chore(deps): update dependency external-secrets to v0.20.4

[bde-dev]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
external-secrets	minor	v0.18.2 → v0.20.4
external-secrets	minor	0.18.2 → 0.20.4

---

Release Notes

external-secrets/external-secrets (external-secrets)

v0.20.4

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v0.20.4
Image: ghcr.io/external-secrets/external-secrets:v0.20.4-ubi
Image: ghcr.io/external-secrets/external-secrets:v0.20.4-ubi-boringssl

What's Changed

General

• fix: re-enable secretserver e2e tests by @​moolen in #​5442
• chore: update dependencies by @​eso-service-account-app[bot] in #​5462
• chore: release helm chart for v0.20.3 by @​Skarlso in #​5467
• docs: remove jwt token authentication option from STSSessionToken generator by @​liununu in #​5468
• feat: re-implement e2e managed tests by @​moolen in #​5444
• docs: Update Segura DSM Branding by @​chellin-segura in #​5469
• ref: simplify and document transform rewrite method by @​riccardomc in #​5450
• fix: put back the expires into the github generator by @​Skarlso in #​5472
• chore(charts): remove unused values from chart by @​rkferreira in #​5334
• feat(generators): add hex generator by @​unique-jakub in #​5314
• fix: use GetClientCertificate in Vault Auth by @​shaxbee in #​5441
• feat(aws): add defining a resource policy via metadata for secretsmanager by @​Skarlso in #​5399
• fix: Webhook provider PushSecret not working by @​Skarlso in #​5445
• fix: remove the finalizer on namespace deletion by @​Skarlso in #​5473
• chore: update dependencies by @​eso-service-account-app[bot] in #​5487
• fix: missing config-file for github action scanning by @​Skarlso in #​5376
• chore(build): Update ubi Docker builds to UBI9 by @​IdanAdar in #​5465
• fix: typo in GitHub provider documentation by @​gecube in #​5493
• fix(oracle): prevent TCP connections leakage by @​adutchak in #​5491
• docs(controller-options): typo in controller-options by @​aslafy-z in #​5496
• chore(linter): fix linter issue in api and cmd package by @​Lumexralph in #​5413
• fix: remove extra json convert check by @​Skarlso in #​5501

Dependencies

• chore(deps): bump actions/dependency-review-action from 4.8.0 to 4.8.1 by @​dependabot[bot] in #​5454
• chore(deps): bump ubi8/ubi from 534c2c0 to 2f698e1 by @​dependabot[bot] in #​5452
• chore(deps): bump golang from 1.25.1 to 1.25.2 by @​dependabot[bot] in #​5456
• chore(deps): bump alpine from 4bcff63 to 4b7ce07 by @​dependabot[bot] in #​5451
• chore(deps): bump github/codeql-action from 3.30.6 to 4.30.8 by @​dependabot[bot] in #​5455
• chore(deps): bump alpine from 3.22.1 to 3.22.2 in /e2e by @​dependabot[bot] in #​5457
• chore(deps): bump golang from 1.25.1-bookworm to 1.25.2-bookworm in /e2e by @​dependabot[bot] in #​5460
• chore(deps): bump click from 8.1.8 to 8.3.0 in /hack/api-docs by @​dependabot[bot] in #​5458
• chore(deps): bump platformdirs from 4.4.0 to 4.5.0 in /hack/api-docs by @​dependabot[bot] in #​5459
• chore(deps): bump idna from 3.10 to 3.11 in /hack/api-docs by @​dependabot[bot] in #​5461
• chore(deps): bump softprops/action-gh-release from 2.3.4 to 2.4.1 by @​dependabot[bot] in #​5453
• chore(deps): bump github/codeql-action from 4.30.8 to 4.30.9 by @​dependabot[bot] in #​5481
• chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 by @​dependabot[bot] in #​5480
• chore(deps): bump anchore/sbom-action from 0.20.6 to 0.20.8 by @​dependabot[bot] in #​5483
• chore(deps): bump mkdocs-material from 9.6.21 to 9.6.22 in /hack/api-docs by @​dependabot[bot] in #​5485
• chore(deps): bump charset-normalizer from 3.4.3 to 3.4.4 in /hack/api-docs by @​dependabot[bot] in #​5486
• chore(deps): bump apache/skywalking-eyes from 0.7.0 to 0.8.0 by @​dependabot[bot] in #​5484
• chore(deps): bump aws-actions/configure-aws-credentials from 06083b7 to 5dc01db by @​dependabot[bot] in #​5482

