fix(deps): update all non-major go dependencies#90
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
| datasource | package | from | to | | ---------- | ------------------------------------------ | ------- | ------- | | go | github.com/cert-manager/cert-manager | v1.19.2 | v1.21.0 | | go | github.com/cloudnative-pg/api | v1.27.0 | v1.30.0 | | go | github.com/cloudnative-pg/cloudnative-pg | v1.27.2 | v1.30.0 | | go | github.com/cloudnative-pg/cnpg-i | v0.3.0 | v0.5.0 | | go | github.com/cloudnative-pg/cnpg-i-machinery | v0.4.1 | v0.4.2 | | go | github.com/cloudnative-pg/machinery | v0.3.1 | v0.5.0 | | go | github.com/onsi/ginkgo/v2 | v2.27.3 | v2.32.0 | | go | github.com/onsi/gomega | v1.38.3 | v1.42.1 | | go | google.golang.org/grpc | v1.77.0 | v1.82.1 | Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate
Bot
force-pushed
the
renovate/all-non-major-go-dependencies
branch
from
July 21, 2026 11:57
434dd21 to
80d1478
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.19.2→v1.21.0v1.27.0→v1.30.0v1.27.2→v1.30.0v0.3.0→v0.5.0v0.4.1→v0.4.2v0.3.1→v0.5.0v2.27.3→v2.32.0v1.38.3→v1.42.1v1.77.0→v1.82.1Release Notes
cert-manager/cert-manager (github.com/cert-manager/cert-manager)
v1.21.0Compare Source
v1.20.3Compare Source
v1.20.2Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.20.2 fixes invalid YAML generated in the Helm chart when both
webhook.configand
webhook.volumesare defined, and bumps Go to 1.26.2 along with dependenciesto address reported vulnerabilities.
Changes by Kind
Bug or Regression
webhook.configandwebhook.volumesare defined. (#8665, @cert-manager-bot)Other (Cleanup or Flake)
v1.20.1Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.20.1 fixes an issue for OpenShift users that has to do with the finalizer RBAC, bumps gRPC to address a reported non-affecting vulnerability, and fixes a duplicate
parentRefbug when both issuer config and annotations are present (Gateway API).Bug or Regression
parentRefbug when both issuer config and annotations are present. (#8658, @hjoshi123)v1.20.0Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.20.0 adds alpha support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta.
Changes by Kind
Feature
imagePullSecretsin thestartupapicheck-jobHelm template to enable pulling images from private registries. (#8186, @mathieu-clnk)parentRefoverride annotations on the Certificate resource. (#8518, @hjoshi123)venafi.cert-manager.io/custom-fieldsannotation on Issuer/ClusterIssuer and use it as base with override/append capabilities on Certificate level. (#8301, @k0da)acme.cert-manager.io/http01-ingress-ingressclassnameto overridehttp01.ingress.ingressClassNamefield in HTTP-01 challenge solvers. (#8244, @lunarwhite)global.nodeSelectorto helm chart to perform amergeand allow for a singlenodeSelectorto be set across all services. (#8195, @StingRayZA)XListenerSetsfeature gate (#8394, @hjoshi123)Documentation
Bug or Regression
Add full detailed DNS-01 errors to the events attached to the Challenge, for easier debugging (#8221, @wallrj-cyberark)
v1.25.5to fixCVE-2025-61727andCVE-2025-61729(#8290, @octo-sts[bot])cert-manager. Previously, it was set depending on various factors (namespace cert-manager is installed in and/or Helm release name). (#8162, @LiquidPL)Other (Cleanup or Flake)
XListenerSetsfeature gate toListenerSets(#8501, @hjoshi123)v1.19.6Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This patch release fixes a security issue (
GHSA-8rvj-mm4h-c258, HIGH) where the defaultcert-manager-editaggregate ClusterRole granted namespace users permission to create ACMEChallengeandOrderresources directly. A user who could create aChallengereferencing aClusterIssuercould supply attacker-controlled solver configuration while cert-manager loaded credentials from theClusterIssuer's namespace, bypassing Issuer solver selectors (dnsZones,dnsNames,matchLabels). With the acme-dns provider specifically, this could disclose DNS credentials to an attacker-controlled endpoint.This release also includes Go version bumps to address reported CVEs. All users should upgrade.
