Skip to content

chore(deps): update dependency cert-manager/cmctl to v2.6.1 - #2829

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/cert-manager-cmctl-2.x
Open

chore(deps): update dependency cert-manager/cmctl to v2.6.1#2829
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/cert-manager-cmctl-2.x

Conversation

@renovate

@renovate renovate Bot commented Sep 19, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
cert-manager/cmctl minor v2.5.0 → v2.6.1

Release Notes

cert-manager/cmctl (cert-manager/cmctl)

v2.6.1

Compare Source

cmctl is the command line tool for interacting with cert-manager.

The one user-facing change in this release hardens cmctl inspect secret. To report revocation status, that command fetches the OCSP and CRL URLs written inside the certificate you are inspecting. It previously trusted those URLs. A certificate from an untrusted source could therefore make cmctl contact any address, including one on your internal network, and could hang it indefinitely. Requests now time out after 10 seconds, do not follow redirects, stop reading after 1 MiB, and accept only http and https for OCSP. Certificates from a trusted source behave as before. Thanks to @​FelixPhipps, who reported and fixed this.

Everything else is routine maintenance. This release moves from cert-manager v1.20.2 to v1.21.2 and takes 120 dependency and CI updates.

Why there is no v2.6.0 release

We tagged v2.6.0 first, but the release build never ran. The CI runner it used had been removed, so the tag produced no binaries and no container image.

By the time we found out, v2.6.0 was already recorded in the Go checksum database. Moving a tag that the checksum database has already seen breaks go install for anyone who fetches direct from GitHub, so we left it alone and released v2.6.1 instead.

The v2.6.0 tag still exists and the code at that tag is fine. It is a usable Go module version, but there is nothing to download and no image to pull. Please use v2.6.1.

What's Changed
New Contributors

Full Changelog: cert-manager/cmctl@v2.5.0...v2.6.1

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants