chore: update go version to 1.26.1#6072
Merged
Skarlso merged 5 commits intoexternal-secrets:mainfrom Mar 16, 2026
Merged
Conversation
Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: Gergely Brautigam <gergely.brautigam@sap.com>
Contributor
Author
|
/ok-to-test sha=d46f27535bc43cdddc266f208e778cf0111afb44 |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughBumps Go toolchain and Docker builder images to 1.26.1, upgrades golangci-lint and reduces lint parallelism, adds CRD deprecation messages and small docs edits, and applies targeted nolint comments and slice preallocation/allocation-style changes. No public API signatures or CRD schemas were functionally changed. Changes
Possibly related PRs
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Tip You can generate walkthrough in a markdown collapsible section to save space.Enable the |
Contributor
Author
|
This actually needs my linter update PR changes as well. Ugh. |
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
tilt.debug.dockerfile (1)
1-5:⚠️ Potential issue | 🟠 MajorUpgrade Delve to a Go 1.26-compatible version.
Line 1 uses Go 1.26.1, but Line 5 pins
dlv@v1.22.0. Delve 1.22 does not support Go 1.26; support was added in Delve 1.26.0. This version mismatch will cause debugger incompatibility with binaries built on this toolchain.🔧 Proposed fix
-RUN go install github.com/go-delve/delve/cmd/dlv@v1.22.0 && chmod +x /go/bin/dlv && mv /go/bin/dlv / +RUN go install github.com/go-delve/delve/cmd/dlv@v1.26.1 && chmod +x /go/bin/dlv && mv /go/bin/dlv /Reference: https://github.com/go-delve/delve/blob/master/CHANGELOG.md#1260-2025-12-18
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@tilt.debug.dockerfile` around lines 1 - 5, The Dockerfile pins Delve to an incompatible version (dlv@v1.22.0) for Go 1.26.1; update the RUN instruction that installs Delve so it uses a Go-1.26-compatible release (e.g., dlv@v1.26.0 or newer) — locate the RUN line that calls "go install github.com/go-delve/delve/cmd/dlv@v1.22.0" and change the version token to v1.26.0+ so the installed dlv binary matches the Go 1.26 toolchain.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@providers/v1/github/go.mod`:
- Line 3: Update the Go version string in the module template: find the template
file named "go.mod.tmpl" and replace the existing directive "go 1.25.3" with "go
1.26.1" so generated go.mod files match the repo-wide go 1.26.1 setting.
---
Outside diff comments:
In `@tilt.debug.dockerfile`:
- Around line 1-5: The Dockerfile pins Delve to an incompatible version
(dlv@v1.22.0) for Go 1.26.1; update the RUN instruction that installs Delve so
it uses a Go-1.26-compatible release (e.g., dlv@v1.26.0 or newer) — locate the
RUN line that calls "go install github.com/go-delve/delve/cmd/dlv@v1.22.0" and
change the version token to v1.26.0+ so the installed dlv binary matches the Go
1.26 toolchain.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: aa2cf82e-414d-48d5-ba38-5c8182f7735a
📒 Files selected for processing (60)
Dockerfile.standaloneapis/go.mode2e/Dockerfilee2e/go.modgenerators/v1/acr/go.modgenerators/v1/cloudsmith/go.modgenerators/v1/ecr/go.modgenerators/v1/fake/go.modgenerators/v1/gcr/go.modgenerators/v1/github/go.modgenerators/v1/grafana/go.modgenerators/v1/mfa/go.modgenerators/v1/password/go.modgenerators/v1/quay/go.modgenerators/v1/sshkey/go.modgenerators/v1/sts/go.modgenerators/v1/uuid/go.modgenerators/v1/vault/go.modgenerators/v1/webhook/go.modgo.modproviders/v1/akeyless/go.modproviders/v1/aws/go.modproviders/v1/azure/go.modproviders/v1/barbican/go.modproviders/v1/beyondtrust/go.modproviders/v1/bitwarden/go.modproviders/v1/chef/go.modproviders/v1/cloudru/go.modproviders/v1/conjur/go.modproviders/v1/delinea/go.modproviders/v1/doppler/go.modproviders/v1/dvls/go.modproviders/v1/fake/go.modproviders/v1/fortanix/go.modproviders/v1/gcp/go.modproviders/v1/github/go.modproviders/v1/gitlab/go.modproviders/v1/ibm/go.modproviders/v1/infisical/go.modproviders/v1/keepersecurity/go.modproviders/v1/kubernetes/go.modproviders/v1/nebius/go.modproviders/v1/ngrok/go.modproviders/v1/onboardbase/go.modproviders/v1/onepassword/go.modproviders/v1/onepasswordsdk/go.modproviders/v1/oracle/go.modproviders/v1/passbolt/go.modproviders/v1/passworddepot/go.modproviders/v1/previder/go.modproviders/v1/pulumi/go.modproviders/v1/scaleway/go.modproviders/v1/secretserver/go.modproviders/v1/senhasegura/go.modproviders/v1/vault/go.modproviders/v1/volcengine/go.modproviders/v1/webhook/go.modproviders/v1/yandex/go.modruntime/go.modtilt.debug.dockerfile
| module github.com/external-secrets/external-secrets/providers/v1/github | ||
|
|
||
| go 1.25.7 | ||
| go 1.26.1 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== go.mod directives =="
fd 'go\.mod$' -x sh -c 'printf "\n%s\n" "$1"; rg -n "^go " "$1"' sh {}
echo
echo "== Docker/Tilt images using Go 1.26.1 =="
rg -n 'golang:1\.26\.1|go1\.26\.1|go-version:\s*["'\'']?1\.26\.1' -g '!**/vendor/**'
echo
echo "== Any remaining old 1.25.x references =="
rg -n '1\.25\.[0-9]+' -g '!**/vendor/**' || trueRepository: external-secrets/external-secrets
Length of output: 4322
Update the Go module template to maintain repo-wide consistency.
Module directives and Docker images are properly aligned to go 1.26.1. However, cmd/esoctl/generator/templates/go.mod.tmpl still references go 1.25.3. Update the template to go 1.26.1 to ensure generated modules remain consistent with the rest of the codebase.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@providers/v1/github/go.mod` at line 3, Update the Go version string in the
module template: find the template file named "go.mod.tmpl" and replace the
existing directive "go 1.25.3" with "go 1.26.1" so generated go.mod files match
the repo-wide go 1.26.1 setting.
Contributor
Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (2)
cmd/esoctl/generator/bootstrap.go (1)
226-226: Consider centralizing repeatedos.WriteFile+nolintinto a helper.Same write/suppression pattern appears in six places. A small helper keeps the rationale and file-mode policy in one audited path.
♻️ Proposed refactor
+func writeInternalFile(path string, data []byte) error { + //nolint:gosec // internal generator target paths + return os.WriteFile(filepath.Clean(path), data, 0o600) +} ... - if err := os.WriteFile(filepath.Clean(registerFile), []byte(strings.Join(newLines, "\n")), 0o600); err != nil { //nolint:gosec // paths are constructed internally, not from user input + if err := writeInternalFile(registerFile, []byte(strings.Join(newLines, "\n"))); err != nil { return err }Also applies to: 310-310, 373-373, 448-448, 514-514, 566-566
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cmd/esoctl/generator/bootstrap.go` at line 226, Several places (including the write at registerFile in bootstrap.go and the other occurrences) repeat os.WriteFile(..., 0o600) with a //nolint:gosec comment; extract this pattern into a single helper like writePrivateFile(path string, data []byte) error that encapsulates filepath.Clean, the 0o600 mode, and the nolint justification in its implementation, then replace the six direct os.WriteFile calls (the call writing registerFile and the ones at the other noted locations) with calls to that helper so the file-mode policy and gosec suppression are centralized and audited in one place; update callers to pass []byte(strings.Join(..., "\n")) or the appropriate byte slice.providers/v1/cloudru/secretmanager/endpoints.go (1)
47-52: Use a bounded-timeout client instead ofhttp.DefaultClient.Line 52 can block indefinitely on slow or broken networks. The SSRF guard is properly in place; add an explicit timeout when executing the HTTP request.
Suggested change
import ( "encoding/json" "fmt" "net/http" + "time" ) ... - resp, err := http.DefaultClient.Do(req) //nolint:gosec // URL is validated against EndpointsURI above + client := &http.Client{Timeout: 10 * time.Second} + resp, err := client.Do(req) if err != nil { return nil, fmt.Errorf("get cloud.ru endpoints: %w", err) }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@providers/v1/cloudru/secretmanager/endpoints.go` around lines 47 - 52, Replace use of http.DefaultClient.Do(req) with an explicit http.Client that has a bounded Timeout and use that client to execute the request; change the call site that currently constructs req and calls http.DefaultClient.Do(req) to create a client like &http.Client{Timeout: <reasonable duration>} and call client.Do(req) (also add the time import). Keep the existing SSRF validation around EndpointsURI and ensure the variable names req and resp are preserved.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@config/crds/bases/external-secrets.io_clustersecretstores.yaml`:
- Line 5129: Update the deprecation guidance string that currently references
"serviceAccountRef.Audiences" to use YAML/manifest casing
"serviceAccountRef.audiences" so it matches CR manifest keys; locate the
deprecation message text (the string containing "Deprecated: use
serviceAccountRef.Audiences") in the clustersecretstores manifest and replace
the field reference in that message (and the analogous occurrence around lines
9818) to "serviceAccountRef.audiences".
In `@deploy/crds/bundle.yaml`:
- Around line 6861-6865: The deprecation note incorrectly references
"serviceAccountRef.Audiences" (PascalCase) which doesn't match CR manifest
JSON/YAML paths; update the text to use the manifest path
"serviceAccountRef.audiences" instead. Replace the string in the shown diff and
the other reported occurrences (around lines 11207-11211, 18620-18624,
22966-22970, 25645-25649, 28332-28336) so the deprecation message is directly
usable by manifest authors and consistently uses the lowercase dot-separated
path.
- Around line 6871-6876: Update the deprecation text for the "expiration"
description so it directs users to the concrete replacement field/path (similar
to how the "audiences" note does) instead of just saying it will be removed;
specifically, change the sentence after the description of serviceAccountRef to
"Deprecated: use <CONCRETE_SUCCESSOR_FIELD_PATH> instead." and apply the same
precise migration-oriented message to the other occurrences mentioned (lines
around the other ranges), referencing the same successor path and keeping the
default/timeout note intact.
- Around line 665-669: The CRD description for the field named namespaceSelector
currently points users to the Go-field spelling "NamespaceSelectors" and also
uses an incorrect "namespaces" sentence; update the description text to
reference the manifest key exactly as `namespaceSelectors` (lower camel case,
matching what users write in YAML) and adjust the preceding sentence that
mentions "namespaces" to the correct `namespaceSelectors` key; make the same
wording change in the other occurrences of this deprecation guidance (the two
additional description blocks with the same message).
---
Nitpick comments:
In `@cmd/esoctl/generator/bootstrap.go`:
- Line 226: Several places (including the write at registerFile in bootstrap.go
and the other occurrences) repeat os.WriteFile(..., 0o600) with a //nolint:gosec
comment; extract this pattern into a single helper like writePrivateFile(path
string, data []byte) error that encapsulates filepath.Clean, the 0o600 mode, and
the nolint justification in its implementation, then replace the six direct
os.WriteFile calls (the call writing registerFile and the ones at the other
noted locations) with calls to that helper so the file-mode policy and gosec
suppression are centralized and audited in one place; update callers to pass
[]byte(strings.Join(..., "\n")) or the appropriate byte slice.
In `@providers/v1/cloudru/secretmanager/endpoints.go`:
- Around line 47-52: Replace use of http.DefaultClient.Do(req) with an explicit
http.Client that has a bounded Timeout and use that client to execute the
request; change the call site that currently constructs req and calls
http.DefaultClient.Do(req) to create a client like &http.Client{Timeout:
<reasonable duration>} and call client.Do(req) (also add the time import). Keep
the existing SSRF validation around EndpointsURI and ensure the variable names
req and resp are preserved.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 7e39731b-30ba-4a13-b8f2-895f00b577bd
📒 Files selected for processing (29)
.github/workflows/ci.ymlMakefileapis/externalsecrets/v1/clusterexternalsecret_types.goapis/externalsecrets/v1/secretstore_vault_types.goapis/externalsecrets/v1beta1/clusterexternalsecret_types.goapis/externalsecrets/v1beta1/secretstore_vault_types.gocmd/controller/certcontroller.gocmd/esoctl/generator/bootstrap.goconfig/crds/bases/external-secrets.io_clusterexternalsecrets.yamlconfig/crds/bases/external-secrets.io_clustersecretstores.yamlconfig/crds/bases/external-secrets.io_secretstores.yamlconfig/crds/bases/generators.external-secrets.io_clustergenerators.yamlconfig/crds/bases/generators.external-secrets.io_vaultdynamicsecrets.yamldeploy/crds/bundle.yamldocs/api/spec.mdgenerators/v1/vault/vault.gopkg/controllers/clusterexternalsecret/clusterexternalsecret_controller.gopkg/controllers/clusterexternalsecret/clusterexternalsecret_controller_test.gopkg/controllers/clusterpushsecret/clusterpushsecret_controller.gopkg/controllers/clusterpushsecret/clusterpushsecret_controller_test.goproviders/v1/cloudru/secretmanager/endpoints.goproviders/v1/conjur/fake/fake.goproviders/v1/infisical/api/api_test.goproviders/v1/nebius/mysterybox/validation_test.goproviders/v1/onepassword/onepassword.goproviders/v1/previder/client_test.goproviders/v1/scaleway/client.goproviders/v1/secretserver/client_test.goproviders/v1/vault/client_get.go
✅ Files skipped from review due to trivial changes (13)
- providers/v1/secretserver/client_test.go
- providers/v1/scaleway/client.go
- apis/externalsecrets/v1/secretstore_vault_types.go
- apis/externalsecrets/v1beta1/secretstore_vault_types.go
- providers/v1/conjur/fake/fake.go
- providers/v1/nebius/mysterybox/validation_test.go
- apis/externalsecrets/v1beta1/clusterexternalsecret_types.go
- apis/externalsecrets/v1/clusterexternalsecret_types.go
- generators/v1/vault/vault.go
- pkg/controllers/clusterpushsecret/clusterpushsecret_controller.go
- config/crds/bases/external-secrets.io_secretstores.yaml
- docs/api/spec.md
- config/crds/bases/generators.external-secrets.io_vaultdynamicsecrets.yaml
| account token for the service account referenced by `serviceAccountRef`. | ||
| Defaults to a single audience `vault` it not specified. | ||
|
|
||
| Deprecated: use serviceAccountRef.Audiences instead |
There was a problem hiding this comment.
Use manifest field casing in deprecation guidance.
The deprecation message points to serviceAccountRef.Audiences, but in CR manifests the field is serviceAccountRef.audiences. Using the YAML key casing avoids user confusion.
✏️ Suggested wording tweak
- Deprecated: use serviceAccountRef.Audiences instead
+ Deprecated: use serviceAccountRef.audiences insteadAlso applies to: 9818-9818
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@config/crds/bases/external-secrets.io_clustersecretstores.yaml` at line 5129,
Update the deprecation guidance string that currently references
"serviceAccountRef.Audiences" to use YAML/manifest casing
"serviceAccountRef.audiences" so it matches CR manifest keys; locate the
deprecation message text (the string containing "Deprecated: use
serviceAccountRef.Audiences") in the clustersecretstores manifest and replace
the field reference in that message (and the analogous occurrence around lines
9818) to "serviceAccountRef.audiences".
