cert-manager/cert-manager v1.12.13

on GitHub

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

📖 Read the release documentation to learn more more about the features introduced in 1.12.

📜 Changes since v1.12.12

This patch release fixes the following vulnerabilities: CVE-2024-6104, CVE-2024-24791, CVE-2024-25620, CVE-2024-26147, and CVE-2024-41110.

ℹ️ This version contains an unusually large number of Go dependency changes for
a patch release. The cert-manager maintainers are confident that it is stable
because it has passed the same extensive suite of tests as previous 1.12
releases. But if you are importing cert-manager 1.12 as a Go module you will
notice that the minimum Go version is 1.21, and the k8s.io modules are now
updated to 0.29.

This reason for the large number of Go dependency changes is that the Helm SDK
has been updated to fix security vulnerabilities in cmctl. This required the
k8s.io modules to be updated from 0.27 to 0.29 in all components. Those
newer minor versions of the Kubernetes modules pulled in new transitive
dependencies, and incremented the minimum Go version from 1.20 to 1.21.

Bugfixes

• Bump the go-retryablehttp dependency to fix CVE-2024-6104 (#7128, @SgtCoDFish)
• Updated Helm dependency to resolve CVE-2024-25620 and CVE-2024-26147 and Docker dependency to resolve CVE-2024-41110 (#7214, @ThatsMrTalbot)
• Updates Go to 1.21.13 to resolve CVE-2024-24791 (#7216, @ThatsMrTalbot)

Dependencies

Added

• github.com/antlr/antlr4/runtime/Go/antlr/v4: 8188dc5
• github.com/google/gnostic-models: v0.6.8
• github.com/xhit/go-str2duration/v2: v2.1.0

Changed

• github.com/BurntSushi/toml: v1.2.1 → v0.3.1
• github.com/alecthomas/kingpin/v2: v2.3.1 → v2.3.2
• github.com/asaskevich/govalidator: f61b66f → 21a406d
• github.com/coreos/go-oidc: v2.1.0+incompatible → v2.2.1+incompatible
• github.com/coreos/go-semver: v0.3.0 → v0.3.1
• github.com/coreos/go-systemd/v22: v22.4.0 → v22.5.0
• github.com/cpuguy83/go-md2man/v2: v2.0.2 → v2.0.3
• github.com/davecgh/go-spew: v1.1.1 → d8f796a
• github.com/dustin/go-humanize: v1.0.0 → v1.0.1
• github.com/emicklei/go-restful/v3: v3.9.0 → v3.11.0
• github.com/evanphx/json-patch: v5.6.0+incompatible → v5.7.0+incompatible
• github.com/fatih/color: v1.15.0 → v1.16.0
• github.com/frankban/quicktest: v1.10.0 → v1.14.3
• github.com/fsnotify/fsnotify: v1.6.0 → v1.7.0
• github.com/go-openapi/jsonreference: v0.20.1 → v0.20.2
• github.com/golang-jwt/jwt/v4: v4.4.2 → v4.5.0
• github.com/golang/protobuf: v1.5.3 → v1.5.4
• github.com/google/cel-go: v0.12.6 → v0.17.7
• github.com/google/gnostic: v0.6.9 → v0.5.7-v3refs
• github.com/gorilla/websocket: v1.4.2 → v1.5.0
• github.com/hashicorp/go-hclog: v1.2.0 → v1.6.3
• github.com/hashicorp/go-retryablehttp: v0.7.2 → v0.7.7
• github.com/imdario/mergo: v0.3.12 → v0.3.13
• github.com/mattn/go-isatty: v0.0.17 → v0.0.20
• github.com/onsi/ginkgo/v2: v2.9.5 → v2.13.0
• github.com/onsi/gomega: v1.27.7 → v1.29.0
• github.com/prometheus/client_golang: v1.15.1 → v1.16.0
• github.com/prometheus/common: v0.42.0 → v0.44.0
• github.com/prometheus/procfs: v0.9.0 → v0.10.1
• github.com/sirupsen/logrus: v1.9.0 → v1.9.3
• github.com/spf13/cobra: v1.7.0 → v1.8.0
• go.etcd.io/bbolt: v1.3.6 → v1.3.8
• go.etcd.io/etcd/api/v3: v3.5.7 → v3.5.10
• go.etcd.io/etcd/client/pkg/v3: v3.5.7 → v3.5.10
• go.etcd.io/etcd/client/v2: v2.305.7 → v2.305.10
• go.etcd.io/etcd/client/v3: v3.5.7 → v3.5.10
• go.etcd.io/etcd/pkg/v3: v3.5.7 → v3.5.10
• go.etcd.io/etcd/raft/v3: v3.5.7 → v3.5.10
• go.etcd.io/etcd/server/v3: v3.5.7 → v3.5.10
• go.uber.org/atomic: v1.9.0 → v1.10.0
• go.uber.org/multierr: v1.6.0 → v1.11.0
• golang.org/x/exp: a1ab85d → a9213ee
• gopkg.in/natefinch/lumberjack.v2: v2.0.0 → v2.2.1
• k8s.io/api: v0.27.2 → v0.29.7
• k8s.io/apiextensions-apiserver: v0.27.2 → v0.29.7
• k8s.io/apimachinery: v0.27.2 → v0.29.7
• k8s.io/apiserver: v0.27.2 → v0.29.7
• k8s.io/client-go: v0.27.2 → v0.29.7
• k8s.io/code-generator: v0.27.2 → v0.29.7
• k8s.io/component-base: v0.27.2 → v0.29.7
• k8s.io/gengo: c0856e2 → 9cce18d
• k8s.io/klog/v2: v2.100.1 → v2.110.1
• k8s.io/kms: v0.27.2 → v0.29.7
• k8s.io/kube-aggregator: v0.27.2 → v0.29.7
• k8s.io/kube-openapi: 54b630e → 2dd684a
• k8s.io/utils: 9f67429 → 3b25d92
• sigs.k8s.io/apiserver-network-proxy/konnectivity-client: v0.1.2 → v0.28.0
• sigs.k8s.io/structured-merge-diff/v4: v4.2.3 → v4.4.1

Removed

• github.com/antlr/antlr4/runtime/Go/antlr: v1.4.10
• github.com/buger/jsonparser: v1.1.1
• github.com/docopt/docopt-go: ee0de3b
• github.com/flowstack/go-jsonschema: v0.1.1
• github.com/xhit/go-str2duration: v1.2.0
• go.opentelemetry.io/otel/exporters/otlp/internal/retry: v1.10.0