feat(helm)!: Update external-secrets ( 0.20.2 → 1.1.0 )

[renovate]

This PR contains the following updates:

Package	Update	Change
external-secrets	major	0.20.2 -> 1.1.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

external-secrets/external-secrets (external-secrets)

v1.1.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.1.0
Image: ghcr.io/external-secrets/external-secrets:v1.1.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.1.0-ubi-boringssl

What's Changed

!NOTE!: During last community meeting we discussed that we are retiring our scarf account. With that, we will be changing back to ghcr.io/external-secrets/external-secrets instead of oci.external-secrets.io/external-secrets/external-secrets.

For now, the old domain will live for a couple months to give people to change back. With this release , the helm chart switched back to ghcr.

General

• chore(chart): release helm chart 1.0.0 by @​Skarlso in #​5552
• feat(security): add support for ECDSA ssh keys by @​bigjazzsound in #​5559
• fix: minor typo in comment of KeeperSecurity example by @​mdjong1 in #​5573
• docs(gcp): update documentation for using WorkloadIdentityFederation in non-GKE cluster by @​jennweir in #​5556
• chore(release): add darwin_arm64 releases by @​lbordowitz in #​5583
• feat: support override IAM endpoint in IBM provider for APIkey auth by @​fidel-ruiz in #​5550
• feat(security): build tags for all the providers to disable them on d… by @​ShimonDarshan in #​5578
• fix: do not include the last element of the path in the iteration by @​Skarlso in #​5588
• fix(k8s): support deleting whole secret by @​tiagolobocastro in #​5538
• fix(provider): configure TLS for secret server provider by @​Lumexralph in #​5558
• chore(aws): remove any usage of aws-sdk-v1 by @​Skarlso in #​5590
• fix(gcp): check for secret version exists in PushSecret by @​bpalko in #​5593
• feat(vault): add GCP Workload Identity authentication support by @​SamuelMolling in #​5356
• chore: fix sonar cloud issues by @​Skarlso in #​5405
• chore(aws-sdk-v2): update dependencies to accept new aws regions by @​damienpuig in #​5577
• feat(chart): use ghcr.io instead of our own domain by @​evrardjp in #​5617

Dependencies

• chore(deps): bump golang from 1.25.3 to 1.25.4 by @​dependabot[bot] in #​5560
• chore(deps): bump golang from 1.25.3-bookworm to 1.25.4-bookworm in /e2e by @​dependabot[bot] in #​5568
• chore(deps): bump step-security/harden-runner from 2.13.1 to 2.13.2 by @​dependabot[bot] in #​5561
• chore(deps): bump softprops/action-gh-release from 2.4.1 to 2.4.2 by @​dependabot[bot] in #​5564
• chore(deps): bump helm/chart-testing-action from 2.7.0 to 2.8.0 by @​dependabot[bot] in #​5565
• chore(deps): bump aws-actions/configure-aws-credentials from 0d00a56 to 2475ef7 by @​dependabot[bot] in #​5562
• chore(deps): bump helm/kind-action from 1.12.0 to 1.13.0 by @​dependabot[bot] in #​5563
• chore(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 by @​dependabot[bot] in #​5567
• chore(deps): bump regex from 2025.10.23 to 2025.11.3 in /hack/api-docs by @​dependabot[bot] in #​5570
• chore(deps): bump markdown from 3.9 to 3.10 in /hack/api-docs by @​dependabot[bot] in #​5569
• chore(deps): bump hashicorp/setup-terraform from 982f6f0 to 4c5fdab by @​dependabot[bot] in #​5566
• chore(deps): bump golang from d3f0cf7 to d3f0cf7 by @​dependabot[bot] in #​5595
• chore(deps): bump github/codeql-action from 4.31.2 to 4.31.3 by @​dependabot[bot] in #​5596
• chore(deps): bump click from 8.3.0 to 8.3.1 in /hack/api-docs by @​dependabot[bot] in #​5602
• chore(deps): bump ubi9/ubi from dec374e to dcd8128 by @​dependabot[bot] in #​5594
• chore(deps): bump aws-actions/configure-aws-credentials from 2475ef7 to f2964c7 by @​dependabot[bot] in #​5597
• chore(deps): bump actions/dependency-review-action from 4.8.1 to 4.8.2 by @​dependabot[bot] in #​5598
• chore(deps): bump pymdown-extensions from 10.16.1 to 10.17.1 in /hack/api-docs by @​dependabot[bot] in #​5599
• chore(deps): bump certifi from 2025.10.5 to 2025.11.12 in /hack/api-docs by @​dependabot[bot] in #​5600
• chore(deps): bump mkdocs-material from 9.6.23 to 9.7.0 in /hack/api-docs by @​dependabot[bot] in #​5601
• chore(deps): bump mkdocs-macros-plugin from 1.4.1 to 1.5.0 in /hack/api-docs by @​dependabot[bot] in #​5603

