feat(passbolt): add support for Passbolt V5 API#5919
Merged
Skarlso merged 4 commits intoexternal-secrets:mainfrom Mar 15, 2026
Merged
feat(passbolt): add support for Passbolt V5 API#5919Skarlso merged 4 commits intoexternal-secrets:mainfrom
Skarlso merged 4 commits intoexternal-secrets:mainfrom
Conversation
WalkthroughThis PR updates Go module dependencies (root and Passbolt provider), refactors the Passbolt provider to use a concrete Changes
Possibly related issues
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
74bf18b to
d71a8b2
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@go.mod`:
- Line 338: The go.mod entry using the pseudo-version
github.com/passbolt/go-passbolt v0.7.3-0.20260202140352-4844e424f7c6 must be
removed because it does not include official v0.7.3 and lacks Passbolt v5 API
support; replace that line by either pinning to the last official compatible
release (e.g., github.com/passbolt/go-passbolt v0.7.2) or remove the dependency
and implement an alternative approach until upstream publishes a v5-compatible
release, and ensure any code referencing the go-passbolt package (imports and
types) is tested against the chosen version to avoid v5-breaking API changes.
d71a8b2 to
f2e7d8d
Compare
f2e7d8d to
3623246
Compare
98062a7 to
ea1d1ab
Compare
Contributor
Author
|
Hi ESO maintainer 👋 It is my first contribution to this project and would like to be sure this PR is ok to review before removing the draft status. I read the contribution process, but still have a few questions :-)
Don't hesitate to tell me if you see something else that needs a change! |
Contributor
|
@Skarlso we could use some guidance here, at your convenience. |
Contributor
|
@cedricherzog-passbolt Hello! First off, thank you for doing this! :) 🙇 Second, you need to sign your commits as described here: https://github.com/external-secrets/external-secrets/pull/5919/checks?check_run_id=62940925983 Third, it would be nice to have a proper tag/version for 0.7.3. :D But I see there is none yet. I assume it's coming? Fourth, I think you need to update both go mods, yeah. Since we are replace-importing the passbolt provider in the main go.mod file. 🤔 So I would indeed assume that it needs a Fifth, you're doing fine for now as far as I can see. :) |
ea1d1ab to
6a52657
Compare
Contributor
Author
|
@Skarlso thanks for the feedback :-) We will do the 0.7.3 release and update this PR. |
6a52657 to
d15c3c1
Compare
Contributor
Author
|
Hello @Skarlso! I updated the dependencies. |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
providers/v1/passbolt/passbolt_test.go (1)
30-149:⚠️ Potential issue | 🟠 MajorAdd tests for core secret retrieval and lifecycle methods.
The Passbolt provider has several implemented methods missing test coverage:
GetSecret- fetches and decrypts individual secrets with error handlingGetAllSecrets- filters secrets by regex with error handlingNewClient- initializes the provider with client setupClose- handles session cleanupValidate- validates provider configurationWhile removing mock complexity is reasonable, compare with similar providers like SecretServer (1,323 test lines covering GetSecret, GetAllSecrets, Close) versus Passbolt's current 149 test lines covering only configuration validation and error stubs.
Either add unit tests with a minimal mock client or integrate tests against a test Passbolt instance.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@providers/v1/passbolt/passbolt_test.go` around lines 30 - 149, Tests are missing for core Passbolt lifecycle and retrieval methods — add unit tests covering ProviderPassbolt.NewClient, ProviderPassbolt.Close, ProviderPassbolt.Validate, ProviderPassbolt.GetSecret and ProviderPassbolt.GetAllSecrets; implement a small mock Passbolt client (or a lightweight test instance) that the provider can be initialized with to simulate success and failure paths, assert proper error handling and decryption in GetSecret, assert regex filtering and empty/non-matching behavior in GetAllSecrets, verify NewClient initialization and Validate configuration errors/success, and ensure Close properly cleans up session state; reference ProviderPassbolt, NewClient, Close, Validate, GetSecret, GetAllSecrets, and Secret.GetProp when locating targets in the test file.
🧹 Nitpick comments (1)
providers/v1/passbolt/passbolt.go (1)
91-98: Consider logging PreFetchCaches failures for observability.The comment explains that
PreFetchCachesfailures are non-fatal, which is reasonable for a performance optimization. However, silently discarding all three return values makes debugging difficult if caching consistently fails in certain environments.Consider logging the error at debug/info level to aid troubleshooting without failing the operation.
