cmctl is the command line tool for interacting with cert-manager.
The one user-facing change in this release hardens cmctl inspect secret. To report revocation status, that command fetches the OCSP and CRL URLs written inside the certificate you are inspecting. It previously trusted those URLs. A certificate from an untrusted source could therefore make cmctl contact any address, including one on your internal network, and could hang it indefinitely. Requests now time out after 10 seconds, do not follow redirects, stop reading after 1 MiB, and accept only http and https for OCSP. Certificates from a trusted source behave as before. Thanks to @FelixPhipps, who reported and fixed this.
Everything else is routine maintenance. This release moves from cert-manager v1.20.2 to v1.21.2 and takes 120 dependency and CI updates.
Why there is no v2.6.0 release
We tagged v2.6.0 first, but the release build never ran. The CI runner it used had been removed, so the tag produced no binaries and no container image.
By the time we found out, v2.6.0 was already recorded in the Go checksum database. Moving a tag that the checksum database has already seen breaks go install for anyone who fetches direct from GitHub, so we left it alone and released v2.6.1 instead.
The v2.6.0 tag still exists and the code at that tag is fine. It is a usable Go module version, but there is nothing to download and no image to pull. Please use v2.6.1.
What's Changed
- [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #469
- [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #470
- [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #471
- [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #472
- fix(deps): update module golang.org/x/mod to v0.36.0 by @renovate[bot] in #473
- fix(deps): update module golang.org/x/crypto to v0.51.0 by @renovate[bot] in #474
- [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #475
- fix(deps): update module sigs.k8s.io/controller-runtime to v0.24.1 by @renovate[bot] in #477
- [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #476
- fix(deps): update kubernetes go patches to v0.36.1 by @renovate[bot] in #478
- fix(deps): update module helm.sh/helm/v4 to v4.2.0 by @renovate[bot] in #479
- [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #480
- [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #481
- [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #482
- fix(deps): update module golang.org/x/crypto to v0.52.0 by @renovate[bot] in #484
- chore(deps): update module golang.org/x/net to v0.55.0 [security] by @renovate[bot] in #486
- [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #483
- [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #487
- [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #488
- chore(deps): update docker/login-action action to v4.2.0 by @renovate[bot] in #485
- fix(deps): update k8s.io/utils digest to ff6756f by @renovate[bot] in #489
- [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #490
- [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #491
- [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #492
- [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #493
- [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #494
- [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #495
- [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #496
- fix(deps): update golang.org/x deps by @renovate[bot] in #497
- fix(deps): update misc go deps to v4.2.1 by @renovate[bot] in #498
- fix(deps): update kubernetes go patches to v0.36.2 by @renovate[bot] in #499
- [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #500
- [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #502
- chore(deps): update makefile modules to 7835ffe by @renovate[bot] in #503
- chore(deps): update makefile modules to 92aeb18 by @renovate[bot] in #505
- chore(deps): update makefile modules to 5d90d75 by @renovate[bot] in #506
- fix(deps): update misc go deps to v4.2.2 by @renovate[bot] in #504
- chore(deps): update misc github actions to v7 by @renovate[bot] in #507
- chore(deps): update makefile modules to 3968a05 by @renovate[bot] in #508
- chore(deps): update makefile modules to e249911 by @renovate[bot] in #509
- chore(deps): update makefile modules to 2439727 by @renovate[bot] in #510
- chore(deps): update makefile modules to 5a6dfa5 by @renovate[bot] in #511
- fix(deps): update module github.com/cert-manager/cert-manager to v1.20.3 by @renovate[bot] in #512
- chore(deps): update makefile modules to 3475385 by @renovate[bot] in #513
- chore(deps): update makefile modules to fb0281c by @renovate[bot] in #514
- chore(deps): update makefile modules to 72b0d34 by @renovate[bot] in #515
- chore(deps): update makefile modules to c9f456a by @renovate[bot] in #516
- fix(deps): update module sigs.k8s.io/gateway-api to v1.6.0 by @renovate[bot] in #518
- chore(deps): update makefile modules to 6ec965f by @renovate[bot] in #519
- chore(deps): update makefile modules to 1a9e320 by @renovate[bot] in #520
- chore(deps): update makefile modules to e18d942 by @renovate[bot] in #521
- fix: harden OCSP/CRL revocation checks against SSRF and DoS by @FelixPhipps in #517
- chore(deps): update makefile modules to 80a790b by @renovate[bot] in #522
- fix(deps): update module golang.org/x/sync to v0.22.0 by @renovate[bot] in #523
- chore(deps): update makefile modules to 2f12511 by @renovate[bot] in #526