Changes by Kind
Bug or Regression
createand Ordercreate,patch,updateverbs from thecert-manager-editaggregate ClusterRole (GHSA-8rvj-mm4h-c258). (#8941, @wallrj-cyberark)Other (Cleanup or Flake)
v1.25.11to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 (#8925, @wallrj-cyberark)v1.19.5Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This is a simple patch release to fix some reported vulnerabilities. All users are recommended to upgrade.
Changes by Kind
Other (Cleanup or Flake)
v1.19.4Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.19.4 is a simple patch release to fix some reported vulnerabilities - notably CVE-2026-24051 and CVE-2025-68121. All users should upgrade.
Changes by Kind
Bug or Regression
v1.19.3Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This release contains three bug fixes, including a fix for the MODERATE severity DoS issue in GHSA-gx3x-vq4p-mhhv. All users should upgrade to the latest release.
Changes by Kind
Bug or Regression
Other (Cleanup or Flake)
cloudnative-pg/api (github.com/cloudnative-pg/api)
v1.30.0Compare Source
v1.29.1Compare Source
v1.29.0Compare Source
v1.28.1Compare Source
v1.28.0Compare Source
cloudnative-pg/cloudnative-pg (github.com/cloudnative-pg/cloudnative-pg)
v1.30.0Compare Source
Release date: Jun 29, 2026
Important changes
Updated the deprecation notice for native (in-tree) Barman Cloud support to reflect that it will now be removed in CloudNativePG 1.31.0, rather than 1.30.0. Users are still encouraged to migrate to the Barman Cloud Plugin. (#11083)
The
clusterreference is now immutable on theDatabase,Pooler,Publication,Subscription, andScheduledBackupresources. Pointing one of these objects at a different cluster has no well-defined semantics and previously left the controllers in an inconsistent state; the update is now rejected at the API server via a CEL validation rule. (#10743)Features
Primary
Leasefor safe primary election: introduced a KubernetesLeaseobject (named after the cluster) that acts as a mutex serializing primary promotion: the instance manager must hold the lease before acting as primary and releases it on clean shutdown so replicas can promote without waiting for the full TTL. Timings are configurable via the new.spec.primaryLeasestanza. The lease is a promotion gate, not a fence. Primary isolation remains responsible for fencing. (#10627)DatabaseRoleCRD for declarative role management: introduced aDatabaseRolecustom resource that manages a PostgreSQL role as a standalone Kubernetes object, instead of declaring it inline in theCluster's.spec.managed.rolesstanza. Each role gets its own lifecycle, status, and RBAC, which suits GitOps workflows and lets role definitions live next to the applications that own them. The spec reuses the sameRoleConfigurationstructure as the inline method, so migrating a role is a matter of moving the stanza into its own manifest. AdatabaseRoleReclaimPolicyfield (retain, the default, ordelete) controls what happens to the role when the resource is deleted, mirroring persistent volumes. (#6155)TLS client certificates for declarative roles: a
DatabaseRolecan now include aclientCertificateblock to have the operator automatically generate and renew a TLS client certificate, signed by the cluster's client CA and stored in a<databaserole-name>-client-certSecret. This enables password-free PostgreSQLcertauthentication; the Secret is cleaned up when the feature is disabled or theDatabaseRoleis deleted. (#10896)PgBouncer image management via image catalogs: the
Poolerresource can now reference an entry in anImageCatalogorClusterImageCatalogthrough the newspec.pgbouncer.imageCatalogReffield, centralizing PgBouncer image management. When a catalog entry is updated, all referencingPoolersare automatically reconciled and roll out the new image without any change to their spec. The resolved image is reported instatus.image, and a newstatus.phase(active,paused,inactive, orfailed), also surfaced as aPhasecolumn inkubectl get pooler, summarizes the lifecycle. (#10568)Enhancements
Enabled
pg_upgradein-place major upgrades to PostgreSQL 19 or later for clusters that use Image Volume extensions, building on the extension-path support added topg_upgradein PostgreSQL 19. During the upgradeJob, the source- and target-version extension images are mounted side by side, so the old server keeps its libraries and a failed upgrade reverts cleanly. (#10366)Added TLS support for the
Poolermetrics endpoint via.spec.monitoring.tls.enabled. When enabled, the metrics server is served over HTTPS, reusing the certificate and key from.spec.pgbouncer.clientTLSSecretand reloading it on every handshake to support rotation without a restart; the generatedPodMonitorscrapes overhttpsaccordingly. (#10466)Added a label selector to the