💡 Suggested improvement
// Prefetch caches for V5 metadata decryption performance (CLI pattern) // This caches session keys and metadata keys for fast V5 decryption - _, _, _ = client.PreFetchCaches(ctx) // Non-fatal if fails + if _, _, err := client.PreFetchCaches(ctx); err != nil { + // Log at debug level - non-fatal but useful for troubleshooting + // log.V(1).Info("failed to prefetch caches", "error", err) + }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@providers/v1/passbolt/passbolt.go` around lines 91 - 98, The call to client.PreFetchCaches currently discards its three return values making cache failures invisible; modify the call in passbolt.go to capture its returned values (e.g., _, _, err := client.PreFetchCaches(ctx)) and, if err != nil, log the error at debug/info level via the existing logger (preserve the non-fatal behavior by not returning the error). Keep the call site as client.PreFetchCaches(ctx) and ensure the log message includes context like "PreFetchCaches failed" plus the error to aid observability.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@providers/v1/passbolt/passbolt_test.go`:
- Around line 30-149: Tests are missing for core Passbolt lifecycle and
retrieval methods — add unit tests covering ProviderPassbolt.NewClient,
ProviderPassbolt.Close, ProviderPassbolt.Validate, ProviderPassbolt.GetSecret
and ProviderPassbolt.GetAllSecrets; implement a small mock Passbolt client (or a
lightweight test instance) that the provider can be initialized with to simulate
success and failure paths, assert proper error handling and decryption in
GetSecret, assert regex filtering and empty/non-matching behavior in
GetAllSecrets, verify NewClient initialization and Validate configuration
errors/success, and ensure Close properly cleans up session state; reference
ProviderPassbolt, NewClient, Close, Validate, GetSecret, GetAllSecrets, and
Secret.GetProp when locating targets in the test file.
---
Nitpick comments:
In `@providers/v1/passbolt/passbolt.go`:
- Around line 91-98: The call to client.PreFetchCaches currently discards its
three return values making cache failures invisible; modify the call in
passbolt.go to capture its returned values (e.g., _, _, err :=
client.PreFetchCaches(ctx)) and, if err != nil, log the error at debug/info
level via the existing logger (preserve the non-fatal behavior by not returning
the error). Keep the call site as client.PreFetchCaches(ctx) and ensure the log
message includes context like "PreFetchCaches failed" plus the error to aid
observability.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: b7eee259-e163-4e2f-8177-de0bf1e71191
⛔ Files ignored due to path filters (2)
go.sumis excluded by!**/*.sumproviders/v1/passbolt/go.sumis excluded by!**/*.sum
📒 Files selected for processing (4)
go.modproviders/v1/passbolt/go.modproviders/v1/passbolt/passbolt.goproviders/v1/passbolt/passbolt_test.go
Skarlso
reviewed
Mar 10, 2026
Contributor
|
@cedricherzog-passbolt can you please take care of the linter issue? :) Thanks. |
- Update provider to handle V5 encrypted metadata - Add session key caching for performance - Implement prefetch caches on client initialization - Update go-passbolt SDK dependency Signed-off-by: Cédric HERZOG <cedric.herzog@passbolt.com>
Signed-off-by: Cédric HERZOG <cedric.herzog@passbolt.com>
Signed-off-by: Cédric HERZOG <cedric.herzog@passbolt.com>
67c6559 to
c474331
Compare
Contributor
Author
|
@Skarlso the linter should pass now! :-) |
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
providers/v1/passbolt/passbolt.go (2)
198-202: MakeClosesafe on an uninitialized provider.
Closedereferencesprovider.clientunconditionally. A nil guard keeps cleanup idempotent and avoids panics on zero-value or error-path usage.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@providers/v1/passbolt/passbolt.go` around lines 198 - 202, ProviderPassbolt.Close currently dereferences provider.client unconditionally; add a nil guard so Close is safe on an uninitialized or error-path provider. In the Close method, check if provider.client == nil and return nil (or no-op) immediately; otherwise call provider.client.SavePendingSessionKeys(ctx) and provider.client.Logout(ctx) as before, keeping the SavePendingSessionKeys call best-effort and returning the Logout error if present. Ensure you reference the ProviderPassbolt.Close method and the provider.client, SavePendingSessionKeys, and Logout symbols when making the change.
97-100: Use the controller logger for prefetch failures.
fmt.Printfbypasses structured logging, loses request/store context, and makes these non-fatal cache warmup failures much harder to correlate in production. Please route this through the operator logger instead of stdout.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@providers/v1/passbolt/passbolt.go` around lines 97 - 100, Replace the stdout print with the controller logger: where client.PreFetchCaches(ctx) is called and currently uses fmt.Printf, obtain the controller logger from the context (e.g. logger := ctrl.LoggerFrom(ctx)) and call logger.Error(err, "passbolt: prefetch caches failed (non-fatal)") (optionally add context values with WithValues); do not use fmt.Printf so failures are recorded in structured logs tied to the request/store.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@providers/v1/passbolt/passbolt.go`:
- Around line 176-180: GetAllSecrets currently aborts the whole bulk fetch when
any single resource fails in the loop; change the loop that iterates over
resources to treat errors from provider.getPassboltSecret(ctx, resource.ID) as
skippable: on error, log a warning (including resource.ID and the error) and
continue to the next resource instead of returning; preserve returning errors
for session-wide or caller-level failures (e.g., failures from session
initialization or provider.listResources), and only treat getPassboltSecret
errors as per-resource non-fatal issues so filtering/regex logic can still run
on the rest of the resources.
---
Nitpick comments:
In `@providers/v1/passbolt/passbolt.go`:
- Around line 198-202: ProviderPassbolt.Close currently dereferences
provider.client unconditionally; add a nil guard so Close is safe on an
uninitialized or error-path provider. In the Close method, check if
provider.client == nil and return nil (or no-op) immediately; otherwise call
provider.client.SavePendingSessionKeys(ctx) and provider.client.Logout(ctx) as
before, keeping the SavePendingSessionKeys call best-effort and returning the
Logout error if present. Ensure you reference the ProviderPassbolt.Close method
and the provider.client, SavePendingSessionKeys, and Logout symbols when making
the change.
- Around line 97-100: Replace the stdout print with the controller logger: where
client.PreFetchCaches(ctx) is called and currently uses fmt.Printf, obtain the
controller logger from the context (e.g. logger := ctrl.LoggerFrom(ctx)) and
call logger.Error(err, "passbolt: prefetch caches failed (non-fatal)")
(optionally add context values with WithValues); do not use fmt.Printf so
failures are recorded in structured logs tied to the request/store.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 9aa68564-e653-44d6-9682-dca8401163eb
📒 Files selected for processing (1)
providers/v1/passbolt/passbolt.go
There was a problem hiding this comment.
♻️ Duplicate comments (1)
providers/v1/passbolt/passbolt.go (1)
176-180:⚠️ Potential issue | 🟠 MajorDon't fail the whole bulk fetch on one bad resource.
This still aborts
GetAllSecretson the firstgetPassboltSecreterror. With V5 metadata decryption now happening before regex filtering, one unreadable or concurrently deleted entry can blank out the entirefindresult even if that item would never match.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@providers/v1/passbolt/passbolt.go` around lines 176 - 180, The loop inside GetAllSecrets currently returns nil on the first provider.getPassboltSecret(ctx, resource.ID) error, aborting the whole bulk fetch; change this to skip the failing resource instead: when getPassboltSecret returns an error, log the error (including resource.ID and error details) and continue the for _, resource := range resources loop so other resources are processed; optionally collect non-fatal errors into a slice for reporting but do not return early—ensure symbols mentioned: GetAllSecrets, resources, provider.getPassboltSecret are updated accordingly.
