fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
argo-cd		patch	9.4.2 → 9.4.5
cert-manager (source)		patch	v1.19.3 → v1.19.4
descheduler		minor	0.34.0 → 0.35.0
docker.io/kanidm/server		patch	1.9.0 → 1.9.1
eck-operator		patch	3.3.0 → 3.3.1
external-secrets		patch	2.0.0 → 2.0.1
k8s.io/api	require	patch	v0.35.1 → v0.35.2
k8s.io/apimachinery	require	patch	v0.35.1 → v0.35.2
k8s.io/client-go	require	patch	v0.35.1 → v0.35.2
kube-prometheus-stack (source)		minor	82.1.0 → 82.4.2
quay.io/argoprojlabs/argocd-image-updater		patch	v1.1.0 → v1.1.1
rook-ceph		patch	v1.19.1 → v1.19.2
rook-ceph-cluster		patch	v1.19.1 → v1.19.2
traefik (source)		patch	39.0.1 → 39.0.2

---

Release Notes

argoproj/argo-helm (argo-cd)

v9.4.5

Compare Source

v9.4.4

Compare Source

v9.4.3

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• chore(github): upgrade SECURITY-INSIGHTS.yml to v2.2.0 schema by @​jmeridth in #​3729
• chore(argo-cd): Update dependency argoproj/argo-cd to v3.3.1 by @​argoproj-renovate[bot] in #​3737

Full Changelog: argoproj/argo-helm@argo-workflows-0.47.4...argo-cd-9.4.3

cert-manager/cert-manager (cert-manager)

v1.19.4

Compare Source

kubernetes-sigs/descheduler (descheduler)

v0.35.0: Descheduler v0.35.0

Compare Source

What's Changed

• feat: enable pod protection based on storage classes by @​ricardomaraschini in #​1752
• fix: pod resource calculation to consider native sidecars by @​a7i in #​1771
• docs: fix incorrect gracePeriodSeconds default in README.md by @​petersalas in #​1773
• docs: fix README.md link to kubernetes bot commands by @​Sycrosity in #​1772
• Fix "Current requires cgo or $USER set in environment" error by @​abelfodil in #​1764
• refactor(TestPodLifeTime): remove ineffective owner references assignments by @​ingvagabund in #​1781
• refactor(TestPodLifeTime): have a pod fully created through BuildTestPod without any edits by @​ingvagabund in #​1782
• refactor(TestPodLifeTime): consolidations, simplifications and node instance for each unit test by @​ingvagabund in #​1783
• refactor(TestPodLifeTime): inline pod creation in each unit test to avoid accidental pod spec updates by @​ingvagabund in #​1784
• refactor(TestPodLifeTime): update unit test names and simplify pod creation by @​ingvagabund in #​1785
• feat(TestPodLifeTime): check only expected pods are evicted by @​ingvagabund in #​1787
• feat(PodLifeTime): document the plugin with details that can be used for reasoning during reviews and design discussions by @​ingvagabund in #​1789
• refactor(TestPodLifeTime): split the unit tests into smaller semantically close groups by @​ingvagabund in #​1790
• refactor(TestFindDuplicatePods): have a pod fully created through BuildTestPod without any edits by @​ingvagabund in #​1791
• refactor(TestFindDuplicatePods): reduce duplicates and inline by @​ingvagabund in #​1792
• refactor(TestRemoveDuplicates): reduce test code duplication by @​ingvagabund in #​1793
• refactor(TestRemovePodsHavingTooManyRestarts): inline object creation by @​ingvagabund in #​1794
• refactor(TestPodAntiAffinity): inline object creation by @​ingvagabund in #​1795
• refactor(TestRemovePodsViolatingNodeAffinity): inline object creation by @​ingvagabund in #​1796
• refactor(TestDeletePodsViolatingNodeTaints): inline object creation by @​ingvagabund in #​1797
• doc: introduce contributing guidelines specific to the project by @​ingvagabund in #​1798
• refactor(TestDefaultEvictor): de-dup code and use helpers by @​ingvagabund in #​1803
• refactor(plugins): simplify the way pods are created by @​ingvagabund in #​1804
• fix(TestReadyNodesWithNodeSelector): make sure nodeLister.List always returns a non-empty list so the lister is always tested by @​ingvagabund in #​1800
• refactor(pkg/framework/profile): dedup unit test code by @​ingvagabund in #​1806
• doc(Design Decisions FAQ): Why doesn't the framework provide helpers for registering and retrieving indexers for plugins by @​ingvagabund in #​1807
• feat(profile): inject a plugin instance ID to each built plugin by @​ingvagabund in #​1808
• feat: register a node indexer for the global node selector instead of listing nodes with the selector by @​ingvagabund in #​1802
• chore(pkg/descheduler): make TestPodEvictorReset table driven by @​ingvagabund in #​1810
• refactor(pkg/operator): replace informerResource with a kubeClientSandbox by @​ingvagabund in #​1811
• refactor(pkg/descheduler): more handlers and dropping unused code by @​ingvagabund in #​1813
• refactor(pkg/descheduler): create fake shared informer factory only once by @​ingvagabund in #​1812
• fix(kubeClientSandbox): do not wait for pods in the fake indexers if they are already deleted by @​ingvagabund in #​1814
• test(pkg/descheduler): test a prometheus client update propagates to a plugin profile handle by @​ingvagabund in #​1816
• Add namespace label selector by @​W1seKappa in #​1786
• tests: Prom client testing by @​ingvagabund in #​1818
• Deduplicate descheduler initialization code so unit tests test more of the production code by @​ingvagabund in #​1819
• test(token reconciling): have tests initialize the prom client reconciling through the descheduler's bootstraping entry too by @​ingvagabund in #​1820
• refactor(promClientController): split it into two prom client controllers by @​ingvagabund in #​1821
• feat(pkg/descheduler): create profiles outside the descheduling cycle by @​ingvagabund in #​1815
• refactor: move prometheus client controller related code under a seperate file by @​ingvagabund in #​1823
• Update go dependecies to fix vulnerabilities by @​sammedsingalkar09 in #​1822
• chore: extend the list of supported Go versions by @​ingvagabund in #​1828
• bump(golangci-lint): update and migrate by @​ingvagabund in #​1829
• [v0.35.0] bump to kubernetes 1.35 deps by @​a7i in #​1827
• chore: upgrade github.com/gomarkdown/markdown to latest version by @​a7i in #​1831
• [v0.35.0] update docs and manifests by @​a7i in #​1832
• Change annotations condition to deploymentAnnotations for Deployment object annotations by @​davidandreoletti in #​1830