New Contributors

• @​bigjazzsound made their first contribution in #​5559
• @​mdjong1 made their first contribution in #​5573
• @​jennweir made their first contribution in #​5556
• @​lbordowitz made their first contribution in #​5583
• @​fidel-ruiz made their first contribution in #​5550
• @​ShimonDarshan made their first contribution in #​5578
• @​bpalko made their first contribution in #​5593
• @​SamuelMolling made their first contribution in #​5356
• @​damienpuig made their first contribution in #​5577

Full Changelog: external-secrets/external-secrets@v1.0.0...v1.1.0

v1.0.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.0.0
Image: ghcr.io/external-secrets/external-secrets:v1.0.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.0.0-ubi-boringssl

What's Changed

General

• chore: release helm chart for v0.20.4 by @​Skarlso in #​5502
• chore(actions): fix security alerts for github actions by @​Skarlso in #​5504
• chore(release): fix incorrect shas from security alert pinning by @​jakobmoellerdev in #​5512
• chore: update dependencies by @​eso-service-account-app[bot] in #​5519
• fix: upgrade go version by @​Skarlso in #​5529
• fix(charts): normalize certificate duration default value by @​aslafy-z in #​5497
• chore(revive-linter): add revive linter configuration by @​Lumexralph in #​5515
• feat: go module separation by @​moolen in #​5498
• fix: update deps script to reflect new go mod structure by @​moolen in #​5532
• fix: lint by @​gusfcarvalho in #​5536
• feat: dynamic target implementation for external secrets sources by @​Skarlso in #​5470
• fix: codeql should not rebuild the world on every run by @​Skarlso in #​5540
• fix(onepassword): Reduce API usage by @​sondrelg in #​5410
• feat(esoctl): adds bootstrap generator commands by @​gusfcarvalho in #​5539
• fix: adds missing externalsecret_type validation on generatorRef by @​gusfcarvalho in #​5547
• chore(docs): fix the generic resource doc using the incorrect switch by @​Skarlso in #​5548
• docs(adopters): add Topicus.Education to adopters list by @​sboschman in #​5551
• fix(build): use more portable bash by @​tiagolobocastro in #​5537

Dependencies

• chore(deps): bump alpine from 4bcff63 to 4b7ce07 in /hack/api-docs by @​dependabot[bot] in #​5507
• chore(deps): bump golang from 1.25.2 to 1.25.3 by @​dependabot[bot] in #​5506
• chore(deps): bump golang from aee43c3 to aee43c3 by @​dependabot[bot] in #​5516
• chore(deps): bump golang from 1.25.2-bookworm to 1.25.3-bookworm in /e2e by @​dependabot[bot] in #​5505
• chore(deps): bump anchore/sbom-action from 0.20.8 to 0.20.9 by @​dependabot[bot] in #​5508
• chore(deps): bump hashicorp/setup-terraform from c529327 to 982f6f0 by @​dependabot[bot] in #​5510
• chore(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @​dependabot[bot] in #​5513
• chore(deps): bump github/codeql-action from 4.30.9 to 4.31.0 by @​dependabot[bot] in #​5514
• chore(deps): bump actions/cache from 4.2.4 to 4.3.0 by @​dependabot[bot] in #​5511
• chore(deps): bump regex from 2025.9.18 to 2025.10.23 in /hack/api-docs by @​dependabot[bot] in #​5509
• chore(deps): bump mkdocs-macros-plugin from 1.4.0 to 1.4.1 in /hack/api-docs by @​dependabot[bot] in #​5518
• chore(deps): bump termcolor from 3.1.0 to 3.2.0 in /hack/api-docs by @​dependabot[bot] in #​5517
• chore(deps): bump github/codeql-action from 4.31.0 to 4.31.2 by @​dependabot[bot] in #​5531
• chore(deps): bump mkdocs-material from 9.6.22 to 9.6.23 in /hack/api-docs by @​dependabot[bot] in #​5533