🧹 Nitpick comments (1)
providers/v1/passbolt/passbolt.go (1)
52-53: Create a mockable interface for Passbolt client dependencies.The
client *api.Clientfield prevents unit testing the changed V5 paths (NewClient,GetSecret,GetAllSecrets,Close); the test file now covers only validation/helpers and stubs. Extract a small internal interface for the methods used byProviderPassbolt(Login,GetResources,SavePendingSessionKeys,Logout, decryption) to restore testability for login/prefetch/session-key/decryption logic without affecting the production implementation.Additionally,
GetAllSecretsstill aborts the entire bulk fetch on the first per-resource error, which remains risky—especially now that decryption happens eagerly before filtering.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@providers/v1/passbolt/passbolt.go` around lines 52 - 53, Replace the concrete client field on ProviderPassbolt with a small internal interface (e.g., PassboltAPI) that declares only the methods ProviderPassbolt uses (Login, GetResources, SavePendingSessionKeys, Logout, Close and the specific decryption call(s) you invoke) and update ProviderPassbolt to hold that interface instead of *api.Client; add an adapter type that wraps *api.Client and implements PassboltAPI and update NewClient to construct ProviderPassbolt with the adapter so production behavior is unchanged but tests can inject a mock. Also modify GetAllSecrets to not abort on the first per-resource error: iterate resources, attempt decryption/filtering for each, collect successful secrets and record per-resource errors (returning successful results plus an aggregated/multi-error or a slice of errors) so a single failing resource doesn’t cancel the whole bulk fetch. Ensure GetSecret, GetAllSecrets, NewClient and Close signatures use the interface-backed ProviderPassbolt.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@providers/v1/passbolt/passbolt.go`:
- Around line 176-180: The loop inside GetAllSecrets currently returns nil on
the first provider.getPassboltSecret(ctx, resource.ID) error, aborting the whole
bulk fetch; change this to skip the failing resource instead: when
getPassboltSecret returns an error, log the error (including resource.ID and
error details) and continue the for _, resource := range resources loop so other
resources are processed; optionally collect non-fatal errors into a slice for
reporting but do not return early—ensure symbols mentioned: GetAllSecrets,
resources, provider.getPassboltSecret are updated accordingly.
---
Nitpick comments:
In `@providers/v1/passbolt/passbolt.go`:
- Around line 52-53: Replace the concrete client field on ProviderPassbolt with
a small internal interface (e.g., PassboltAPI) that declares only the methods
ProviderPassbolt uses (Login, GetResources, SavePendingSessionKeys, Logout,
Close and the specific decryption call(s) you invoke) and update
ProviderPassbolt to hold that interface instead of *api.Client; add an adapter
type that wraps *api.Client and implements PassboltAPI and update NewClient to
construct ProviderPassbolt with the adapter so production behavior is unchanged
but tests can inject a mock. Also modify GetAllSecrets to not abort on the first
per-resource error: iterate resources, attempt decryption/filtering for each,
collect successful secrets and record per-resource errors (returning successful
results plus an aggregated/multi-error or a slice of errors) so a single failing
resource doesn’t cancel the whole bulk fetch. Ensure GetSecret, GetAllSecrets,
NewClient and Close signatures use the interface-backed ProviderPassbolt.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: c47d87b7-a0a6-4a5f-9b75-a2ed42d5e12c
⛔ Files ignored due to path filters (2)
go.sumis excluded by!**/*.sumproviders/v1/passbolt/go.sumis excluded by!**/*.sum
📒 Files selected for processing (4)
go.modproviders/v1/passbolt/go.modproviders/v1/passbolt/passbolt.goproviders/v1/passbolt/passbolt_test.go
Skarlso
approved these changes
Mar 15, 2026
|
AlexOQ
pushed a commit
to AlexOQ/external-secrets
that referenced
this pull request
Mar 18, 2026
Co-authored-by: Gergely Bräutigam <gergely.brautigam@sap.com> Signed-off-by: AlexOQ <30403857+AlexOQ@users.noreply.github.com>
alexlebens
pushed a commit
to alexlebens/infrastructure
that referenced
this pull request
Mar 20, 2026