New Contributors

• @​liununu made their first contribution in #​5468
• @​chellin-segura made their first contribution in #​5469
• @​unique-jakub made their first contribution in #​5314
• @​adutchak made their first contribution in #​5491

Full Changelog: external-secrets/external-secrets@v0.20.3...v0.20.4

v0.20.3

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v0.20.3
Image: ghcr.io/external-secrets/external-secrets:v0.20.3-ubi
Image: ghcr.io/external-secrets/external-secrets:v0.20.3-ubi-boringssl

What's Changed

General

• chore: release helm chart for v0.20.2 by @​Skarlso in #​5403
• fix(ci): Remove PAUL by @​evrardjp in #​5406
• docs: add note on Vault 1.21 audience requirement for roles by @​AddRain1 in #​5411
• docs: extend bitwarden example and integration to accomodate the ssh key feature by @​luilegeant in #​5414
• chore: update dependencies by @​eso-service-account-app[bot] in #​5427
• docs(getting-started): Change apply to use File (-f) instead of Kustomize (-k) by @​smellems in #​5433
• docs(release): Resolve incorrect references in documentation samples by @​blast-hardcheese in #​5431
• docs: Update scaleway json doc by @​RobinFrcd in #​5429
• chore(previder): Update Previder Provider dependency and fix ReadOnly token by @​gkwmiddelkamp in #​5327
• chore(linter): fix revive linter issues in pkg by @​Lumexralph in #​5412
• chore: move to new GCP account, temporarily disable delinea by @​moolen in #​5438
• chore(actions): always run helm test and update make check-diff by @​Skarlso in #​5440
• fix: make port in the schema file either a string of an integer by @​Skarlso in #​5439
• fix: use maps.Equal instead of bytes.Compare for JSON value by @​Skarlso in #​5448
• chore(docs): update refresh interval format by @​Skarlso in #​5447
• chore(docs): update ADOPTERS.md to include Criteo by @​alikhil in #​5446

Dependencies

• chore(deps): bump softprops/action-gh-release from 2.3.3 to 2.3.4 by @​dependabot[bot] in #​5417
• chore(deps): bump github/codeql-action from 3.30.5 to 3.30.6 by @​dependabot[bot] in #​5420
• chore(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @​dependabot[bot] in #​5418
• chore(deps): bump golang from 6ad9415 to c423747 in /e2e by @​dependabot[bot] in #​5423
• chore(deps): bump mkdocs-material from 9.6.20 to 9.6.21 in /hack/api-docs by @​dependabot[bot] in #​5425
• chore(deps): bump certifi from 2025.8.3 to 2025.10.5 in /hack/api-docs by @​dependabot[bot] in #​5424
• chore(deps): bump docker/login-action from 3.5.0 to 3.6.0 by @​dependabot[bot] in #​5422
• chore(deps): bump actions/stale from 10.0.0 to 10.1.0 by @​dependabot[bot] in #​5416
• chore(deps): bump peter-evans/create-or-update-comment from 4.0.0 to 5.0.0 by @​dependabot[bot] in #​5421
• chore(deps): bump golang from b6ed3fd to b6ed3fd by @​dependabot[bot] in #​5419

New Contributors

• @​AddRain1 made their first contribution in #​5411
• @​luilegeant made their first contribution in #​5414
• @​smellems made their first contribution in #​5433
• @​blast-hardcheese made their first contribution in #​5431
• @​RobinFrcd made their first contribution in #​5429
• @​alikhil made their first contribution in #​5446

Full Changelog: external-secrets/external-secrets@v0.20.2...v0.20.3

v0.20.2

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v0.20.2
Image: ghcr.io/external-secrets/external-secrets:v0.20.2-ubi
Image: ghcr.io/external-secrets/external-secrets:v0.20.2-ubi-boringssl

