chore(deps): update helm charts

[renovate]

This PR contains the following updates:

Package	Update	Change
argo-cd	patch	9.4.3 → 9.4.15
external-secrets	minor	2.0.1 → 2.2.0
reloader	patch	2.2.8 → 2.2.9
trivy-operator	patch	0.32.0 → 0.32.1

---

Release Notes

argoproj/argo-helm (argo-cd)

v9.4.15

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• fix(argo-cd): quote VPA updateMode to prevent YAML boolean coercion by @​snigdhasambitak in #​3790

New Contributors

• @​snigdhasambitak made their first contribution in #​3790

Full Changelog: argoproj/argo-helm@argo-workflows-1.0.4...argo-cd-9.4.15

v9.4.14

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• fix(argo-cd): Omit runAsUser for dex when deployed on OpenShift by @​CLNRMN in #​3785

New Contributors

• @​CLNRMN made their first contribution in #​3785

Full Changelog: argoproj/argo-helm@argo-workflows-1.0.3...argo-cd-9.4.14

v9.4.13

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• feat(argo-cd): Script to update Argo CD CRDs by @​tico24 in #​3782

Full Changelog: argoproj/argo-helm@argo-cd-9.4.12...argo-cd-9.4.13

v9.4.12

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• fix(argo-cd): Set ServerSideApply sync option annotation on CRDs by @​rouke-broersma in #​3781

New Contributors

• @​rouke-broersma made their first contribution in #​3781

Full Changelog: argoproj/argo-helm@argo-cd-9.4.11...argo-cd-9.4.12

v9.4.11

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• chore(deps): update actions/create-github-app-token action to v2.2.2 by @​argoproj-renovate[bot] in #​3774
• chore(deps): update actions/create-github-app-token action to v3 by @​argoproj-renovate[bot] in #​3775
• chore(deps): update renovatebot/github-action action to v46.1.5 by @​argoproj-renovate[bot] in #​3777
• chore(argo-cd): Update dependency argoproj/argo-cd to v3.3.4 by @​argoproj-renovate[bot] in #​3778

Full Changelog: argoproj/argo-helm@argocd-image-updater-1.1.3...argo-cd-9.4.11

v9.4.10

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• chore(argo-cd): Update dependency argoproj/argo-cd to v3.3.3 by @​argoproj-renovate[bot] in #​3768

Full Changelog: argoproj/argo-helm@argo-cd-9.4.9...argo-cd-9.4.10

v9.4.9

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• chore(argo-cd): Update ghcr.io/oliver006/redis_exporter Docker tag to v1.82.0 by @​argoproj-renovate[bot] in #​3766

Full Changelog: argoproj/argo-helm@argo-cd-9.4.8...argo-cd-9.4.9

v9.4.8

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• ci(github): add awaiting-upstream and keep to exempt labels by @​jmeridth in #​3763
• chore(deps): update renovatebot/github-action action to v46.1.3 by @​argoproj-renovate[bot] in #​3761
• chore(deps): bump the dependencies group with 2 updates by @​dependabot[bot] in #​3764
• chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 by @​dependabot[bot] in #​3765
• chore(argo-cd): Update ghcr.io/dexidp/dex Docker tag to v2.45.1 by @​argoproj-renovate[bot] in #​3749

Full Changelog: argoproj/argo-helm@argo-cd-9.4.7...argo-cd-9.4.8

v9.4.7

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• chore(deps): update ghcr.io/renovatebot/renovate docker tag to v43.49.0 by @​argoproj-renovate[bot] in #​3760
• feat(argo-cd): Add timeout.reconciliation.jitter config by @​sh-cho in #​3748

New Contributors

• @​sh-cho made their first contribution in #​3748

Full Changelog: argoproj/argo-helm@argo-cd-9.4.6...argo-cd-9.4.7

v9.4.6

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @​dependabot[bot] in #​3759
• feat(argo-cd): add support for custom statefulset labels by @​inesmuka98 in #​3740

New Contributors

• @​inesmuka98 made their first contribution in #​3740

Full Changelog: argoproj/argo-helm@argo-cd-9.4.5...argo-cd-9.4.6

v9.4.5

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• chore(deps): update renovatebot/github-action action to v46.1.2 by @​argoproj-renovate[bot] in #​3746
• feat(argo-cd): Allow configuring HTTPRoute timeouts by @​jonasz-lasut in #​3755

New Contributors

• @​jonasz-lasut made their first contribution in #​3755

Full Changelog: argoproj/argo-helm@argo-cd-9.4.4...argo-cd-9.4.5

v9.4.4

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• chore(deps): bump the dependencies group with 3 updates by @​dependabot[bot] in #​3742
• chore(argo-cd): Update dependency argoproj/argo-cd to v3.3.2 by @​argoproj-renovate[bot] in #​3745

Full Changelog: argoproj/argo-helm@argo-cd-9.4.3...argo-cd-9.4.4

external-secrets/external-secrets (external-secrets)

v2.2.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.2.0
Image: ghcr.io/external-secrets/external-secrets:v2.2.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.2.0-ubi-boringssl

What's Changed

General

• chore: release charts v2.1.0 by @​Skarlso in #​6030
• chore: fix the stability doc by @​Skarlso in #​6035
• fix(security): Fix vulnerabilities by @​othomann in #​6052
• fix(aws): sync tags and resource policy even when secret value unchanged by @​evs-secops in #​6025
• fix: publish now uses docker build v4 which required some changes by @​Skarlso in #​6062
• feat(gcpsm): auto-detect projectID from GCP metadata server by @​patjlm in #​5922
• chore(templating): Remove years in license and their checks by @​evrardj-roche in #​5955
• docs: Add Roche to official ADOPTERS by @​evrardj-roche in #​6076
• feat: Add Last Sync column to ExternalSecret and PushSecret printers by @​jaruwat-panturat in #​6068
• fix(onepassword): support native item IDs by @​chadxz in #​6073
• feat: extract LGTM processor to external JS file with tests by @​mateenali66 in #​6074
• feat: fail fast if LGTM label does not exist in repository by @​mateenali66 in #​6078
• feat(passbolt): add support for Passbolt V5 API by @​cedricherzog-passbolt in #​5919
• fix(infisical): dataFrom.find.path should filter by secret path not name by @​johnvox in #​6086
• fix: disable the priority queue which misbehaves at scale by @​Skarlso in #​6083
• chore: update go version to 1.26.1 by @​Skarlso in #​6072
• docs(aws): fix PushSecret metadata indentation in resource policy exa... by @​Br1an67 in #​6056
• fix(aws): prevent EC2 IMDS fallback when explicit credentials are pro... by @​Br1an67 in #​6036
• feat(templating): Add certSANs function to extract SANs from certificates by @​mzdeb in #​6058
• docs: document template.metadata labels/annotations behavior by @​lucpas in #​6102
• fix: CODEOWNERS are seriously out of date by @​Skarlso in #​6106
• feat(helm): add readinessProbe support for external-secrets deployment by @​AlexOQ in #​5831
• fix: update grpc for CVE-2026-33186 by @​Skarlso in #​6108
• feat(azurekv): add expiration time to azure kv secret by @​muraliavarma in #​5935
• feat: add path to cloud.ru provider by @​heavyandrew in #​5952
• fix(add-eso-version): fix separator line pattern in add_eso_version.sh script by @​riccardomc in #​6113

Dependencies

• chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 by @​dependabot[bot] in #​6038
• chore(deps): bump charset-normalizer from 3.4.4 to 3.4.5 in /hack/api-docs by @​dependabot[bot] in #​6047
• chore(deps): bump platformdirs from 4.9.2 to 4.9.4 in /hack/api-docs by @​dependabot[bot] in #​6050
• chore(deps): bump mkdocs-material from 9.7.3 to 9.7.4 in /hack/api-docs by @​dependabot[bot] in #​6049
• chore(deps): bump github/codeql-action from 4.32.4 to 4.32.6 by @​dependabot[bot] in #​6039
• chore(deps): bump step-security/harden-runner from 2.15.0 to 2.15.1 by @​dependabot[bot] in #​6043
• chore(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0 by @​dependabot[bot] in #​6040
• chore(deps): bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 by @​dependabot[bot] in #​6044
• chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 by @​dependabot[bot] in #​6042
• chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by @​dependabot[bot] in #​6041
• chore(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by @​dependabot[bot] in #​6046
• chore(deps): bump aquasecurity/trivy-action from 0.34.1 to 0.35.0 by @​dependabot[bot] in #​6048
• chore(deps): bump anchore/sbom-action from 0.23.0 to 0.23.1 by @​dependabot[bot] in #​6093
• chore(deps): bump distroless/static from 28efbe9 to 47b2d72 by @​dependabot[bot] in #​6088
• chore(deps): bump ubi9/ubi from cecb1cd to 6ed9f6f by @​dependabot[bot] in #​6087
• chore(deps): bump mkdocs-material from 9.7.4 to 9.7.5 in /hack/api-docs by @​dependabot[bot] in #​6096
• chore(deps): bump tornado from 6.5.4 to 6.5.5 in /hack/api-docs by @​dependabot[bot] in #​6094
• chore(deps): bump charset-normalizer from 3.4.5 to 3.4.6 in /hack/api-docs by @​dependabot[bot] in #​6095
• chore(deps): bump step-security/harden-runner from 2.15.1 to 2.16.0 by @​dependabot[bot] in #​6089
• chore(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 by @​dependabot[bot] in #​6092
• chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by @​dependabot[bot] in #​6090
• chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 by @​dependabot[bot] in #​6091