…2.2.0 (#4923) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets/external-secrets](https://github.com/external-secrets/external-secrets) | minor | `v2.1.0` → `v2.2.0` | --- >⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/2) for more information. --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets/external-secrets)</summary> ### [`v2.2.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.2.0) [Compare Source](external-secrets/external-secrets@v2.1.0...v2.2.0) Image: `ghcr.io/external-secrets/external-secrets:v2.2.0` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi-boringssl` <!-- Release notes generated using configuration in .github/release.yml at main --> #### What's Changed ##### General - chore: release charts v2.1.0 by [@​Skarlso](https://github.com/Skarlso) in [#​6030](external-secrets/external-secrets#6030) - chore: fix the stability doc by [@​Skarlso](https://github.com/Skarlso) in [#​6035](external-secrets/external-secrets#6035) - fix(security): Fix vulnerabilities by [@​othomann](https://github.com/othomann) in [#​6052](external-secrets/external-secrets#6052) - fix(aws): sync tags and resource policy even when secret value unchanged by [@​evs-secops](https://github.com/evs-secops) in [#​6025](external-secrets/external-secrets#6025) - fix: publish now uses docker build v4 which required some changes by [@​Skarlso](https://github.com/Skarlso) in [#​6062](external-secrets/external-secrets#6062) - feat(gcpsm): auto-detect projectID from GCP metadata server by [@​patjlm](https://github.com/patjlm) in [#​5922](external-secrets/external-secrets#5922) - chore(templating): Remove years in license and their checks by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​5955](external-secrets/external-secrets#5955) - docs: Add Roche to official ADOPTERS by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​6076](external-secrets/external-secrets#6076) - feat: Add Last Sync column to ExternalSecret and PushSecret printers by [@​jaruwat-panturat](https://github.com/jaruwat-panturat) in [#​6068](external-secrets/external-secrets#6068) - fix(onepassword): support native item IDs by [@​chadxz](https://github.com/chadxz) in [#​6073](external-secrets/external-secrets#6073) - feat: extract LGTM processor to external JS file with tests by [@​mateenali66](https://github.com/mateenali66) in [#​6074](external-secrets/external-secrets#6074) - feat: fail fast if LGTM label does not exist in repository by [@​mateenali66](https://github.com/mateenali66) in [#​6078](external-secrets/external-secrets#6078) - feat(passbolt): add support for Passbolt V5 API by [@​cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) in [#​5919](external-secrets/external-secrets#5919) - fix(infisical): dataFrom.find.path should filter by secret path not name by [@​johnvox](https://github.com/johnvox) in [#​6086](external-secrets/external-secrets#6086) - fix: disable the priority queue which misbehaves at scale by [@​Skarlso](https://github.com/Skarlso) in [#​6083](external-secrets/external-secrets#6083) - chore: update go version to 1.26.1 by [@​Skarlso](https://github.com/Skarlso) in [#​6072](external-secrets/external-secrets#6072) - docs(aws): fix PushSecret metadata indentation in resource policy exa... by [@​Br1an67](https://github.com/Br1an67) in [#​6056](external-secrets/external-secrets#6056) - fix(aws): prevent EC2 IMDS fallback when explicit credentials are pro... by [@​Br1an67](https://github.com/Br1an67) in [#​6036](external-secrets/external-secrets#6036) - feat(templating): Add certSANs function to extract SANs from certificates by [@​mzdeb](https://github.com/mzdeb) in [#​6058](external-secrets/external-secrets#6058) - docs: document template.metadata labels/annotations behavior by [@​lucpas](https://github.com/lucpas) in [#​6102](external-secrets/external-secrets#6102) - fix: CODEOWNERS are seriously out of date by [@​Skarlso](https://github.com/Skarlso) in [#​6106](external-secrets/external-secrets#6106) - feat(helm): add readinessProbe support for external-secrets deployment by [@​AlexOQ](https://github.com/AlexOQ) in [#​5831](external-secrets/external-secrets#5831) - fix: update grpc for CVE-2026-33186 by [@​Skarlso](https://github.com/Skarlso) in [#​6108](external-secrets/external-secrets#6108) - feat(azurekv): add expiration time to azure kv secret by [@​muraliavarma](https://github.com/muraliavarma) in [#​5935](external-secrets/external-secrets#5935) - feat: add path to cloud.ru provider by [@​heavyandrew](https://github.com/heavyandrew) in [#​5952](external-secrets/external-secrets#5952) - fix(add-eso-version): fix separator line pattern in add\_eso\_version.sh script by [@​riccardomc](https://github.com/riccardomc) in [#​6113](external-secrets/external-secrets#6113) ##### Dependencies - chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6038](external-secrets/external-secrets#6038) - chore(deps): bump charset-normalizer from 3.4.4 to 3.4.5 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6047](external-secrets/external-secrets#6047) - chore(deps): bump platformdirs from 4.9.2 to 4.9.4 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6050](external-secrets/external-secrets#6050) - chore(deps): bump mkdocs-material from 9.7.3 to 9.7.4 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6049](external-secrets/external-secrets#6049) - chore(deps): bump github/codeql-action from 4.32.4 to 4.32.6 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6039](external-secrets/external-secrets#6039) - chore(deps): bump step-security/harden-runner from 2.15.0 to 2.15.