New Contributors

• @​petersalas made their first contribution in #​1773
• @​Sycrosity made their first contribution in #​1772
• @​abelfodil made their first contribution in #​1764
• @​W1seKappa made their first contribution in #​1786
• @​sammedsingalkar09 made their first contribution in #​1822
• @​davidandreoletti made their first contribution in #​1830

Full Changelog: kubernetes-sigs/descheduler@v0.34.0...v0.35.0

elastic/cloud-on-k8s (eck-operator)

v3.3.1

Compare Source

Elastic Cloud on Kubernetes 3.3.1

• Quickstart guide

Release Highlights

Removing Enterprise requirement for Elastic AutoOps

ECK 3.3.1 has removed the enterprise requirement for AutoOpsAgentPolicy. AutoOps can now be used by on premises users without the need for an enterprise license.

Features and enhancements

• Removing enterprise requirement for AutoOpsAgentPolicy #​9125
• Add Namespace Selector to AutoOpsAgentPolicy #​8991
• Update minimum AutoOps Agent to 9.2.4 when a Basic license is used #​9157

Dependency updates

• Go 1.25.6 => 1.25.7
• github.com/elastic/go-ucfg v0.8.9-0.20251017163010-3520930bed4f -> v0.8.9-0.20260108155023-368693374ae9
• go.elastic.co/apm/v2 v2.7.2 -> v2.7.3
• golang.org/x/crypto v0.46.0 -> v0.48.0
• k8s.io/api v0.35.0 -> v0.35.1
• k8s.io/apimachinery v0.35.0 -> v0.35.1
• k8s.io/client-go v0.35.0 -> v0.35.1

external-secrets/external-secrets (external-secrets)

v2.0.1

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.0.1
Image: ghcr.io/external-secrets/external-secrets:v2.0.1-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.0.1-ubi-boringssl

What's Changed

General

• chore: release helm chart for v2.0.0 by @​Skarlso in #​5932
• docs: update the stability doc with the new version by @​Skarlso in #​5933
• chore(doc): add loblaw to adopter md by @​FZhg in #​5937
• chore: bump golang to 1.25.7 because of cve by @​Skarlso in #​5938
• fix: deleting the whole secret when it is empty by @​Skarlso in #​5927
• chore: update controller runtime by @​Skarlso in #​5930
• fix: update cosign and syft for signing by @​Skarlso in #​5958
• fix: the informer can not register use GetInformer instead by @​Skarlso in #​5931
• fix: attempt to fix cosign compatibility issues by @​gusfcarvalho in #​5959
• chore: remove outdated info from stability doc by @​Skarlso in #​5971
• chore(deps): update Masterminds/sprig to 8cb06fe… by @​tete17 in #​5747
• docs(release): Update support matrix by @​evrardjp in #​5978