New Contributors

• @​othomann made their first contribution in #​6052
• @​evs-secops made their first contribution in #​6025
• @​patjlm made their first contribution in #​5922
• @​jaruwat-panturat made their first contribution in #​6068
• @​chadxz made their first contribution in #​6073
• @​mateenali66 made their first contribution in #​6074
• @​cedricherzog-passbolt made their first contribution in #​5919
• @​johnvox made their first contribution in #​6086
• @​Br1an67 made their first contribution in #​6056
• @​mzdeb made their first contribution in #​6058
• @​lucpas made their first contribution in #​6102
• @​AlexOQ made their first contribution in #​5831
• @​muraliavarma made their first contribution in #​5935
• @​heavyandrew made their first contribution in #​5952

Full Changelog: external-secrets/external-secrets@v2.1.0...v2.2.0

v2.1.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.1.0
Image: ghcr.io/external-secrets/external-secrets:v2.1.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.1.0-ubi-boringssl

What's Changed

General

• chore(release): Update helm chart by @​evrardj-roche in #​5981
• fix: cosign verify does not use signing config by @​gusfcarvalho in #​5982
• docs: Update release process by @​evrardj-roche in #​5980
• fix: allow cross-namespace push with ClusterSecretStore objects by @​Skarlso in #​5998
• feat(charts): add new flag enable leader for cert-manager by @​nutmos in #​5863
• feat(kubernetes): fall back to system CA roots when no CA is configured by @​rajsinghtech in #​5961
• feat: dedup sbom but keep it monolithic by @​moolen in #​6004
• fix: add missing metrics and fundamentally fix the caching logic by @​Skarlso in #​5894
• docs: designate Oracle Vault provider as 'stable' by @​anders-swanson in #​6020
• docs: Oracle Vault provider capabilities by @​anders-swanson in #​6023
• docs(azurekv): cert-manager pushsecret example and cleanups by @​illrill in #​5972
• feat(kubernetes): implement SecretExists by @​Saku2 in #​5973
• fix(charts): Fix wrongly set annotations for cert-controller metrics service by @​josemaia in #​6029
• feat(providers): Nebius MysteryBox integration by @​greenmapc in #​5868

Dependencies

• chore(deps): bump aquasecurity/trivy-action from 0.34.0 to 0.34.1 by @​dependabot[bot] in #​5986
• chore(deps): bump mkdocs-material from 9.7.1 to 9.7.2 in /hack/api-docs by @​dependabot[bot] in #​5992
• chore(deps): bump ubi9/ubi from b8923f5 to cecb1cd by @​dependabot[bot] in #​5984
• chore(deps): bump helm/kind-action from 1.13.0 to 1.14.0 by @​dependabot[bot] in #​5985
• chore(deps): bump actions/dependency-review-action from 4.8.2 to 4.8.3 by @​dependabot[bot] in #​5990
• chore(deps): bump github/codeql-action from 4.32.3 to 4.32.4 by @​dependabot[bot] in #​5989
• chore(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 by @​dependabot[bot] in #​5987
• chore(deps): bump regex from 2026.1.15 to 2026.2.19 in /hack/api-docs by @​dependabot[bot] in #​5991
• chore(deps): bump actions/stale from 10.1.1 to 10.2.0 by @​dependabot[bot] in #​5988
• chore(deps): bump regex from 2026.2.19 to 2026.2.28 in /hack/api-docs by @​dependabot[bot] in #​6012
• chore(deps): bump mkdocs-material from 9.7.2 to 9.7.3 in /hack/api-docs by @​dependabot[bot] in #​6014
• chore(deps): bump step-security/harden-runner from 2.14.2 to 2.15.0 by @​dependabot[bot] in #​6015
• chore(deps): bump anchore/sbom-action from 0.22.2 to 0.23.0 by @​dependabot[bot] in #​6016
• chore(deps): bump certifi from 2026.1.4 to 2026.2.25 in /hack/api-docs by @​dependabot[bot] in #​6013
• chore(deps): bump actions/setup-go from 6.2.0 to 6.3.0 by @​dependabot[bot] in #​6010
• chore(deps): bump hashicorp/setup-terraform from ce70bcf to 5e8dbf3 by @​dependabot[bot] in #​6011
• chore(deps): bump actions/attest-build-provenance from 3.2.0 to 4.1.0 by @​dependabot[bot] in #​6009
• chore(deps): bump distroless/static from 972618c to 28efbe9 by @​dependabot[bot] in #​6008