What's Changed

General

• fix(typo): Google misspelled by @​evrardjp in #​5348
• chore: update helm charts v0.20.1 by @​Skarlso in #​5352
• chore(docs): update stability and support table for 0.20.x by @​jakobmoellerdev in #​5354
• chore: update dependencies by @​eso-service-account-app[bot] in #​5349
• chore(docs): update the release flow by @​Skarlso in #​5358
• feat: add support for decryption scheme from properties in senhasegura Devops Secrets Management (DSM) provider by @​felipeosantos in #​3895
• feat(ci): use separate github app for lgtm workflow. by @​webstradev in #​5365
• fix(ci): listing required roles should NOT mention/tag the roles, just name them. by @​webstradev in #​5363
• fix(ci): run lgtm label remover in pull_request_target context instead by @​webstradev in #​5366
• chore: update codeql action to also run for actions by @​Skarlso in #​5360
• feat(oracle): switch provider to maintained status by @​anders-swanson in #​5367
• fix: liveness probe would include invalid value enable by @​Skarlso in #​5369
• feat: introduce priorityPolicy in merge rewrite by @​riccardomc in #​5329
• docs: update community meeting section by @​webstradev in #​5364
• docs: issue-5350: Updates CRD and docs with write-only limitation for github provider by @​bharath-b-rh in #​5361
• fix: IBM Cloud Secrets Manager Imported Cert does not always require intermediate cert by @​varksvader in #​5370
• feat(gcp): get latest enabled secret by @​itaispiegel in #​5131
• feat(ci): zizmor github actions vuln scanner by @​arielrahamim in #​5368
• chore(docs): update pull request approval process by @​Skarlso in #​5374
• fix(release): Validate GCP GetSecret json format by @​Gabrielmadrid73 in #​5336
• fix(charts): exclude 'address' key from livenessProbe definition by @​baprx in #​5377
• feat: add ngrok provider by @​jonstacks in #​5160
• chore: update dependencies by @​eso-service-account-app[bot] in #​5386
• docs(release): CyberArk Conjur name change updates by @​akosasi in #​5359
• chore: bump go, e2e: flux/argo & restructure e2e-bin build by @​moolen in #​5333
• fix: remove unused secret by @​moolen in #​5391
• feat(charts): add startupProbe to cert controller by @​KyriosGN0 in #​5297
• fix: issue-5388: Fixes GCP Workload Identity Federation auth issue by @​bharath-b-rh in #​5392
• chore(lint): fix revive lint errors (pkg/providers) by @​Lumexralph in #​5362
• feat: make cert auth mount path configurable by @​shaxbee in #​5400

Dependencies

• chore(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 by @​dependabot[bot] in #​5379
• chore(deps): bump pyyaml from 6.0.2 to 6.0.3 in /hack/api-docs by @​dependabot[bot] in #​5380
• chore(deps): bump actions/dependency-review-action from 4.7.3 to 4.8.0 by @​dependabot[bot] in #​5381
• chore(deps): bump github/codeql-action from 3.30.3 to 3.30.5 by @​dependabot[bot] in #​5384
• chore(deps): bump markupsafe from 3.0.2 to 3.0.3 in /hack/api-docs by @​dependabot[bot] in #​5383
• chore(deps): bump mkdocs-macros-plugin from 1.3.9 to 1.4.0 in /hack/api-docs by @​dependabot[bot] in #​5385
• chore(deps): bump actions/cache from 4.2.4 to 4.3.0 by @​dependabot[bot] in #​5382

New Contributors

• @​evrardjp made their first contribution in #​5348
• @​felipeosantos made their first contribution in #​3895
• @​varksvader made their first contribution in #​5370
• @​itaispiegel made their first contribution in #​5131
• @​arielrahamim made their first contribution in #​5368
• @​Gabrielmadrid73 made their first contribution in #​5336
• @​baprx made their first contribution in #​5377
• @​akosasi made their first contribution in #​5359
• @​Lumexralph made their first contribution in #​5362
• @​shaxbee made their first contribution in #​5400

Full Changelog: external-secrets/external-secrets@v0.20.0...v0.20.2

v0.20.1

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v0.20.1
Image: ghcr.io/external-secrets/external-secrets:v0.20.1-ubi
Image: ghcr.io/external-secrets/external-secrets:v0.20.1-ubi-boringssl