Dependencies

• chore(deps): bump golang from 20c8a94 to f6751d8 by @​dependabot[bot] in #​5940
• chore(deps): bump ubi9/ubi from c8df11b to b8923f5 by @​dependabot[bot] in #​5939
• chore(deps): bump distroless/static from cd64bec to 972618c by @​dependabot[bot] in #​5941
• chore(deps): bump github/codeql-action from 4.32.0 to 4.32.2 by @​dependabot[bot] in #​5942
• chore(deps): bump anchore/sbom-action from 0.22.1 to 0.22.2 by @​dependabot[bot] in #​5943
• chore(deps): bump step-security/harden-runner from 2.14.1 to 2.14.2 by @​dependabot[bot] in #​5944
• chore(deps): bump zizmorcore/zizmor-action from 0.4.1 to 0.5.0 by @​dependabot[bot] in #​5945
• chore(deps): bump fossas/fossa-action from 1.7.0 to 1.8.0 by @​dependabot[bot] in #​5946
• chore(deps): bump aws-actions/configure-aws-credentials from 5.1.1 to 6.0.0 by @​dependabot[bot] in #​5947
• chore(deps): bump github/codeql-action from 4.32.2 to 4.32.3 by @​dependabot[bot] in #​5965
• chore(deps): bump markdown from 3.10.1 to 3.10.2 in /hack/api-docs by @​dependabot[bot] in #​5968
• chore(deps): bump aquasecurity/trivy-action from 0.33.1 to 0.34.0 by @​dependabot[bot] in #​5964
• chore(deps): bump platformdirs from 4.5.1 to 4.9.2 in /hack/api-docs by @​dependabot[bot] in #​5967
• chore(deps): bump pymdown-extensions from 10.20.1 to 10.21 in /hack/api-docs by @​dependabot[bot] in #​5969

New Contributors

• @​FZhg made their first contribution in #​5937

Full Changelog: external-secrets/external-secrets@v2.0.0...v2.0.1

kubernetes/api (k8s.io/api)

v0.35.2

Compare Source

kubernetes/apimachinery (k8s.io/apimachinery)

v0.35.2

Compare Source

kubernetes/client-go (k8s.io/client-go)

v0.35.2

Compare Source

prometheus-community/helm-charts (kube-prometheus-stack)

v82.4.2

Compare Source

v82.4.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​6684

Full Changelog: prometheus-community/helm-charts@prometheus-28.11.0...kube-prometheus-stack-82.4.1

v82.4.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] unify PodDisruptionBudget configuration by @​mkmet in #​6669

New Contributors

• @​mkmet made their first contribution in #​6669

Full Changelog: prometheus-community/helm-charts@prometheus-nginx-exporter-1.19.1...kube-prometheus-stack-82.4.0

v82.3.0

Compare Source

v82.2.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​6668

Full Changelog: prometheus-community/helm-charts@prometheus-snmp-exporter-9.12.1...kube-prometheus-stack-82.2.1

v82.2.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​6665

Full Changelog: prometheus-community/helm-charts@prometheus-adapter-5.3.0...kube-prometheus-stack-82.2.0

v82.1.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [CI] Update helm/kind-action action to v1.14.0 by @​renovate[bot] in #​6657
• [kube-prometheus-stack] Fix default Kubernetes version assignment logic by @​EmyLIEUTAUD in #​6658

New Contributors

• @​EmyLIEUTAUD made their first contribution in #​6658

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-82.1.0...kube-prometheus-stack-82.1.1

rook/rook (rook-ceph)

v1.19.2

Compare Source

Improvements

Rook v1.19.2 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• csi: Update imagePullPolicy in operatorconfig and driver CR (#​17084, @​iPraveenParihar)
• osd: Fix OSDs on multipath device with metadata device (#​17083, @​satoru-takeuchi)
• build: Publish images with buildx instead of manifest-tool (#​17079, @​subhamkrai)
• rgw: Update status info when http is disabled (#​17050, @​sp98)
• object: Add ObjectStoreUserSpec.OpMask field (#​17037, @​jhoblitt)
• exporter: Add log collector for ceph exporter pod (#​16584, @​subhamkrai)
• csi: Update ceph-csi image to 3.16.1 (#​17060, @​iPraveenParihar)
• build(deps): bump sigs.k8s.io/controller-runtime from 0.22.4 to 0.23.0 in the k8s-dependencies group (#​16963, @​dependabot[bot])
• osd: In cephx key init, don't overwrite key on failure (#​17052, @​BlaineEXE)
• nvmeof: Add default gateway topology spread constraints (#​17074, @​OdedViner)
• nvmeof: Update expansion fields and sidecar images (#​17019, @​OdedViner)

traefik/traefik-helm-chart (traefik)

v39.0.2

Compare Source

🚀 Features

• feat: 📦 allow IBM cloud values #​1677 by @​darkweaver87

📦 Others

• chore(deps): update helm/kind-action action to v1.14.0 #​1675 by @​renovate[bot]
• docs: fix typo in examples #​1676 by @​rverchere
• chore(release): 🚀 publish traefik 39.0.2 #​1678 by @​darkweaver87

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.