New Contributors

• @​sondrelg made their first contribution in #​5410
• @​tiagolobocastro made their first contribution in #​5537

Full Changelog: external-secrets/external-secrets@v0.20.4...v1.0.0

v0.20.4

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v0.20.4
Image: ghcr.io/external-secrets/external-secrets:v0.20.4-ubi
Image: ghcr.io/external-secrets/external-secrets:v0.20.4-ubi-boringssl

What's Changed

General

• fix: re-enable secretserver e2e tests by @​moolen in #​5442
• chore: update dependencies by @​eso-service-account-app[bot] in #​5462
• chore: release helm chart for v0.20.3 by @​Skarlso in #​5467
• docs: remove jwt token authentication option from STSSessionToken generator by @​liununu in #​5468
• feat: re-implement e2e managed tests by @​moolen in #​5444
• docs: Update Segura DSM Branding by @​chellin-segura in #​5469
• ref: simplify and document transform rewrite method by @​riccardomc in #​5450
• fix: put back the expires into the github generator by @​Skarlso in #​5472
• chore(charts): remove unused values from chart by @​rkferreira in #​5334
• feat(generators): add hex generator by @​unique-jakub in #​5314
• fix: use GetClientCertificate in Vault Auth by @​shaxbee in #​5441
• feat(aws): add defining a resource policy via metadata for secretsmanager by @​Skarlso in #​5399
• fix: Webhook provider PushSecret not working by @​Skarlso in #​5445
• fix: remove the finalizer on namespace deletion by @​Skarlso in #​5473
• chore: update dependencies by @​eso-service-account-app[bot] in #​5487
• fix: missing config-file for github action scanning by @​Skarlso in #​5376
• chore(build): Update ubi Docker builds to UBI9 by @​IdanAdar in #​5465
• fix: typo in GitHub provider documentation by @​gecube in #​5493
• fix(oracle): prevent TCP connections leakage by @​adutchak in #​5491
• docs(controller-options): typo in controller-options by @​aslafy-z in #​5496
• chore(linter): fix linter issue in api and cmd package by @​Lumexralph in #​5413
• fix: remove extra json convert check by @​Skarlso in #​5501

Dependencies

• chore(deps): bump actions/dependency-review-action from 4.8.0 to 4.8.1 by @​dependabot[bot] in #​5454
• chore(deps): bump ubi8/ubi from 534c2c0 to 2f698e1 by @​dependabot[bot] in #​5452
• chore(deps): bump golang from 1.25.1 to 1.25.2 by @​dependabot[bot] in #​5456
• chore(deps): bump alpine from 4bcff63 to 4b7ce07 by @​dependabot[bot] in #​5451
• chore(deps): bump github/codeql-action from 3.30.6 to 4.30.8 by @​dependabot[bot] in #​5455
• chore(deps): bump alpine from 3.22.1 to 3.22.2 in /e2e by @​dependabot[bot] in #​5457
• chore(deps): bump golang from 1.25.1-bookworm to 1.25.2-bookworm in /e2e by @​dependabot[bot] in #​5460
• chore(deps): bump click from 8.1.8 to 8.3.0 in /hack/api-docs by @​dependabot[bot] in #​5458
• chore(deps): bump platformdirs from 4.4.0 to 4.5.0 in /hack/api-docs by @​dependabot[bot] in #​5459
• chore(deps): bump idna from 3.10 to 3.11 in /hack/api-docs by @​dependabot[bot] in #​5461
• chore(deps): bump softprops/action-gh-release from 2.3.4 to 2.4.1 by @​dependabot[bot] in #​5453
• chore(deps): bump github/codeql-action from 4.30.8 to 4.30.9 by @​dependabot[bot] in #​5481
• chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 by @​dependabot[bot] in #​5480
• chore(deps): bump anchore/sbom-action from 0.20.6 to 0.20.8 by @​dependabot[bot] in #​5483
• chore(deps): bump mkdocs-material from 9.6.21 to 9.6.22 in /hack/api-docs by @​dependabot[bot] in #​5485
• chore(deps): bump charset-normalizer from 3.4.3 to 3.4.4 in /hack/api-docs by @​dependabot[bot] in #​5486
• chore(deps): bump apache/skywalking-eyes from 0.7.0 to 0.8.0 by @​dependabot[bot] in #​5484
• chore(deps): bump aws-actions/configure-aws-credentials from 06083b7 to 5dc01db by @​dependabot[bot] in #​5482