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6043](external-secrets/external-secrets#6043) - chore(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6040](external-secrets/external-secrets#6040) - chore(deps): bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6044](external-secrets/external-secrets#6044) - chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6042](external-secrets/external-secrets#6042) - chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6041](external-secrets/external-secrets#6041) - chore(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6046](external-secrets/external-secrets#6046) - chore(deps): bump aquasecurity/trivy-action from 0.34.1 to 0.35.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6048](external-secrets/external-secrets#6048) - chore(deps): bump anchore/sbom-action from 0.23.0 to 0.23.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6093](external-secrets/external-secrets#6093) - chore(deps): bump distroless/static from `28efbe9` to `47b2d72` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6088](external-secrets/external-secrets#6088) - chore(deps): bump ubi9/ubi from `cecb1cd` to `6ed9f6f` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6087](external-secrets/external-secrets#6087) - chore(deps): bump mkdocs-material from 9.7.4 to 9.7.5 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6096](external-secrets/external-secrets#6096) - chore(deps): bump tornado from 6.5.4 to 6.5.5 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6094](external-secrets/external-secrets#6094) - chore(deps): bump charset-normalizer from 3.4.5 to 3.4.6 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6095](external-secrets/external-secrets#6095) - chore(deps): bump step-security/harden-runner from 2.15.1 to 2.16.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6089](external-secrets/external-secrets#6089) - chore(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6092](external-secrets/external-secrets#6092) - chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6090](external-secrets/external-secrets#6090) - chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6091](external-secrets/external-secrets#6091) #### New Contributors - [@​othomann](https://github.com/othomann) made their first contribution in [#​6052](external-secrets/external-secrets#6052) - [@​evs-secops](https://github.com/evs-secops) made their first contribution in [#​6025](external-secrets/external-secrets#6025) - [@​patjlm](https://github.com/patjlm) made their first contribution in [#​5922](external-secrets/external-secrets#5922) - [@​jaruwat-panturat](https://github.com/jaruwat-panturat) made their first contribution in [#​6068](external-secrets/external-secrets#6068) - [@​chadxz](https://github.com/chadxz) made their first contribution in [#​6073](external-secrets/external-secrets#6073) - [@​mateenali66](https://github.com/mateenali66) made their first contribution in [#​6074](external-secrets/external-secrets#6074) - [@​cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) made their first contribution in [#​5919](external-secrets/external-secrets#5919) - [@​johnvox](https://github.com/johnvox) made their first contribution in [#​6086](external-secrets/external-secrets#6086) - [@​Br1an67](https://github.com/Br1an67) made their first contribution in [#​6056](external-secrets/external-secrets#6056) - [@​mzdeb](https://github.com/mzdeb) made their first contribution in [#​6058](external-secrets/external-secrets#6058) - [@​lucpas](https://github.com/lucpas) made their first contribution in [#​6102](external-secrets/external-secrets#6102) - [@​AlexOQ](https://github.com/AlexOQ) made their first contribution in [#​5831](external-secrets/external-secrets#5831) - [@​muraliavarma](https://github.com/muraliavarma) made their first contribution in [#​5935](external-secrets/external-secrets#5935) - [@​heavyandrew](https://github.com/heavyandrew) made their first contribution in [#​5952](external-secrets/external-secrets#5952) **Full Changelog**: <external-secrets/external-secrets@v2.1.0...v2.2.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41OS4yIiwidXBkYXRlZEluVmVyIjoiNDMuNTkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW1hZ2UiXX0=--> Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4923 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
alexlebens
pushed a commit
to alexlebens/infrastructure
that referenced
this pull request
Mar 20, 2026
