enix/x509-certificate-exporter v4.2.3

on GitHub

Upgrade notes

• Chart, rbacProxy.enabled: the exporter's plain-HTTP listener now binds 127.0.0.1:<rbacProxy.upstreamListenPort> instead of every interface. Anything scraping that port directly stops working; scrape through kube-rbac-proxy (the metrics port), as the chart's ServiceMonitor and PodMonitor do.
• JKS/JCEKS: allocations are now bounded by the input size. On unusual stores: JKS entries with mixed-case aliases are now reported (they were silently skipped); a truncated or corrupted JCEKS reports bad_jks instead of bad_passphrase; bytes after the JCEKS digest are ignored.

Changelog

Security Updates

• b835c07: security(jks): bound JKS parsing allocations to the input size (audit B01) (@npdgm)
• 0fae747: security(chart): bind the exporter to loopback behind kube-rbac-proxy (@npdgm)

Bug Fixes

• 87d327b: fix: update module github.com/kimmachinegun/automemlimit to v1.0.1 (@enix-renovate[bot])

Dependencies

• 901f966: deps: refresh indirect Go module dependencies (@npdgm)
• a8ff748: deps: lock file maintenance (@enix-renovate[bot])

Documentation

• d5084dc: docs(audit): add the 2026-10-23 project audit (@npdgm)