Clusterscale subresource (status.selector), making aClustera validtargetReffor the Vertical Pod Autoscaler (VPA) and Horizontal Pod Autoscaler (HPA), which can now map aClusterto its instance pods. Contributed by @sebv004. (#8996)The operator now emits a
WarningPrimaryStatusCheckFailedevent on theClusterwhen the primary pod isReadyfrom the kubelet perspective but the operator's/pg/statuscheck fails and failover is deferred, giving users visibility into the deferral viakubectl describe cluster. (#10509)Added the
ENABLE_WEBHOOK_NAMESPACE_SUFFIXflag, which suffixes the operator's webhook configuration names with-<OPERATOR_NAMESPACE>so that multiple operator instances can coexist on the same cluster. The operator only looks up these configurations; users must create and maintain them. Contributed by @maxlengdell. (#10420)The operator now reloads a CNPG-i plugin automatically when its pods are rolled: it watches the
EndpointSlicesbacking pluginServicesand re-enqueues every cluster using the plugin once the new pods becomeReady, so an upgraded plugin is picked up without waiting for the next resync. (#10836)Instance serial numbers are now assigned by reusing the lowest free slot among existing instance names, instead of always incrementing a global counter. Pod and PVC names stay stable across instance recreation (for example, an instance recreated after a node drain comes back with the same name), and serials freed by deleted instances are reclaimed. A new
Initializedcluster condition reports whether the cluster has completed its first bootstrap, andstatus.latestGeneratedNodeis deprecated: it is no longer written, but is preserved on the CRD for backward compatibility. (#10548)Defaulting and validation now run during reconciliation as a fallback when admission webhooks are unavailable, or configured to ignore failures, so the operator no longer reconciles invalid or incomplete specs. Missing defaults are applied directly, and validation failures are surfaced in the resource status instead of failing silently later. (#10874)
Security
CVE-2026-55769/GHSA-x8c2-3p4r-v9r6:search_pathpinning on operator-issued connections: a database owner could plant overloaded built-in operators in thepublicschema and alter thesearch_pathso that operator introspection probes, running as the cluster superuser, resolved those overloads beforepg_catalog, aCWE-426privilege-escalation chain (same class asCVE-2018-1058) that could lead to in-pod RCE viaCOPY ... FROM PROGRAM. The operator now pinssearch_path = pg_catalog, public, pg_tempon every pooled connection so it ships in the startup message and takes precedence over tenant-controlled defaults. (#10774,GHSA-x8c2-3p4r-v9r6)GHSA-7qwx-x8ff-3px9: authenticated operator-to-instance-manager calls: the instance manager's remote webserver relied on network isolation rather than authentication for its operator-only control endpoints, so any party able to reach the pod's status port could invoke them, disrupting backup orchestration and WAL archival and reading operational metadata. (The upgrade endpoint is SHA-256-pinned, so this did not permit arbitrary code execution.) The operator now generates an in-memory ECDSA P-256 client certificate at startup and reconciles its SHA-256 fingerprint into the cluster status; the instance manager rejects requests to sensitive endpoints that do not present a matching certificate. This hardening is not backported; earlier releases should continue to restrict the status port with aNetworkPolicy. (#10579,GHSA-7qwx-x8ff-3px9)CVE-2026-55765/GHSA-w3gf-xc94-wvmj: operator-side SCRAM-SHA-256 password encoding: the operator now SCRAM-SHA-256 encodes cleartext role passwords before issuingCREATE/ALTER ROLE ... PASSWORD, so the literal PostgreSQL parses (and that extensions such aspg_stat_statementsorpgauditmay capture) is the SCRAM verifier rather than the cleartext secret. Pre-hashed (MD5 or SCRAM) values are forwarded unchanged, and the per-Secret annotationcnpg.io/passwordPassthrough: "enabled"opts out. (#10724,GHSA-w3gf-xc94-wvmj)Changes
Added support for Kubernetes 1.36. (#10900)
Updated the default PostgreSQL version to 18.4. (#10719)
Updated the Kubernetes versions used to test the operator on public cloud providers. (#10720, #10563, #11033)
Fixes
Fixed declarative
Database,Publication, andSubscriptionobjects reporting a stale primary-side status forever after their cluster was demoted to a replica; the controller now re-checks the replica condition and watches theClusterso a demotion is detected promptly. (#10871)Fixed non-sequential pod names (for example
-1,-3) caused by the instance serial counter being advanced before the correspondingJoband PVCs were created; the bump is now persisted only after those resources exist. (#10491)Fixed deletion of a
Database,Publication, orSubscriptiongetting stuck inTerminatingon a replica cluster, where the replica gate ran before the finalizer reconciler and the finalizer was never released. On a replica the PostgreSQL object is left to the primary cluster. (#10853)Fixed a conflicting duplicate
DatabaseorSubscriptionwith adeletereclaim policy dropping the PostgreSQL object owned by the surviving CR; the drop is now gated on a recorded reconciliation. (#10870)Fixed the
postgressuperuser being left locked out after superuser access was disabled and then re-enabled, because the cached secret version was not invalidated and the password was never re-applied. Diagnosed by @mhartmann-jaconi. (#10834)Fixed backups getting stuck in the
startedphase when the instance manager running them was restarted (for example by the in-place upgrade following an operator upgrade) before the backup reachedrunning; the reconciliation is now rescheduled so the lost session is detected. (#10859)Fixed
exec/attachstreaming to negotiate WebSocket with a SPDY fallback, restoring compatibility both with Kubernetes versions that have removed SPDY and with platforms such as OpenShift that reject WebSocket exec upgrades. Contributed by @bartscheers. (#10876, #10933)Fixed resource leaks when concurrent
Backupobjects raced: backups now run in strict creation-time order, so an already-executing backup is never preempted by a newer one and its replication slot and PostgreSQL session are no longer orphaned on the primary. Contributed by @GabriFedi97. (#10747)Fixed role reconciliation clearing the password on a PostgreSQL role when the referenced Secret could not be fetched; the role is now left untouched until the Secret becomes available, and per-action errors are aggregated for better visibility. (#10053)
Fixed a bootstrap failure where a metrics-exporter setup error (commonly a duplicate-key race with the controller) rolled back
streaming_replicacreation and wedged replica joins. The metrics-exporter step now runs in a separate transaction. Contributed by @BlaiseAntony. (#10749)Fixed a
ScheduledBackupcontroller loop that occurred when aBackupwas created but its status patch never landed; the controller now adopts an existingBackupfor the next iteration instead of looping onAlreadyExists. (#10612)Fixed a nil-pointer panic when reconciling a
PoolerwhoseClusterhas been deleted. (#10667)Fixed bootstrap log handling so that all named log pipes (
postgres,postgres.csv, andpostgres.json) get consumers duringWithActiveInstance, preventing regular files from being created in place of the named pipes. (#10043)Fixed generation of invalid IPv6 URLs by wrapping the address in square brackets. Contributed by @Infinoid. (#10682)
Fixed an external cluster plugin still being treated as active when its configuration set
enabled: false. (#10932)Fixed a race during bootstrap recovery from an object store where the restore job could read a stale
Cluster(primary not yet recorded and timeline still unset) and have its.historyfiles rejected by the split-brain guard. When this happened, recovery stopped at the base backup's timeline and silently dropped transactions committed on later timelines. History files are now allowed while the cluster timeline is unset. Contributed by @dennispidun. (#10818)Fixed a race where deleting an instance's PVCs could leave the instance permanently stuck: if the data PVC was removed while a WAL PVC was still terminating, the operator recreated the instance bound to the terminating volume, leaving the Pod unschedulable and blocking all further reconciliation. The operator now waits for terminating PVCs to be fully removed before recreating or reattaching an instance, and surfaces the wait through a log line and the cluster phase. (#11017)
Fixed a cache race during cluster creation when the server and client CA resolve to the same Secret (the default): a stale informer cache triggered a redundant
Createthat failed withAlreadyExistsand could leave the cluster stuck inUnable to create required cluster objects. The operator now reuses the already-fetched CA Secret when the names match. (#10989)Fixed the
pg_basebackupbootstrap path overwriting or failing on a pre-existingPGDATA(for example after a replica Pod restart) by enforcing the same pre-flight directory check already applied by the other bootstrap methods; this also protects statically provisioned PVCs from being silently overwritten. (#11006)Fixed the
