials to an attacker-controlled endpoint.

This release also removes the issuer owner reference from Challenges which was blocking Challenge garbage collection, and updates Go to fix reported CVEs.

All users should upgrade.

[!WARNING]
Potentially breaking change: The cert-manager-edit aggregate ClusterRole no longer grants create for challenges.acme.cert-manager.io or create, patch, update for orders.acme.cert-manager.io. These resources are internal to cert-manager's ACME workflow and are not intended to be created or modified directly by users. If you have tooling or workflows that create Challenge or Order resources directly (outside of the normal Certificate → CertificateRequest → Order → Challenge flow), you will need to grant those permissions explicitly.

Changes by Kind

Bug or Regression

• Security (HIGH): Remove Challenge create and Order create, patch, update verbs from the cert-manager-edit aggregate ClusterRole (GHSA-8rvj-mm4h-c258). (#​8940, @​wallrj-cyberark)
• Remove issuer owner reference from challenges blocking challenge garbage collection (#​8759, @​cert-manager-bot)

Other (Cleanup or Flake)

• Bump go to 1.26.3, other deps to fix several govulncheck issues (#​8789, @​SgtCoDFish)
• Update Go to v1.26.4 to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 (#​8926, @​wallrj-cyberark)

v1.20.2

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.20.2 fixes invalid YAML generated in the Helm chart when both webhook.config
and webhook.volumes are defined, and bumps Go to 1.26.2 along with dependencies
to address reported vulnerabilities.

Changes by Kind

Bug or Regression

• Helm: Fix invalid YAML generated when both webhook.config and webhook.volumes are defined. (#​8665, @​cert-manager-bot)

Other (Cleanup or Flake)

• Bump go dependencies with reported vulnerabilities (#​8704, @​erikgb)
• Bump go to 1.26.2 (#​8703, @​erikgb)

v1.20.1

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.20.1 fixes an issue for OpenShift users that has to do with the finalizer RBAC, bumps gRPC to address a reported non-affecting vulnerability, and fixes a duplicate parentRef bug when both issuer config and annotations are present (Gateway API).

Bug or Regression

• Fixed duplicate parentRef bug when both issuer config and annotations are present. (#​8658, @​hjoshi123)
• Add missing issuer finalizer RBAC to the order controller to support owner references. This was preventing OpenShift users from being able to upgrade to v1.20.0. (#​8655, @​erikgb)
• Bump google.golang.org/grpc to fix vulnerability reported by scanners. This isn't a vulnerability that affects cert-manager, but we are bumping it because it is reported by scanners. (#​8657, @​erikgb)

v1.20.0

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.20.0 adds alpha support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta.

Changes by Kind

Feature

• Added a set of flags to permit setting NetworkPolicy across all deployed containers. Remove redundant global IP ranges from example policies. (#​8370, @​jcpunk)
• Added selectable fields to custom resource definitions for .spec.issuerRef.{group, kind, name} (#​8256, @​tareksha)
• Added support for specifying imagePullSecrets in the startupapicheck-job Helm template to enable pulling images from private registries. (#​8186, @​mathieu-clnk)
• Added 'extraContainers' helm chart value, allowing the deployment of arbitrary sidecar containers within the cert-manager operator pod. This can be used to support, for e.g., AWS IAM Roles Anywhere for Route53 DNS01 verification. (#​8355, @​dancmeyers)
• Added parentRef override annotations on the Certificate resource. (#​8518, @​hjoshi123)
• Added support for azure private zones for dns01 issuer. (#​8494, @​hjoshi123)
• Added support for configuring PEM decoding size limits, allowing operators to handle larger certificates and keys. (#​7642, @​robertlestak)
• Added support for unhealthyPodEvictionPolicy in PodDisruptionBudget (#​7728, @​jcpunk)
• For Venafi provider, read venafi.cert-manager.io/custom-fields annotation on Issuer/ClusterIssuer and use it as base with override/append capabilities on Certificate level. (#​8301, @​k0da)
• Improve error message when CA issuers are misconfigured to use a clashing secret name (#​8374, @​majiayu000)
• Introduce a new Ingress annotation acme.cert-manager.io/http01-ingress-ingressclassname to override http01.ingress.ingressClassName field in HTTP-01 challenge solvers. (#​8244, @​lunarwhite)
• Update global.nodeSelector to helm chart to perform a merge and allow for a single nodeSelector to be set across all services. (#​8195, @​StingRayZA)
• Vault issuers will now include the Vault server address as one of the default audiences on generated service account tokens. (#​8228, @​terinjokes)
• Added experimental XListenerSets feature gate (#​8394, @​hjoshi123)

Documentation

• Add GWAPI documentation to NOTES.TXT in helm chart (#​8353, @​jaxels10)