Comment on lines
665
to
669
| namespaceSelector: | ||
| description: |- | ||
| The labels to select by to find the Namespaces to create the ExternalSecrets in. | ||
|
|
||
| Deprecated: Use NamespaceSelectors instead. |
There was a problem hiding this comment.
Use namespaceSelectors in the deprecation guidance.
NamespaceSelectors is the Go-field spelling. The generated CRD should point users at the manifest key namespaceSelectors, otherwise the migration hint does not match what they can actually write in YAML. The same casing issue is also present in the preceding namespaces sentence.
✏️ Suggested wording
- Deprecated: Use NamespaceSelectors instead.
+ Deprecated: use `namespaceSelectors` instead.Also applies to: 762-766, 1496-1500
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@deploy/crds/bundle.yaml` around lines 665 - 669, The CRD description for the
field named namespaceSelector currently points users to the Go-field spelling
"NamespaceSelectors" and also uses an incorrect "namespaces" sentence; update
the description text to reference the manifest key exactly as
`namespaceSelectors` (lower camel case, matching what users write in YAML) and
adjust the preceding sentence that mentions "namespaces" to the correct
`namespaceSelectors` key; make the same wording change in the other occurrences
of this deprecation guidance (the two additional description blocks with the
same message).
Comment on lines
6861
to
6865
| Optional audiences field that will be used to request a temporary Kubernetes service | ||
| account token for the service account referenced by `serviceAccountRef`. | ||
| Defaults to a single audience `vault` it not specified. | ||
|
|
||
| Deprecated: use serviceAccountRef.Audiences instead |
There was a problem hiding this comment.
Use the manifest path in the audiences replacement note.
serviceAccountRef.Audiences does not exist in CR manifests. Please generate this description with the JSON/YAML path serviceAccountRef.audiences so the deprecation text is directly usable by manifest authors.
✏️ Suggested wording
- Deprecated: use serviceAccountRef.Audiences instead
+ Deprecated: use `serviceAccountRef.audiences` instead.Also applies to: 11207-11211, 18620-18624, 22966-22970, 25645-25649, 28332-28336
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@deploy/crds/bundle.yaml` around lines 6861 - 6865, The deprecation note
incorrectly references "serviceAccountRef.Audiences" (PascalCase) which doesn't
match CR manifest JSON/YAML paths; update the text to use the manifest path
"serviceAccountRef.audiences" instead. Replace the string in the shown diff and
the other reported occurrences (around lines 11207-11211, 18620-18624,
22966-22970, 25645-25649, 28332-28336) so the deprecation message is directly
usable by manifest authors and consistently uses the lowercase dot-separated
path.
Comment on lines
6871
to
6876
| Optional expiration time in seconds that will be used to request a temporary | ||
| Kubernetes service account token for the service account referenced by | ||
| `serviceAccountRef`. | ||
|
|
||
| Deprecated: this will be removed in the future. | ||
| Defaults to 10 minutes. |
There was a problem hiding this comment.
Make the expiration deprecation note migration-oriented.
Deprecated: this will be removed in the future. warns about removal but does not tell users what to switch to. Please point this description at the concrete successor field/path here as well, the same way the audiences note does.
Also applies to: 11217-11222, 18630-18635, 22976-22981, 25655-25660, 28342-28347
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@deploy/crds/bundle.yaml` around lines 6871 - 6876, Update the deprecation
text for the "expiration" description so it directs users to the concrete
replacement field/path (similar to how the "audiences" note does) instead of
just saying it will be removed; specifically, change the sentence after the
description of serviceAccountRef to "Deprecated: use
<CONCRETE_SUCCESSOR_FIELD_PATH> instead." and apply the same precise
migration-oriented message to the other occurrences mentioned (lines around the
other ranges), referencing the same successor path and keeping the
default/timeout note intact.
evrardjp
approved these changes
Mar 13, 2026
Contributor
There was a problem hiding this comment.
While I don't see the point of diverging of the go version used in client-go and our operator tooling, I don't see a problem with it either. When that passes CI, it should be good to go. I did not check the source of TestNewVault/InvalidRetrySettings issue...
Contributor
Author
|
Ah it's an error parsing failure. I will fix it, thanks 🙇 |
Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>
Contributor
Author
|
Okay, the matching logic is fixed now. The test was way too strict and since go 1.26 the duration parser returns an unexported error type. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@providers/v1/vault/provider_test.go`:
- Around line 747-750: Fix the nil-error dereference and missing assertion by
explicitly handling the three cases for tc.want.err vs err in the test: when
tc.want.err != nil, first assert err is non-nil (fail the test if err == nil),
then compare error messages (use tc.want.err.Error() vs err.Error()); when
tc.want.err == nil, assert that err is nil and fail the test if err != nil;
update the assertion logic around the newClient() call in provider_test.go
(referencing variables tc.want.err and err) to avoid calling err.Error() on a
nil error and to fail on unexpected errors.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 71e17820-bc08-448f-8e6f-c12d8c69822e
📒 Files selected for processing (1)
providers/v1/vault/provider_test.go
This was referenced Mar 15, 2026
Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>
moolen
approved these changes
Mar 16, 2026
|
There was a problem hiding this comment.