New Contributors

• @​liununu made their first contribution in #​5468
• @​chellin-segura made their first contribution in #​5469
• @​unique-jakub made their first contribution in #​5314
• @​adutchak made their first contribution in #​5491

Full Changelog: external-secrets/external-secrets@v0.20.3...v0.20.4

v0.20.3

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v0.20.3
Image: ghcr.io/external-secrets/external-secrets:v0.20.3-ubi
Image: ghcr.io/external-secrets/external-secrets:v0.20.3-ubi-boringssl

What's Changed

General

• chore: release helm chart for v0.20.2 by @​Skarlso in #​5403
• fix(ci): Remove PAUL by @​evrardjp in #​5406
• docs: add note on Vault 1.21 audience requirement for roles by @​AddRain1 in #​5411
• docs: extend bitwarden example and integration to accomodate the ssh key feature by @​luilegeant in #​5414
• chore: update dependencies by @​eso-service-account-app[bot] in #​5427
• docs(getting-started): Change apply to use File (-f) instead of Kustomize (-k) by @​smellems in #​5433
• docs(release): Resolve incorrect references in documentation samples by @​blast-hardcheese in #​5431
• docs: Update scaleway json doc by @​RobinFrcd in #​5429
• chore(previder): Update Previder Provider dependency and fix ReadOnly token by @​gkwmiddelkamp in #​5327
• chore(linter): fix revive linter issues in pkg by @​Lumexralph in #​5412
• chore: move to new GCP account, temporarily disable delinea by @​moolen in #​5438
• chore(actions): always run helm test and update make check-diff by @​Skarlso in #​5440
• fix: make port in the schema file either a string of an integer by @​Skarlso in #​5439
• fix: use maps.Equal instead of bytes.Compare for JSON value by @​Skarlso in #​5448
• chore(docs): update refresh interval format by @​Skarlso in #​5447
• chore(docs): update ADOPTERS.md to include Criteo by @​alikhil in #​5446

Dependencies

• chore(deps): bump softprops/action-gh-release from 2.3.3 to 2.3.4 by @​dependabot[bot] in #​5417
• chore(deps): bump github/codeql-action from 3.30.5 to 3.30.6 by @​dependabot[bot] in #​5420
• chore(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @​dependabot[bot] in #​5418
• chore(deps): bump golang from 6ad9415 to c423747 in /e2e by @​dependabot[bot] in #​5423
• chore(deps): bump mkdocs-material from 9.6.20 to 9.6.21 in /hack/api-docs by @​dependabot[bot] in #​5425
• chore(deps): bump certifi from 2025.8.3 to 2025.10.5 in /hack/api-docs by @​dependabot[bot] in #​5424
• chore(deps): bump docker/login-action from 3.5.0 to 3.6.0 by @​dependabot[bot] in #​5422
• chore(deps): bump actions/stale from 10.0.0 to 10.1.0 by @​dependabot[bot] in #​5416
• chore(deps): bump peter-evans/create-or-update-comment from 4.0.0 to 5.0.0 by @​dependabot[bot] in #​5421
• chore(deps): bump golang from b6ed3fd to b6ed3fd by @​dependabot[bot] in #​5419

New Contributors

• @​AddRain1 made their first contribution in #​5411
• @​luilegeant made their first contribution in #​5414
• @​smellems made their first contribution in #​5433
• @​blast-hardcheese made their first contribution in #​5431
• @​RobinFrcd made their first contribution in #​5429
• @​alikhil made their first contribution in #​5446

Full Changelog: external-secrets/external-secrets@v0.20.2...v0.20.3

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.