Bug or Regression

• Adds logs for cases when acme server returns us a fatal error in the order controller (#​8199, @​Peac36)
• Fixed an issue where kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed (#​8160, @​inteon)
• Changes to the Duration and RenewBefore annotations on ingress and gateway-api resources will now trigger certificate updates. (#​8232, @​eleanor-merry)
• Fix an issue where ACME challenge TXT records are not cleaned up when there are many resource records in CloudDNS. (#​8456, @​tkna)
• Fix unregulated retries with the DigitalOcean DNS-01 solver
  Add full detailed DNS-01 errors to the events attached to the Challenge, for easier debugging (#​8221, @​wallrj-cyberark)
• Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. (#​8403, @​calm329)
• Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. (#​8424, @​SlashNephy)
• Fixed the HTTP-01 Gateway solver creating invalid HTTPRoutes by not setting spec.hostnames when the challenge DNSName is an IP address. (#​8443, @​alviss7)
• Revert API defaults for issuer reference kind and group introduced in 0.19.0 (#​8173, @​erikgb)
• Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. (#​8469, @​SgtCoDFish)
• Update Go to v1.25.5 to fix CVE-2025-61727 and CVE-2025-61729 (#​8290, @​octo-sts[bot])
• When Prometheus monitoring is enabled, the metrics label is now set to the intended value of cert-manager. Previously, it was set depending on various factors (namespace cert-manager is installed in and/or Helm release name). (#​8162, @​LiquidPL)

Other (Cleanup or Flake)

• Promoted the OtherNames feature to Beta and enabled it by default (#​8288, @​wallrj-cyberark)
• Promoting XListenerSets feature gate to ListenerSets (#​8501, @​hjoshi123)
• Rebranding of the Venafi Issuer to CyberArk (#​8215, @​iossifbenbassat123)
• Switched to SSA for challenge finalizer updates (#​8519, @​inteon)
• The default container user (UID) is now 65532 (previously 1000) and the default container group (GID) is now 65532 (previously 0) (#​8408, @​wallrj-cyberark)
• The feature-gate DefaultPrivateKeyRotationPolicyAlways moved from Beta to GA and can no longer be disabled. (#​8287, @​wallrj-cyberark)
• Update cert-manager's ACME client, forked from golang/x/crypto (#​8268, @​SgtCoDFish)
• Use the latest version of Kyverno (1.16.2) in the best-practice installation tests (#​8389, @​wallrj-cyberark)
• We stopped testing with Coutour due to it not supporting the new XListenerSet resource, and moved to kgateway. (#​8426, @​hjoshi123)

v1.19.6

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

This patch release fixes a security issue (GHSA-8rvj-mm4h-c258, HIGH) where the default cert-manager-edit aggregate ClusterRole granted namespace users permission to create ACME Challenge and Order resources directly. A user who could create a Challenge referencing a ClusterIssuer could supply attacker-controlled solver configuration while cert-manager loaded credentials from the ClusterIssuer's namespace, bypassing Issuer solver selectors (dnsZones, dnsNames, matchLabels). With the acme-dns provider specifically, this could disclose DNS credentials to an attacker-controlled endpoint.

This release also includes Go version bumps to address reported CVEs. All users should upgrade.

[!WARNING]
Potentially breaking change: The cert-manager-edit aggregate ClusterRole no longer grants create for challenges.acme.cert-manager.io or create, patch, update for orders.acme.cert-manager.io. These resources are internal to cert-manager's ACME workflow and are not intended to be created or modified directly by users. If you have tooling or workflows that create Challenge or Order resources directly (outside of the normal Certificate → CertificateRequest → Order → Challenge flow), you will need to grant those permissions explicitly.

Changes by Kind

Bug or Regression

• Security (HIGH): Remove Challenge create and Order create, patch, update verbs from the cert-manager-edit aggregate ClusterRole (GHSA-8rvj-mm4h-c258). (#​8941, @​wallrj-cyberark)

Other (Cleanup or Flake)

• Update Go to v1.25.11 to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 (#​8925, @​wallrj-cyberark)
• Upgrade Go to 1.25.10 to fix reported vulnerabilities, along with other dependency bumps (#​8788, @​SgtCoDFish)

v1.19.5

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

This is a simple patch release to fix some reported vulnerabilities. All users are recommended to upgrade.

Changes by Kind

Other (Cleanup or Flake)

• Bump go dependencies with reported vulnerabilities (#​8706, @​erikgb)
• Bump go to 1.25.8 to address several reported vulnerabilities (#​8628, @​SgtCoDFish)
• Bump go to 1.25.9 (#​8705, @​erikgb)

v1.19.4

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.19.4 is a simple patch release to fix some reported vulnerabilities - notably CVE-2026-24051 and CVE-2025-68121. All users should upgrade.