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `2.1.0` → `2.2.0` | --- >⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/2) for more information. --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v2.2.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.2.0) [Compare Source](external-secrets/external-secrets@v2.1.0...v2.2.0) Image: `ghcr.io/external-secrets/external-secrets:v2.2.0` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi-boringssl` <!-- Release notes generated using configuration in .github/release.yml at main --> ##### What's Changed ##### General - chore: release charts v2.1.0 by [@​Skarlso](https://github.com/Skarlso) in [#​6030](external-secrets/external-secrets#6030) - chore: fix the stability doc by [@​Skarlso](https://github.com/Skarlso) in [#​6035](external-secrets/external-secrets#6035) - fix(security): Fix vulnerabilities by [@​othomann](https://github.com/othomann) in [#​6052](external-secrets/external-secrets#6052) - fix(aws): sync tags and resource policy even when secret value unchanged by [@​evs-secops](https://github.com/evs-secops) in [#​6025](external-secrets/external-secrets#6025) - fix: publish now uses docker build v4 which required some changes by [@​Skarlso](https://github.com/Skarlso) in [#​6062](external-secrets/external-secrets#6062) - feat(gcpsm): auto-detect projectID from GCP metadata server by [@​patjlm](https://github.com/patjlm) in [#​5922](external-secrets/external-secrets#5922) - chore(templating): Remove years in license and their checks by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​5955](external-secrets/external-secrets#5955) - docs: Add Roche to official ADOPTERS by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​6076](external-secrets/external-secrets#6076) - feat: Add Last Sync column to ExternalSecret and PushSecret printers by [@​jaruwat-panturat](https://github.com/jaruwat-panturat) in [#​6068](external-secrets/external-secrets#6068) - fix(onepassword): support native item IDs by [@​chadxz](https://github.com/chadxz) in [#​6073](external-secrets/external-secrets#6073) - feat: extract LGTM processor to external JS file with tests by [@​mateenali66](https://github.com/mateenali66) in [#​6074](external-secrets/external-secrets#6074) - feat: fail fast if LGTM label does not exist in repository by [@​mateenali66](https://github.com/mateenali66) in [#​6078](external-secrets/external-secrets#6078) - feat(passbolt): add support for Passbolt V5 API by [@​cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) in [#​5919](external-secrets/external-secrets#5919) - fix(infisical): dataFrom.find.path should filter by secret path not name by [@​johnvox](https://github.com/johnvox) in [#​6086](external-secrets/external-secrets#6086) - fix: disable the priority queue which misbehaves at scale by [@​Skarlso](https://github.com/Skarlso) in [#​6083](external-secrets/external-secrets#6083) - chore: update go version to 1.26.1 by [@​Skarlso](https://github.com/Skarlso) in [#​6072](external-secrets/external-secrets#6072) - docs(aws): fix PushSecret metadata indentation in resource policy exa... by [@​Br1an67](https://github.com/Br1an67) in [#​6056](external-secrets/external-secrets#6056) - fix(aws): prevent EC2 IMDS fallback when explicit credentials are pro... by [@​Br1an67](https://github.com/Br1an67) in [#​6036](external-secrets/external-secrets#6036) - feat(templating): Add certSANs function to extract SANs from certificates by [@​mzdeb](https://github.com/mzdeb) in [#​6058](external-secrets/external-secrets#6058) - docs: document template.metadata labels/annotations behavior by [@​lucpas](https://github.com/lucpas) in [#​6102](external-secrets/external-secrets#6102) - fix: CODEOWNERS are seriously out of date by [@​Skarlso](https://github.com/Skarlso) in [#​6106](external-secrets/external-secrets#6106) - feat(helm): add readinessProbe support for external-secrets deployment by [@​AlexOQ](https://github.com/AlexOQ) in [#​5831](external-secrets/external-secrets#5831) - fix: update grpc for CVE-2026-33186 by [@​Skarlso](https://github.com/Skarlso) in [#​6108](external-secrets/external-secrets#6108) - feat(azurekv): add expiration time to azure kv secret by [@​muraliavarma](https://github.com/muraliavarma) in [#​5935](external-secrets/external-secrets#5935) - feat: add path to cloud.ru provider by [@​heavyandrew](https://github.com/heavyandrew) in [#​5952](external-secrets/external-secrets#5952) - fix(add-eso-version): fix separator line pattern in add\_eso\_version.sh script by [@​riccardomc](https://github.com/riccardomc) in [#​6113](external-secrets/external-secrets#6113) ##### Dependencies - chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6038](external-secrets/external-secrets#6038) - chore(deps): bump charset-normalizer from 3.4.4 to 3.4.5 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6047](external-secrets/external-secrets#6047) - chore(deps): bump platformdirs from 4.9.2 to 4.9.4 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6050](external-secrets/external-secrets#6050) - chore(deps): bump mkdocs-material from 9.7.3 to 9.7.4 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6049](external-secrets/external-secrets#6049) - chore(deps): bump github/codeql-action from 4.32.4 to 4.32.6 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6039](external-secrets/external-secrets#6039) - chore(deps): bump step-security/harden-runner from 2.15.0 to 2.15.