- fix(deps): update module golang.org/x/mod to v0.38.0 by @renovate[bot] in #527
- chore(deps): update makefile modules to b7c9d73 by @renovate[bot] in #530
- chore(deps): update makefile modules to 703bbcc by @renovate[bot] in #531
- fix(deps): update module sigs.k8s.io/gateway-api to v1.6.1 by @renovate[bot] in #533
- chore(deps): update module golang.org/x/text to v0.39.0 [security] by @renovate[bot] in #535
- chore(deps): update module golang.org/x/net to v0.56.0 [security] by @renovate[bot] in #534
- fix(deps): update module golang.org/x/crypto to v0.54.0 by @renovate[bot] in #528
- fix(deps): update kubernetes go patches to v0.36.3 by @renovate[bot] in #539
- fix(deps): update module k8s.io/kubectl to v0.36.3 by @renovate[bot] in #540
- chore(deps): update makefile modules to 57b5681 by @renovate[bot] in #541
- chore(deps): update makefile modules to e0878ff by @renovate[bot] in #542
- chore(deps): update makefile modules to 556e163 by @renovate[bot] in #543
- fix(deps): update misc go deps by @renovate[bot] in #529
- chore(deps): update actions/setup-go action to v7 by @renovate[bot] in #532
- chore(deps): update makefile modules to b41c15b by @renovate[bot] in #548
- Update module github.com/cert-manager/cert-manager to v1.21.1 by @erikgb in #550
- chore(deps): update makefile modules to 7443000 by @renovate[bot] in #551
- chore(deps): update module oras.land/oras-go/v2 to v2.6.2 [security] by @renovate[bot] in #544
- fix(deps): update k8s.io/utils digest to cf1189d by @renovate[bot] in #549
- chore(deps): update makefile modules to a09232d by @renovate[bot] in #552
- chore(deps): update makefile modules to 2c4a3b8 by @renovate[bot] in #553
- chore(deps): update misc github actions by @renovate[bot] in #554
- fix(deps): update module golang.org/x/mod to v0.39.0 by @renovate[bot] in #555
- fix(deps): update module golang.org/x/mod to v0.40.0 [security] by @renovate[bot] in #556
- chore(deps): update makefile modules to b514cb5 by @renovate[bot] in #557
- fix(deps): update module golang.org/x/crypto to v0.55.0 by @renovate[bot] in #558
- fix(deps): update misc go deps by @renovate[bot] in #559
- chore(deps): update makefile modules to 24aa843 by @renovate[bot] in #560
- chore(deps): update module go.etcd.io/etcd/client/pkg/v3 to v3.6.14 [security] by @renovate[bot] in #561
- chore(deps): update makefile modules to ca8dd5c by @renovate[bot] in #563
- chore(deps): update module github.com/google/cel-go to v0.30.0 [security] by @renovate[bot] in #562
- chore(deps): update makefile modules to 4dc1d67 by @renovate[bot] in #564
- chore(deps): update makefile modules to b903033 by @renovate[bot] in #565
- chore(deps): update makefile modules to 62d18d0 by @renovate[bot] in #567
- fix(deps): update kubernetes go patches to v0.36.4 by @renovate[bot] in #568
- chore(deps): update makefile modules to 4c69ed4 by @renovate[bot] in #569
- chore(deps): update makefile modules to 555e973 by @renovate[bot] in #570
- chore(deps): update makefile modules to c236200 by @renovate[bot] in #571
- fix(deps): update module github.com/stretchr/testify to v1.12.1 by @renovate[bot] in #566
- fix(deps): update kubernetes go deps to v0.37.0 by @renovate[bot] in #572
- chore(deps): update module go.etcd.io/etcd/client/pkg/v3 to v3.7.1 [security] by @renovate[bot] in #573
- chore(deps): update makefile modules to 1745d14 by @renovate[bot] in #574
- chore(deps): update module google.golang.org/grpc to v1.83.1 [security] by @renovate[bot] in #575
- chore(deps): update makefile modules to 44a7b02 by @renovate[bot] in #576
- fix(deps): update module golang.org/x/crypto to v0.56.0 [security] by @renovate[bot] in #577
- chore(deps): update makefile modules to 8817d0f by @renovate[bot] in #578
- chore(deps): update makefile modules to 7b9a8ef by @renovate[bot] in #579
- fix(deps): update module sigs.k8s.io/controller-runtime to v0.25.0 by @renovate[bot] in #580
- fix(deps): update module sigs.k8s.io/gateway-api to v1.6.2 by @renovate[bot] in #581
- chore(deps): update makefile modules to a0a1cfe by @renovate[bot] in #582
- chore(deps): update makefile modules to 667adb4 by @renovate[bot] in #583
- chore(deps): update makefile modules to 3db3dfa by @renovate[bot] in #584
- chore(deps): update makefile modules to 3802a00 by @renovate[bot] in #585
- fix(deps): update golang.org/x deps by @renovate[bot] in #586
- chore(deps): update module google.golang.org/grpc to v1.83.2 [security] by @renovate[bot] in #587
- chore(deps): update makefile modules to 11349e7 by @renovate[bot] in #588
- fix(deps): update module github.com/cert-manager/cert-manager to v1.21.2 by @renovate[bot] in #589
- fix(deps): update module golang.org/x/crypto to v0.57.0 by @renovate[bot] in #590
- chore(deps): update makefile modules to 3dee59e by @renovate[bot] in #591
- fix(deps): update module helm.sh/helm/v4 to v4.3.0 by @renovate[bot] in #592
- chore(deps): update makefile modules to 56bbaca by @renovate[bot] in #593
- chore(deps): update makefile modules to d983bab by @renovate[bot] in #594
- chore(deps): update makefile modules to 91ea1cc by @renovate[bot] in #595
- fix(deps): update module sigs.k8s.io/controller-runtime to v0.25.1 by @renovate[bot] in #596
- chore: move release job to a CNCF runner that still exists by @wallrj-cyberark in #597
New Contributors
- @FelixPhipps made their first contribution in #517
- @wallrj-cyberark made their first contribution in #597
Full Changelog: v2.5.0...v2.6.1