♻️ Duplicate comments (1)
deploy/crds/bundle.yaml (1)
6861-6865:⚠️ Potential issue | 🟡 MinorFix the Go doc that generates this description.
apis/externalsecrets/v1beta1/secretstore_vault_types.go:276-285still has the sameserviceAccountRef.Audienceswording and theit not specifiedtypo, so adjusting onlydeploy/crds/bundle.yamlwill drift again on the next CRD regeneration. Please correct the source comment toserviceAccountRef.audiencesandif not specified, then regenerate the bundle.✏️ Suggested source fix
- // Defaults to a single audience `vault` it not specified. + // Defaults to a single audience `vault` if not specified. @@ - // Deprecated: use serviceAccountRef.Audiences instead + // Deprecated: use `serviceAccountRef.audiences` instead.Also applies to: 11207-11211, 18629-18633, 22975-22979, 25654-25658, 28341-28345
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@deploy/crds/bundle.yaml` around lines 6861 - 6865, Update the Go doc in apis/externalsecrets/v1beta1/secretstore_vault_types.go (the comment that produces the CRD description for serviceAccountRef) to use the correct field casing and wording: change "serviceAccountRef.Audiences" to "serviceAccountRef.audiences" and fix the typo "it not specified" to "if not specified"; then regenerate the CRD bundle so deploy/crds/bundle.yaml (and all other CRD locations noted) are updated consistently.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@deploy/crds/bundle.yaml`:
- Around line 6861-6865: Update the Go doc in
apis/externalsecrets/v1beta1/secretstore_vault_types.go (the comment that
produces the CRD description for serviceAccountRef) to use the correct field
casing and wording: change "serviceAccountRef.Audiences" to
"serviceAccountRef.audiences" and fix the typo "it not specified" to "if not
specified"; then regenerate the CRD bundle so deploy/crds/bundle.yaml (and all
other CRD locations noted) are updated consistently.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 43854905-28bf-45fa-b23e-cb01f7afe655
📒 Files selected for processing (7)
Dockerfile.standalonecmd/controller/certcontroller.godeploy/crds/bundle.yamlgo.modproviders/v1/onepassword/go.modproviders/v1/onepassword/onepassword.goproviders/v1/passbolt/go.mod
✅ Files skipped from review due to trivial changes (1)
- go.mod
🚧 Files skipped from review as they are similar to previous changes (3)
- providers/v1/onepassword/go.mod
- providers/v1/onepassword/onepassword.go
- cmd/controller/certcontroller.go
AlexOQ
pushed a commit
to AlexOQ/external-secrets
that referenced
this pull request
Mar 18, 2026
Signed-off-by: AlexOQ <30403857+AlexOQ@users.noreply.github.com>
alexlebens
pushed a commit
to alexlebens/infrastructure
that referenced
this pull request
Mar 20, 2026
…2.2.0 (#4923) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets/external-secrets](https://github.com/external-secrets/external-secrets) | minor | `v2.1.0` → `v2.2.0` | --- >⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/2) for more information. --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets/external-secrets)</summary> ### [`v2.2.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.2.0) [Compare Source](external-secrets/external-secrets@v2.1.0...v2.2.0) Image: `ghcr.io/external-secrets/external-secrets:v2.2.0` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi-boringssl` <!-- Release notes generated using configuration in .github/release.yml at main --> #### What's Changed ##### General - chore: release charts v2.1.0 by [@​Skarlso](https://github.com/Skarlso) in [#​6030](external-secrets/external-secrets#6030) - chore: fix the stability doc by [@​Skarlso](https://github.com/Skarlso) in [#​6035](external-secrets/external-secrets#6035) - fix(security): Fix vulnerabilities by [@​othomann](https://github.com/othomann) in [#​6052](external-secrets/external-secrets#6052) - fix(aws): sync tags and resource policy even when secret value unchanged by [@​evs-secops](https://github.com/evs-secops) in [#​6025](external-secrets/external-secrets#6025) - fix: publish now uses docker build v4 which required some changes by [@​Skarlso](https://github.com/Skarlso) in [#​6062](external-secrets/external-secrets#6062) - feat(gcpsm): auto-detect projectID from GCP metadata server by [@​patjlm](https://github.com/patjlm) in [#​5922](external-secrets/external-secrets#5922) - chore(templating): Remove years in license and their checks by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​5955](external-secrets/external-secrets#5955) - docs: Add Roche to official ADOPTERS by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​6076](external-secrets/external-secrets#6076) - feat: Add Last Sync column to ExternalSecret and PushSecret printers by [@​jaruwat-panturat](https://github.com/jaruwat-panturat) in [#​6068](external-secrets/external-secrets#6068) - fix(onepassword): support native item IDs by [@​chadxz](https://github.com/chadxz) in [#​6073](external-secrets/external-secrets#6073) - feat: extract LGTM processor to external JS file with tests by [@​mateenali66](https://github.com/mateenali66) in [#​6074](external-secrets/external-secrets#6074) - feat: fail fast if LGTM label does not exist in repository by [@​mateenali66](https://github.com/mateenali66) in [#​6078](external-secrets/external-secrets#6078) - feat(passbolt): add support for Passbolt V5 API by [@​cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) in [#​5919](external-secrets/external-secrets#5919) - fix(infisical): dataFrom.find.path should filter by secret path not name by [@​johnvox](https://github.com/johnvox) in [#​6086](external-secrets/external-secrets#6086) - fix: disable the priority queue which misbehaves at scale by [@​Skarlso](https://github.com/Skarlso) in [#​6083](external-secrets/external-secrets#6083) - chore: update go version