What's Changed

General

• chore: release 0.19.2 by @​moolen in #​5136
• chore: update readme by @​gusfcarvalho in #​5137
• fix(kubernetes): make auth field optional by @​mhrabovcin in #​5064
• chore: Fix Markdown spelling issues found by codespell by @​mjtrangoni in #​5139
• Fix yaml codeblock for oracle-vault provider docs by @​muckelba in #​5146
• feat: add liveness probe to eso controller by @​Skarlso in #​4930
• fix(helm): add boolean for processClusterGenerator by @​DrummyFloyd in #​5144
• chore: add Cisco to ADOPTERS.md by @​sriaradhyula in #​5159
• docs: Fix provider stability and support table by @​jonstacks in #​5161
• feat(helm): Add control of response to missing prometheus CRDs by @​jcpunk in #​5087
• chore: Added release notes configuration by @​bonddim in #​5148
• chore: bump bitwarden helm chart version by @​Skarlso in #​5044
• chore(docs): update ADOPTERS.md to include SAP by @​jakobmoellerdev in #​5165
• feat: add externalsecret namespace for webhook provider by @​matheusmazzoni in #​5155
• fix: add unknown status for secret store by @​alvin-rw in #​5070
• Fix pushing to an AWS Secrets Manager Secret when there are no secret values by @​nirajsapkota in #​4878
• add extralabels for dashboard to be scraped by multiple grafana instances by @​L1ghtman2k in #​5138
• fix: the api docs are not referencing sshkey generator by @​Skarlso in #​5170
• Update github.md by @​gecube in #​5171
• Update anchore-engine-credentials.md by @​gecube in #​5172
• docs: update infisical docs to clarify missing system:auth-delegator need by @​Skarlso in #​5174
• Adding support different type auth sources by @​preved911 in #​4877
• fix: stability update document did not update the stability table correctly by @​Skarlso in #​5176
• Add esv1.AnnotationForceSync for CES and ES by @​ntnn in #​5156
• fix: helm build failing by @​Skarlso in #​5178
• fix: remove release- branch automation by @​moolen in #​5182
• chore: update dependencies by @​eso-service-account-app[bot] in #​5181
• docs: update bitwarden documentation for dataFrom field usage by @​Skarlso in #​5196
• feat: add contributor ladder by @​gusfcarvalho in #​5150
• feat: support vault provider check and set for push secrets by @​webstradev in #​5197
• chore(docs): update helm charts by @​gusfcarvalho in #​5203
• chore(ci): fix sonarqube security warnings in helm.yml by @​webstradev in #​5202
• chore: add pull request maintenance auto labelling and sizes by @​Skarlso in #​5200
• fix: update the label verification step by @​Skarlso in #​5209
• feat: add infisical k8s auth with Client JWT as Reviewer JWT Token support by @​tuxtof in #​5168
• feat: improve error message for json marshalling/unmarshalling by @​webstradev in #​5211
• chore: enhance helm-values-schema-json schema plugin management logic by @​jakobmoellerdev in #​5212
• fix(aws): stop incrementing the UUID for versions by @​Skarlso in #​5175
• feat: enable secure serving for metrics [issue 4614] by @​rkferreira in #​5169
• fix(infisical): fix TokenAuth auth method by escaping the token revocation by @​arthlr in #​5217
• fix: tilt build was failing to rebuild by @​Skarlso in #​5225
• feat: add selectable fields to the CRDs by @​Skarlso in #​5226
• ref: removing Yandex Cloud specific common types declaration duplication by @​preved911 in #​4905
• fix: missing codeowners file from .github folder by @​Skarlso in #​5228
• feat: add setting remote namespace to metadata for kubernetes provider by @​Skarlso in #​5224
• feat: add support for certs only in pkcs12 by @​devnopt in #​4875
• docs: document redundant clusterName/clusterLocation parameters in GCP Secret Manager docs by @​ionicsolutions in #​5208
• feat: Allow adding finalizers from template by @​malovme in #​5140
• fix: controller-runtime update by @​gusfcarvalho in #​5239
• chore: update dependencies by @​eso-service-account-app[bot] in #​5229
• fix: Prevent secretstore reconcile loop when provider error response is dynamic by @​dakotaharden in #​5247
• feat: add finalizers to SecretStores when referenced by PushSecrets with DeletionPolicy=Delete by @​matheusmazzoni in #​5163
• fix: keepersecurity support for shortcuts by @​pepordev in #​5245
• feat: add support for GCP Workload Identity Federation by @​bharath-b-rh in #​4654
• feat: support fetching secrets and certificates by name in Yandex Lockbox & Certificate Manager by @​alliseeisgold in #​5022
• chore(charts): Adds new make target for installing unittest plugin by @​bharath-b-rh in #​5250
• docs(templating): added clarifying comments to Github generator example by @​nielstenboom in #​5248
• feat(release): add new workflow to label first time contributor issues by @​mouhsen-ibrahim in #​5243
• feat(security): Adds an option to make HTTP2 configurable by @​siddhibhor-56 in #​5231
• feat: add retry for onepassword on authorization error by @​Skarlso in #​5253
• fix: handle namespace deletion race conditions with finalizers by @​framsouza in #​5154
• docs: update stability and support by @​anders-swanson in #​5257
• fix(akeyless): Upgrade Akeyless Provider Go SDK to v4 by @​kgal-akl in #​5263
• feat: support Pod Identity authentication for Vault Provider by @​webstradev in #​5201
• feat: add domain field to secretserver provider by @​rkferreira in #​5258
• chore(release): Migrate to actions/create-github-app-token action by @​mouhsen-ibrahim in #​5264
• chore: just updating the crd conformance tests by @​Skarlso in #​5265
• chore(revert): "chore(release): Migrate to actions/create-github-app-token action" by @​Skarlso in #​5269
• chore: azure sdk update by @​hauswio in #​5162
• feat: add support for fetching Secret by Path on Delinea Secret Server provider by @​DelineaSahilWankhede in #​5270
• feat: migrate from tibdex to actions/create-github-app-token by @​rkferreira in #​5286
• fix: license headers across all Go files - standardize format, add missing copyright, fix typos by @​Copilot in #​5288
• fix: the boilerplate was missing the right license format by @​Skarlso in #​5289
• chore(license): add automated license header checking using Apache SkyWalking Eyes GitHub Action by @​Copilot in #​5290
• chore(docs): remove GitHub Discussions references and update support channels by @​jakobmoellerdev in #​5292
• docs: updated the ladder with two new tracks: documentation and community by @​Skarlso in #​5298
• docs(release): create upgrading section by @​rkferreira in #​5310
• docs: readme update for health of the project by @​Skarlso in #​5309
• fix: validate namespace in secretRef by @​moolen in #​5311
• docs: add burnout prevention strategies and mitigation policy document by @​Skarlso in #​5307
• feat: add missing go sbom by @​moolen in #​5313
• feat: make vault e2e tests run locally by @​moolen in #​5246
• chore: update dependencies by @​eso-service-account-app[bot] in #​5324
• feat: add Cloudsmith generator for container registry authentication by @​cloudsmith-iduffy in #​5267
• feat: Add lgtm review automation step to ci workflows. by @​webstradev in #​5251
• feat(provider): add Volcengine provider support by @​kevinyancn in #​5306
• test: add more information to potentially flaky test by @​Skarlso in #​5330
• fix(docs): Fix typo in controller options doc by @​tspearconquest in #​5299
• chore(testing): Add licence.check make target by @​jonstacks in #​5335
• docs(gitlab-variables): document environment scope fallback by @​s1nyx in #​5300

