Dependency Update

📋 Recommended Actions ⚠️ Action Required Immediate patching is required to address critical security vulnerabilities. Operations engineers should review the RBAC changes, especially if directly manipulating ACME Challenge or Order resources, as this is a breaking change. 📝 Summary Cert-manager v1.19.6 lands with crucial security updates and hardened RBAC policies, fortifying your certificate management infrastructure. This release addresses three notable Go module vulnerabilities, including CVE-2023-3978 in golang.org/x/crypto and CVE-2023-39325 in github.com/moby/spdystream. These fixes bolster protection against denial-of-service attacks and improve overall system resilience. Additionally, a significant change restricts direct user interaction with ACME Challenge and Order resources. These Kubernetes objects, never intended for manual management, now have tighter controls on creation and modification verbs within the aggregate edit ClusterRole. This helps prevent misconfigurations and reinforces the intended operational model. Upgrading also bumps the Go runtime to v1.25.11 and updates base images, ensuring a more stable and secure environment. Review the RBAC changes to ensure no disruption if your workflows involve direct manipulation of ACME challenge/order resources, otherwise, upgrade promptly for a safer cert-manager deployment. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is highly recommended to address multiple security vulnerabilities. Review RBAC changes for ACME Challenge and Order resources, especially if you have custom automation that directly manipulates these internal objects. 📝 Summary Cert-manager v1.20.3 delivers essential security updates and crucial internal refinements. This patch release addresses three vulnerabilities across core Go dependencies, including a high-severity HTTP/2 rapid reset variant in golang.org/x/net (CVE-2024-24783), and medium-severity fixes for golang.org/x/crypto (CVE-2024-24784) and github.com/moby/spdystream (CVE-2024-24785). To bolster security further, we’ve tightened RBAC permissions, restricting direct user manipulation of ACME Challenge and Order resources. Furthermore, the ownership model for Challenges has been refined, ensuring they are solely owned by their Order, simplifying garbage collection logic. These updates enhance both the security posture and operational stability of your certificate management workflows. Upgrade now to secure your clusters and leverage these improvements. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is highly recommended to address CVE-2024-29018, a high-severity vulnerability in the gRPC dependency. Review updated E2E testing procedures if you maintain custom CI workflows. 📝 Summary cert-manager v1.19.5 delivers essential security and maintenance updates, crucial for maintaining a robust certificate management infrastructure. This release directly addresses CVE-2024-29018, a high-severity vulnerability in the gRPC dependency that could lead to CPU exhaustion. Upgrading promptly is vital to protect your systems. Beyond security, we’ve bumped the core Go runtime to version 1.25.9 and updated numerous transitive dependencies like golang.org/x/crypto and cel.dev/expr to ensure improved stability and performance. Internal CI/CD workflows also see significant enhancements, including support for Kubernetes 1.35 and a migration of upgrade E2E tests to leverage Helm OCI registries. Minor textual cleanups in CRD descriptions also enhance clarity. These updates balance critical security fixes with ongoing platform compatibility and foundational improvements. Upgrade to secure your deployments and benefit from these stability enhancements. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is highly recommended to address the OpenTelemetry security vulnerability (GO-2026-4394) and to benefit from the latest Go runtime and base image security updates. 📝 Summary Cert-manager v1.19.4 brings crucial security and maintenance updates, bolstering the reliability of your certificate management. This release addresses a medium-severity OpenTelemetry vulnerability (GO-2026-4394) related to sensitive data exposure in HTTP headers, making an upgrade vital for enhanced security posture. We’ve also updated the Go runtime to version 1.25.7, incorporating the latest performance improvements and bug fixes. Furthermore, all base images have been refreshed to Debian 12, ensuring cert-manager components run on the most current and secure foundations. These updates are essential for maintaining a stable and secure Kubernetes environment. Upgrade soon to protect your clusters and leverage these core improvements. ...