Clusterphase flapping betweenHealthyand a plugin-failure phase when a post-reconcile plugin hook returned an error; theHealthyphase is now registered as the last step of a successful reconciliation, so a loop that ends in a plugin error never reportsHealthy. Contributed by @GabriFedi97. (#10421)Fixed stale certificate data and partial reads after an external server's Secret was rotated (for example a CA bundle shrinking from two certificates to one): the file is now written atomically, so libpq always reads either the old or the new value, never a mix. Contributed by @Anand-240. (#10975)
Fixed plugin connectivity to use the plugin
ServiceFQDN instead of its short name, avoiding failures when a cluster-level proxy is automatically injected into pods. Contributed by @kdautrey. (#10921)Fixed excessive operator log noise from the per-request
Clustercreate/update validation webhook messages, now logged atdebuginstead ofinfo. (#10984)Fixed
spec.postgresql.parametersaccepting keys that are not valid PostgreSQL parameter names, which could inject arbitrary directives intopostgresql.conf; key names are now validated by the webhook. (#11029)Fixed a switchover deadlock when a WAL-archiver plugin was enabled on an existing cluster: with
primaryUpdateMethod: switchoverthe primary could not be rolled out because a clean demotion needs the archiver sidecar that is still missing. The operator now recreates the primary Pod in place so the sidecar is injected and archiving resumes. The check also covers plugins that inject the archiver as a native sidecar (an init container withrestartPolicy: Always), such as the Barman Cloud plugin. (#11032, #11059)Fixed a cluster staying in
Setting up primaryindefinitely when the instance-creation Job exhausted its backoff limit; the operator now detects the terminal Job failure and marks the cluster unrecoverable, naming the failed Job and pointing to its logs. (#11035)Fixed a first-primary bootstrap deadlock where a status-patch conflict after the data PVC was created but before the initialization Job was started left the orphan Pending PVC counted as an instance, blocking the bootstrap gate; the PVC-state reconciler now recreates the bootstrap Job reusing the assigned serial. (#11039)
Fixed external cluster names and secret selector references being joined into filesystem paths without validation, letting a
..component or path separator escape the external secrets directory when the instance manager dumps connection material; these values are now rejected at the validating webhook and re-checked at the write site. Reported by @r0binak. (#11045)Fixed a backup getting stuck in
pendingforever: the concurrent-backup gate ran on every reconcile and could overwrite an already-completed phase written asynchronously by the instance manager. The gate now runs only while the backup phase is still unset orpending. (#11056)Fixed a declarative
VolumeSnapshotbackup being permanently marked as failed when a stale cache made the operator re-create a snapshot it had already provisioned, failing withAlreadyExists. The operator now tolerates the collision when the existing snapshot carries this backup's label and adopts it; a collision with a foreign snapshot still surfaces as an error. (#11071)Fixed a volume snapshot backup being discarded on a transient instance-manager connection error (for example a dial timeout from a brief pod-network disruption) during the finalize step, even when its snapshots were already provisioned; such network errors are now retried instead of treated as terminal. (#11069)
Fixed a replica switchover losing its
status.demotionTokenwhen a reconcile was requeued between storing the token and cleaning up the transition metadata (for example a cleanup patch failing against a flaky webhook); the empty no-change token is no longer patched back over the stored value. (#11075)cnpgplugin:Fixed
kubectl cnpg psqlon Windows, where execution relied on a Unix-only system call and failed with "not supported by windows"; Windows now launcheskubectl execas a child process. Contributed by @Utkarsh-sharma47. (#10972)Fixed an unbounded memory leak in
kubectl cnpg logs -fon busy clusters, where a per-log-group timer was never released; timers are now reused across iterations. Contributed by @Anand-240. (#10976)Supported versions
v1.29.2Compare Source
Release date: Jun 29, 2026
Important changes
Updated the deprecation notice for native (in-tree) Barman Cloud support to reflect that it will now be removed in CloudNativePG 1.31.0, rather than 1.30.0. Users are still encouraged to migrate to the Barman Cloud Plugin. (#11083)
The