to 1.26.1 by [@​Skarlso](https://github.com/Skarlso) in [#​6072](external-secrets/external-secrets#6072) - docs(aws): fix PushSecret metadata indentation in resource policy exa... by [@​Br1an67](https://github.com/Br1an67) in [#​6056](external-secrets/external-secrets#6056) - fix(aws): prevent EC2 IMDS fallback when explicit credentials are pro... by [@​Br1an67](https://github.com/Br1an67) in [#​6036](external-secrets/external-secrets#6036) - feat(templating): Add certSANs function to extract SANs from certificates by [@​mzdeb](https://github.com/mzdeb) in [#​6058](external-secrets/external-secrets#6058) - docs: document template.metadata labels/annotations behavior by [@​lucpas](https://github.com/lucpas) in [#​6102](external-secrets/external-secrets#6102) - fix: CODEOWNERS are seriously out of date by [@​Skarlso](https://github.com/Skarlso) in [#​6106](external-secrets/external-secrets#6106) - feat(helm): add readinessProbe support for external-secrets deployment by [@​AlexOQ](https://github.com/AlexOQ) in [#​5831](external-secrets/external-secrets#5831) - fix: update grpc for CVE-2026-33186 by [@​Skarlso](https://github.com/Skarlso) in [#​6108](external-secrets/external-secrets#6108) - feat(azurekv): add expiration time to azure kv secret by [@​muraliavarma](https://github.com/muraliavarma) in [#​5935](external-secrets/external-secrets#5935) - feat: add path to cloud.ru provider by [@​heavyandrew](https://github.com/heavyandrew) in [#​5952](external-secrets/external-secrets#5952) - fix(add-eso-version): fix separator line pattern in add\_eso\_version.sh script by [@​riccardomc](https://github.com/riccardomc) in [#​6113](external-secrets/external-secrets#6113) ##### Dependencies - chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6038](external-secrets/external-secrets#6038) - chore(deps): bump charset-normalizer from 3.4.4 to 3.4.5 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6047](external-secrets/external-secrets#6047) - chore(deps): bump platformdirs from 4.9.2 to 4.9.4 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6050](external-secrets/external-secrets#6050) - chore(deps): bump mkdocs-material from 9.7.3 to 9.7.4 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6049](external-secrets/external-secrets#6049) - chore(deps): bump github/codeql-action from 4.32.4 to 4.32.6 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6039](external-secrets/external-secrets#6039) - chore(deps): bump step-security/harden-runner from 2.15.0 to 2.15.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6043](external-secrets/external-secrets#6043) - chore(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6040](external-secrets/external-secrets#6040) - chore(deps): bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6044](external-secrets/external-secrets#6044) - chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6042](external-secrets/external-secrets#6042) - chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6041](external-secrets/external-secrets#6041) - chore(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6046](external-secrets/external-secrets#6046) - chore(deps): bump aquasecurity/trivy-action from 0.34.1 to 0.35.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6048](external-secrets/external-secrets#6048) - chore(deps): bump anchore/sbom-action from 0.23.0 to 0.23.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6093](external-secrets/external-secrets#6093) - chore(deps): bump distroless/static from `28efbe9` to `47b2d72` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6088](external-secrets/external-secrets#6088) - chore(deps): bump ubi9/ubi from `cecb1cd` to `6ed9f6f` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6087](external-secrets/external-secrets#6087) - chore(deps): bump mkdocs-material from 9.7.4 to 9.7.5 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6096](external-secrets/external-secrets#6096) - chore(deps): bump tornado from 6.5.4 to 6.5.5 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6094](external-secrets/external-secrets#6094) - chore(deps): bump charset-normalizer from 3.4.5 to 3.4.6 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6095](external-secrets/external-secrets#6095) - chore(deps): bump step-security/harden-runner from 2.15.1 to 2.16.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6089](external-secrets/external-secrets#6089) - chore(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6092](external-secrets/external-secrets#6092) - chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6090](external-secrets/external-secrets#6090) - chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6091](external-secrets/external-secrets#6091) #### New Contributors - [@​othomann](https://github.com/othomann) made their first contribution in [#​6052](external-secrets/external-secrets#6052) - [@​evs-secops](https://github.com/evs-secops) made their first contribution in [#​6025](external-secrets/external-secrets#6025) - [@​patjlm](https://github.com/patjlm) made their first contribution in [#​5922](external-secrets/external-secrets#5922) - [@​jaruwat-panturat](https://github.com/jaruwat-panturat) made their first contribution in [#​6068](external-secrets/external-secrets#6068) - [@​chadxz](https://github.com/chadxz) made their first contribution in [#​6073](external-secrets/external-secrets#6073) - [@​mateenali66](https://github.com/mateenali66) made their first contribution in [#​6074](external-secrets/external-secrets#6074) - [@​cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) made their first contribution in [#​5919](external-secrets/external-secrets#5919) - [@​johnvox](https://github.com/johnvox) made their first contribution in [#​6086](external-secrets/external-secrets#6086) - [@​Br1an67](https://github.com/Br1an67) made their first contribution in [#​6056](external-secrets/external-secrets#6056) - [@​mzdeb](https://github.com/mzdeb) made their first contribution in [#​6058](external-secrets/external-secrets#6058) - [@​lucpas](https://github.com/lucpas) made their first contribution in [#​6102](external-secrets/external-secrets#6102) - [@​AlexOQ](https://github.com/AlexOQ) made their first contribution in [#​5831](external-secrets/external-secrets#5831) - [@​muraliavarma](https://github.com/muraliavarma) made their first contribution in [#​5935](external-secrets/external-secrets#5935) - [@​heavyandrew](https://github.com/heavyandrew) made their first contribution in [#​5952](external-secrets/external-secrets#5952) **Full Changelog**: <external-secrets/external-secrets@v2.1.0...v2.2.