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6043](external-secrets/external-secrets#6043) - chore(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6040](external-secrets/external-secrets#6040) - chore(deps): bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6044](external-secrets/external-secrets#6044) - chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6042](external-secrets/external-secrets#6042) - chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6041](external-secrets/external-secrets#6041) - chore(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6046](external-secrets/external-secrets#6046) - chore(deps): bump aquasecurity/trivy-action from 0.34.1 to 0.35.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6048](external-secrets/external-secrets#6048) - chore(deps): bump anchore/sbom-action from 0.23.0 to 0.23.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6093](external-secrets/external-secrets#6093) - chore(deps): bump distroless/static from `28efbe9` to `47b2d72` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6088](external-secrets/external-secrets#6088) - chore(deps): bump ubi9/ubi from `cecb1cd` to `6ed9f6f` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6087](external-secrets/external-secrets#6087) - chore(deps): bump mkdocs-material from 9.7.4 to 9.7.5 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6096](external-secrets/external-secrets#6096) - chore(deps): bump tornado from 6.5.4 to 6.5.5 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6094](external-secrets/external-secrets#6094) - chore(deps): bump charset-normalizer from 3.4.5 to 3.4.6 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6095](external-secrets/external-secrets#6095) - chore(deps): bump step-security/harden-runner from 2.15.1 to 2.16.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6089](external-secrets/external-secrets#6089) - chore(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6092](external-secrets/external-secrets#6092) - chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6090](external-secrets/external-secrets#6090) - chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6091](external-secrets/external-secrets#6091) ##### New Contributors - [@​othomann](https://github.com/othomann) made their first contribution in [#​6052](external-secrets/external-secrets#6052) - [@​evs-secops](https://github.com/evs-secops) made their first contribution in [#​6025](external-secrets/external-secrets#6025) - [@​patjlm](https://github.com/patjlm) made their first contribution in [#​5922](external-secrets/external-secrets#5922) - [@​jaruwat-panturat](https://github.com/jaruwat-panturat) made their first contribution in [#​6068](external-secrets/external-secrets#6068) - [@​chadxz](https://github.com/chadxz) made their first contribution in [#​6073](external-secrets/external-secrets#6073) - [@​mateenali66](https://github.com/mateenali66) made their first contribution in [#​6074](external-secrets/external-secrets#6074) - [@​cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) made their first contribution in [#​5919](external-secrets/external-secrets#5919) - [@​johnvox](https://github.com/johnvox) made their first contribution in [#​6086](external-secrets/external-secrets#6086) - [@​Br1an67](https://github.com/Br1an67) made their first contribution in [#​6056](external-secrets/external-secrets#6056) - [@​mzdeb](https://github.com/mzdeb) made their first contribution in [#​6058](external-secrets/external-secrets#6058) - [@​lucpas](https://github.com/lucpas) made their first contribution in [#​6102](external-secrets/external-secrets#6102) - [@​AlexOQ](https://github.com/AlexOQ) made their first contribution in [#​5831](external-secrets/external-secrets#5831) - [@​muraliavarma](https://github.com/muraliavarma) made their first contribution in [#​5935](external-secrets/external-secrets#5935) - [@​heavyandrew](https://github.com/heavyandrew) made their first contribution in [#​5952](external-secrets/external-secrets#5952) **Full Changelog**: <external-secrets/external-secrets@v2.1.0...v2.2.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41OS4yIiwidXBkYXRlZEluVmVyIjoiNDMuNTkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiY2hhcnQiXX0=--> Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4927 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
dsp0x4
pushed a commit
to dsp0x4/external-secrets
that referenced
this pull request
Mar 22, 2026
Co-authored-by: Gergely Bräutigam <gergely.brautigam@sap.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #5867
Overview
Adds Passbolt V5 API support (encrypted metadata), updates go-passbolt to v0.8.0-beta.1 and bumps related dependencies in both root and providers/v1/passbolt go.mod files. Fixes #5867.
Key Changes
Status / Notes