clusterreference is now immutable on theDatabase,Pooler,Publication,Subscription, andScheduledBackupresources. Pointing one of these objects at a different cluster has no well-defined semantics and previously left the controllers in an inconsistent state; the update is now rejected at the API server via a CEL validation rule. (#10743)Enhancements
Enabled
pg_upgradein-place major upgrades to PostgreSQL 19 or later for clusters that use Image Volume extensions, building on the extension-path support added topg_upgradein PostgreSQL 19. During the upgradeJob, the source- and target-version extension images are mounted side by side, so the old server keeps its libraries and a failed upgrade reverts cleanly. (#10366)Added a label selector to the
Clusterscale subresource (status.selector), making aClustera validtargetReffor the Vertical Pod Autoscaler (VPA) and Horizontal Pod Autoscaler (HPA), which can now map aClusterto its instance pods. Contributed by @sebv004. (#8996)The operator now emits a
WarningPrimaryStatusCheckFailedevent on theClusterwhen the primary pod isReadyfrom the kubelet perspective but the operator's/pg/statuscheck fails and failover is deferred, giving users visibility into the deferral viakubectl describe cluster. (#10509)The operator now reloads a CNPG-i plugin automatically when its pods are rolled: it watches the
EndpointSlicesbacking pluginServicesand re-enqueues every cluster using the plugin once the new pods becomeReady, so an upgraded plugin is picked up without waiting for the next resync. (#10836)Security and Supply Chain
CVE-2026-55769/GHSA-x8c2-3p4r-v9r6:search_pathpinning on operator-issued connections: a database owner could plant overloaded built-in operators in thepublicschema and alter thesearch_pathso that operator introspection probes, running as the cluster superuser, resolved those overloads beforepg_catalog, aCWE-426privilege-escalation chain (same class asCVE-2018-1058) that could lead to in-pod RCE viaCOPY ... FROM PROGRAM. The operator now pinssearch_path = pg_catalog, public, pg_tempon every pooled connection so it ships in the startup message and takes precedence over tenant-controlled defaults. (#10774,GHSA-x8c2-3p4r-v9r6)CVE-2026-55765/GHSA-w3gf-xc94-wvmj: operator-side SCRAM-SHA-256 password encoding: the operator now SCRAM-SHA-256 encodes cleartext role passwords before issuingCREATE/ALTER ROLE ... PASSWORD, so the literal PostgreSQL parses (and that extensions such aspg_stat_statementsorpgauditmay capture) is the SCRAM verifier rather than the cleartext secret. Pre-hashed (MD5 or SCRAM) values are forwarded unchanged, and the per-Secret annotationcnpg.io/passwordPassthrough: "enabled"opts out. (#10724,GHSA-w3gf-xc94-wvmj)Changes
Added support for Kubernetes 1.36. (#10900)
Updated the default PostgreSQL version to 18.4. (#10719)
Updated the Kubernetes versions used to test the operator on public cloud providers. (#10720, #10563, #11033)
Fixes
Fixed
spec.postgresql.parametersaccepting keys that are not valid PostgreSQL parameter names, which could inject arbitrary directives intopostgresql.conf; key names are now validated by the webhook. (#11029)Fixed declarative
Database,Publication, andSubscriptionobjects reporting a stale primary-side status forever after their cluster was demoted to a replica; the controller now re-checks the replica condition and watches theClusterso a demotion is detected promptly. (#10871)Fixed non-sequential pod names (for example
-1,-3) caused by the instance serial counter being advanced before the correspondingJoband PVCs were created; the bump is now persisted only after those resources exist. (#10491)Fixed a switchover deadlock when a WAL-archiver plugin was enabled on an existing cluster: with
primaryUpdateMethod: switchoverthe primary could not be rolled out because a clean demotion needs the archiver sidecar that is still missing. The operator now recreates the primary Pod in place so the sidecar is injected and archiving resumes. The check also covers plugins that inject the archiver as a native sidecar (an init container withrestartPolicy: Always), such as the Barman Cloud plugin. (#11032, #11059)Fixed a cluster staying in
Setting up primaryindefinitely when the instance-creation Job exhausted its backoff limit; the operator now detects the terminal Job failure and marks the cluster unrecoverable, naming the failed Job and pointing to its logs. (#11035)Fixed deletion of a
Database,Publication, orSubscriptiongetting stuck inTerminatingon a replica cluster, where the replica gate ran before the finalizer reconciler and the finalizer was never released. On a replica the PostgreSQL object is left to the primary cluster. (#10853)Fixed a conflicting duplicate
DatabaseorSubscriptionwith a `deleConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.