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41OS4yIiwidXBkYXRlZEluVmVyIjoiNDMuNTkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW1hZ2UiXX0=--> Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4923 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
alexlebens
pushed a commit
to alexlebens/infrastructure
that referenced
this pull request
Mar 20, 2026
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `2.1.0` → `2.2.0` | --- >⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/2) for more information. --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v2.2.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.2.0) [Compare Source](external-secrets/external-secrets@v2.1.0...v2.2.0) Image: `ghcr.io/external-secrets/external-secrets:v2.2.0` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi-boringssl` <!-- Release notes generated using configuration in .github/release.yml at main --> ##### What's Changed ##### General - chore: release charts v2.1.0 by [@​Skarlso](https://github.com/Skarlso) in [#​6030](external-secrets/external-secrets#6030) - chore: fix the stability doc by [@​Skarlso](https://github.com/Skarlso) in [#​6035](external-secrets/external-secrets#6035) - fix(security): Fix vulnerabilities by [@​othomann](https://github.com/othomann) in [#​6052](external-secrets/external-secrets#6052) - fix(aws): sync tags and resource policy even when secret value unchanged by [@​evs-secops](https://github.com/evs-secops) in [#​6025](external-secrets/external-secrets#6025) - fix: publish now uses docker build v4 which required some changes by [@​Skarlso](https://github.com/Skarlso) in [#​6062](external-secrets/external-secrets#6062) - feat(gcpsm): auto-detect projectID from GCP metadata server by [@​patjlm](https://github.com/patjlm) in [#​5922](external-secrets/external-secrets#5922) - chore(templating): Remove years in license and their checks by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​5955](external-secrets/external-secrets#5955) - docs: Add Roche to official ADOPTERS by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​6076](external-secrets/external-secrets#6076) - feat: Add Last Sync column to ExternalSecret and PushSecret printers by [@​jaruwat-panturat](https://github.com/jaruwat-panturat) in [#​6068](external-secrets/external-secrets#6068) - fix(onepassword): support native item IDs by [@​chadxz](https://github.com/chadxz) in [#​6073](external-secrets/external-secrets#6073) - feat: extract LGTM processor to external JS file with tests by [@​mateenali66](https://github.com/mateenali66) in [#​6074](external-secrets/external-secrets#6074) - feat: fail fast if LGTM label does not exist in repository by [@​mateenali66](https://github.com/mateenali66) in [#​6078](external-secrets/external-secrets#6078) - feat(passbolt): add support for Passbolt V5 API by [@​cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) in [#​5919](external-secrets/external-secrets#5919) - fix(infisical): dataFrom.find.path should filter by secret path not name by [@​johnvox](https://github.com/johnvox) in [#​6086](external-secrets/external-secrets#6086) - fix: disable the priority queue which misbehaves at scale by [@​Skarlso](https://github.com/Skarlso) in [#​6083](external-secrets/external-secrets#6083) - chore: update go version to 1.26.1 by [@​Skarlso](https://github.com/Skarlso) in [#​6072](external-secrets/external-secrets#6072) - docs(aws): fix PushSecret metadata indentation in resource policy exa... by [@​Br1an67](https://github.com/Br1an67) in [#​6056](external-secrets/external-secrets#6056) - fix(aws): prevent EC2 IMDS fallback when explicit credentials are pro... by [@​Br1an67](https://github.com/Br1an67) in [#​6036](external-secrets/external-secrets#6036) - feat(templating): Add certSANs function to extract SANs from certificates by [@​mzdeb](https://github.com/mzdeb) in [#​6058](external-secrets/external-secrets#6058) - docs: document template.metadata labels/annotations behavior by [@​lucpas](https://github.com/lucpas) in [#​6102](external-secrets/external-secrets#6102) - fix: CODEOWNERS are seriously out of date by [@​Skarlso](https://github.com/Skarlso) in [#​6106](external-secrets/external-secrets#6106) - feat(helm): add readinessProbe support for external-secrets deployment by [@​AlexOQ](https://github.com/AlexOQ) in [#​5831](external-secrets/external-secrets#5831) - fix: update grpc for CVE-2026-33186 by [@​Skarlso](https://github.com/Skarlso) in [#​6108](external-secrets/external-secrets#6108) - feat(azurekv): add expiration time to azure kv secret by [@​muraliavarma](https://github.com/muraliavarma) in [#​5935](external-secrets/external-secrets#5935) - feat: add path to cloud.ru provider by [@​heavyandrew](https://github.com/heavyandrew) in [#​5952](external-secrets/external-secrets#5952) - fix(add-eso-version): fix separator line pattern in add\_eso\_version.sh script by [@​riccardomc](https://github.com/riccardomc) in [#​6113](external-secrets/external-secrets#6113) ##### Dependencies - chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6038](external-secrets/external-secrets#6038) - chore(deps): bump charset-normalizer from 3.4.4 to 3.4.5 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6047](external-secrets/external-secrets#6047) - chore(deps): bump platformdirs from 4.9.2 to 4.9.4 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6050](external-secrets/external-secrets#6050) - chore(deps): bump mkdocs-material from 9.7.3 to 9.7.4 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6049](external-secrets/external-secrets#6049) - chore(deps): bump github/codeql-action from 4.32.4 to 4.32.6 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6039](external-secrets/external-secrets#6039) - chore(deps): bump step-security/harden-runner from 2.15.0 to 2.15.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6043](external-secrets/external-secrets#6043) - chore(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6040](external-secrets/external-secrets#6040) - chore(deps): bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6044](external-secrets/external-secrets#6044) - chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6042](external-secrets/external-secrets#6042) - chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6041](external-secrets/external-secrets#6041) - chore(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6046](external-secrets/external-secrets#6046) - chore(deps): bump aquasecurity/trivy-action from 0.34.1 to 0.35.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6048](external-secrets/external-secrets#6048) - chore(deps): bump anchore/sbom-action from 0.23.0 to 0.23.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6093](external-secrets/external-secrets#6093) - chore(deps): bump distroless/static from `28efbe9` to `47b2d72` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6088](external-secrets/external-secrets#6088) - chore(deps): bump ubi9/ubi from `cecb1cd` to `6ed9f6f` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6087](external-secrets/external-secrets#6087) - chore(deps): bump mkdocs-material from 9.7.4 to 9.7.5 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6096](external-secrets/external-secrets#6096) - chore(deps): bump tornado from 6.5.4 to 6.5.5 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6094](external-secrets/external-secrets#6094) - chore(deps): bump charset-normalizer from 3.4.5 to 3.4.6 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6095](external-secrets/external-secrets#6095) - chore(deps): bump step-security/harden-runner from 2.15.1 to 2.16.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6089](external-secrets/external-secrets#6089) - chore(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6092](external-secrets/external-secrets#6092) - chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6090](external-secrets/external-secrets#6090) - chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6091](external-secrets/external-secrets#6091) ##### New Contributors - [@​othomann](https://github.com/othomann) made their first contribution in [#​6052](external-secrets/external-secrets#6052) - [@​evs-secops](https://github.com/evs-secops) made their first contribution in [#​6025](external-secrets/external-secrets#6025) - [@​patjlm](https://github.com/patjlm) made their first contribution in [#​5922](external-secrets/external-secrets#5922) - [@​jaruwat-panturat](https://github.com/jaruwat-panturat) made their first contribution in [#​6068](external-secrets/external-secrets#6068) - [@​chadxz](https://github.com/chadxz) made their first contribution in [#​6073](external-secrets/external-secrets#6073) - [@​mateenali66](https://github.com/mateenali66) made their first contribution in [#​6074](external-secrets/external-secrets#6074) - [@​cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) made their first contribution in [#​5919](external-secrets/external-secrets#5919) - [@​johnvox](https://github.com/johnvox) made their first contribution in [#​6086](external-secrets/external-secrets#6086) - [@​Br1an67](https://github.com/Br1an67) made their first contribution in [#​6056](external-secrets/external-secrets#6056) - [@​mzdeb](https://github.com/mzdeb) made their first contribution in [#​6058](external-secrets/external-secrets#6058) - [@​lucpas](https://github.com/lucpas) made their first contribution in [#​6102](external-secrets/external-secrets#6102) - [@​AlexOQ](https://github.com/AlexOQ) made their first contribution in [#​5831](external-secrets/external-secrets#5831) - [@​muraliavarma](https://github.com/muraliavarma) made their first contribution in [#​5935](external-secrets/external-secrets#5935) - [@​heavyandrew](https://github.com/heavyandrew) made their first contribution in [#​5952](external-secrets/external-secrets#5952) **Full Changelog**: <external-secrets/external-secrets@v2.1.0...v2.2.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41OS4yIiwidXBkYXRlZEluVmVyIjoiNDMuNTkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiY2hhcnQiXX0=--> Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4927 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
5 tasks
dsp0x4
pushed a commit
to dsp0x4/external-secrets
that referenced
this pull request
Mar 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem Statement
What is the problem you're trying to solve?
Related Issue
Fixes #...
Proposed Changes
How do you like to solve the issue and why?
Format
Please ensure that your PR follows the following format for the title:
Where
scopeis optionally one of:Checklist
git commit --signoffmake testmake reviewableSummary
Update Go toolchain from 1.25.7 to 1.26.1 across the repository, bump CI linter, and apply related lint/comment, test, allocation, and documentation edits.
Changes
Impact