New Contributors

• @​nutmos made their first contribution in #​5863
• @​rajsinghtech made their first contribution in #​5961
• @​illrill made their first contribution in #​5972
• @​Saku2 made their first contribution in #​5973
• @​greenmapc made their first contribution in #​5868

Full Changelog: external-secrets/external-secrets@v2.0.1...v2.1.0

aquasecurity/helm-charts (trivy-operator)

v0.32.1

Compare Source

Keeps security report resources updated

---

Configuration

📅 Schedule: Branch creation - "before 9am on saturday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[atlantis-homelab-user-cube]

Plan Error

deleting dir '/atlantis-data/repos/user-cube/cluster-bootstrap/44/default' before cloning: unlinkat /atlantis-data/repos/user-cube/cluster-bootstrap/44/default/.git/hooks: permission denied

[atlantis-homelab-user-cube]

Plan Error

deleting dir '/atlantis-data/repos/user-cube/cluster-bootstrap/44/default' before cloning: unlinkat /atlantis-data/repos/user-cube/cluster-bootstrap/44/default/.git/hooks: permission denied

[atlantis-homelab-user-cube]

Plan Error

deleting dir '/atlantis-data/repos/user-cube/cluster-bootstrap/44/default' before cloning: unlinkat /atlantis-data/repos/user-cube/cluster-bootstrap/44/default/.git/hooks: permission denied

[atlantis-homelab-user-cube]

Plan Error

deleting dir '/atlantis-data/repos/user-cube/cluster-bootstrap/44/default' before cloning: unlinkat /atlantis-data/repos/user-cube/cluster-bootstrap/44/default/.git/hooks: permission denied

[atlantis-homelab-user-cube]

Plan Error

deleting dir '/atlantis-data/repos/user-cube/cluster-bootstrap/44/default' before cloning: unlinkat /atlantis-data/repos/user-cube/cluster-bootstrap/44/default/.git/hooks: permission denied

[atlantis-homelab-user-cube]

Plan Error

deleting dir '/atlantis-data/repos/user-cube/cluster-bootstrap/44/default' before cloning: unlinkat /atlantis-data/repos/user-cube/cluster-bootstrap/44/default/.git/hooks: permission denied

[atlantis-homelab-user-cube]

Plan Error

deleting dir '/atlantis-data/repos/user-cube/cluster-bootstrap/44/default' before cloning: unlinkat /atlantis-data/repos/user-cube/cluster-bootstrap/44/default/.git/hooks: permission denied

[atlantis-homelab-user-cube]

Plan Error

deleting dir '/atlantis-data/repos/user-cube/cluster-bootstrap/44/default' before cloning: unlinkat /atlantis-data/repos/user-cube/cluster-bootstrap/44/default/.git/hooks: permission denied

[atlantis-homelab-user-cube]

Plan Error

deleting dir '/atlantis-data/repos/user-cube/cluster-bootstrap/44/default' before cloning: unlinkat /atlantis-data/repos/user-cube/cluster-bootstrap/44/default/.git/hooks: permission denied

[atlantis-homelab-user-cube]

Plan Error

deleting dir '/atlantis-data/repos/user-cube/cluster-bootstrap/44/default' before cloning: unlinkat /atlantis-data/repos/user-cube/cluster-bootstrap/44/default/.git/hooks: permission denied

[atlantis-homelab-user-cube]

Plan Error

deleting dir '/atlantis-data/repos/user-cube/cluster-bootstrap/44/default' before cloning: unlinkat /atlantis-data/repos/user-cube/cluster-bootstrap/44/default/.git/hooks: permission denied

[atlantis-homelab-user-cube]

Plan Error

deleting dir '/atlantis-data/repos/user-cube/cluster-bootstrap/44/default' before cloning: unlinkat /atlantis-data/repos/user-cube/cluster-bootstrap/44/default/.git/hooks: permission denied