Changes by Kind

Bug or Regression

• Bump go to address CVE-2025-68121 (#​8526, @​SgtCoDFish)
• Bump otel SDK to address GO-2026-4394 (#​8531, @​SgtCoDFish)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[scality-renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 31 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=7 days

Details:

Package	Change
sigs.k8s.io/controller-runtime	v0.22.3 -> v0.23.1
github.com/go-openapi/swag/jsonname	v0.25.1 -> v0.25.4
golang.org/x/mod	v0.38.0 -> v0.40.0
sigs.k8s.io/gateway-api	v1.4.0 -> v1.5.0
sigs.k8s.io/structured-merge-diff/v6	v6.3.0 -> v6.3.2
cel.dev/expr	v0.24.0 -> v0.25.2
github.com/go-openapi/jsonpointer	v0.22.1 -> v0.22.4
github.com/go-openapi/jsonreference	v0.21.2 -> v0.21.4
github.com/google/cel-go	v0.26.0 -> v0.30.0
github.com/google/gnostic-models	v0.7.0 -> v0.7.1
github.com/mailru/easyjson	v0.9.0 -> v0.9.1
github.com/spf13/cobra	v1.10.1 -> v1.10.2
go.opentelemetry.io/auto/sdk	v1.1.0 -> v1.2.1
go.opentelemetry.io/otel	v1.37.0 -> v1.44.0
go.opentelemetry.io/otel/metric	v1.37.0 -> v1.44.0
go.opentelemetry.io/otel/sdk	v1.37.0 -> v1.44.0
go.opentelemetry.io/otel/trace	v1.37.0 -> v1.44.0
go.uber.org/zap	v1.27.0 -> v1.27.1
golang.org/x/net	v0.57.0 -> v0.58.0
golang.org/x/oauth2	v0.31.0 -> v0.36.0
golang.org/x/time	v0.13.0 -> v0.14.0
golang.org/x/tools	v0.48.0 -> v0.49.0
google.golang.org/genproto/googleapis/api	v0.0.0-20250721164621-a45f3dfb1074 -> v0.0.0-20260526163538-3dc84a4a5aaa
google.golang.org/genproto/googleapis/rpc	v0.0.0-20250929231259-57b25ae835d4 -> v0.0.0-20260526163538-3dc84a4a5aaa
google.golang.org/grpc	v1.75.1 -> v1.83.2
google.golang.org/protobuf	v1.36.9 -> v1.36.11
k8s.io/apiextensions-apiserver	v0.34.1 -> v0.35.2
k8s.io/apiserver	v0.34.1 -> v0.35.2
k8s.io/component-base	v0.34.1 -> v0.35.2
k8s.io/klog/v2	v2.130.1 -> v2.140.0
k8s.io/kube-openapi	v0.0.0-20250910181357-589584f1c912 -> v0.0.0-20260127142750-a19766b6e2d4

[scality-renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[github-actions]

Dependency Bump Evaluation

Version change: v1.19.3 → v1.20.4 (minor bump, 8 intermediate releases)
Semver bump type: minor

Changes (v1.19.4 through v1.20.4):

• Security (HIGH): cert-manager-edit ClusterRole no longer grants create for challenges or create/patch/update for orders (GHSA-8rvj-mm4h-c258)
• Security (MODERATE): Fix potential panic from DNS response caching
• Multiple CVE fixes in Go runtime and dependencies (x/crypto, x/net, grpc, cel-go, go-pkcs12)
• Bug fix: ingress-shim no longer removes applyset label from cached objects
• Bug fix: challenge garbage collection unblocked by removing issuer owner reference
• New features: ListenerSet support, Azure Private DNS, OtherNames promoted to Beta
• Default container UID/GID changed from 1000/0 to 65532/65532
• DefaultPrivateKeyRotationPolicyAlways feature gate moved to GA (can no longer be disabled)
• SSA for challenge finalizer updates

Breaking changes: Several noted in release notes, but none affect this codebase:

• ClusterRole change: codebase only checks CRD existence via kubectl get crds, does not depend on challenge/order permissions
• IssuerRef API defaults revert: codebase explicitly sets Kind on all IssuerRef usages
• UID/GID change: only affects cert-manager containers, not this operator
• Feature gate GA promotion: codebase does not reference DefaultPrivateKeyRotationPolicyAlways

Security concerns: This bump resolves multiple HIGH and MODERATE security advisories. The cert-manager project recommends all users upgrade. No new suspicious patterns -- changes are from established cert-manager maintainers.

Impact on codebase: The operator imports pkg/apis/certmanager/v1 and pkg/apis/meta/v1 for Issuer/ClusterIssuer types and ObjectReference. These are stable v1 APIs with no breaking changes in v1.20.x. The operator does not interact with challenges, orders, or finalizers.

CI status: build / build -- FAILURE | test / test -- FAILURE | generate -- SUCCESS | lint -- IN_PROGRESS

Recommendation: REVIEW REQUIRED

Notes: The dependency analysis shows no breaking API changes affecting this codebase, and the upgrade is security-critical. However, CI is currently failing (build and test). Investigate build/test failures before merging -- they may indicate an incompatibility introduced by the minor version bump (e.g., transitive dependency conflicts or API type changes not covered by release notes).

— Claude Code