Dependencies

• chore(deps): bump mkdocs-macros-plugin from 1.3.7 to 1.3.9 in /hack/api-docs by @​dependabot[bot] in #​5190
• chore(deps): bump requests from 2.32.4 to 2.32.5 in /hack/api-docs by @​dependabot[bot] in #​5191
• chore(deps): bump golang from 1.24.6-bookworm to 1.25.0-bookworm in /e2e by @​dependabot[bot] in #​5189
• chore(deps): bump goreleaser/goreleaser-action from 6.3.0 to 6.4.0 by @​dependabot[bot] in #​5188
• chore(deps): bump actions/create-github-app-token from 2.1.0 to 2.1.1 by @​dependabot[bot] in #​5187
• chore(deps): bump anchore/sbom-action from 0.20.4 to 0.20.5 by @​dependabot[bot] in #​5186
• chore(deps): bump codecov/codecov-action from 5.4.3 to 5.5.0 by @​dependabot[bot] in #​5184
• chore(deps): bump golang from 1.24.6 to 1.25.0 by @​dependabot[bot] in #​5194
• chore(deps): bump github/codeql-action from 3.29.8 to 3.29.11 by @​dependabot[bot] in #​5195
• chore(deps): bump ubi8/ubi from 4f0a4e4 to 7010e70 by @​dependabot[bot] in #​5193
• chore(deps): bump mkdocs-material from 9.6.16 to 9.6.18 in /hack/api-docs by @​dependabot[bot] in #​5192
• chore(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @​dependabot[bot] in #​5198
• chore(deps): bump actions/dependency-review-action from 4.7.1 to 4.7.2 by @​dependabot[bot] in #​5199
• chore(deps): bump aquasecurity/trivy-action from 0.32.0 to 0.33.0 by @​dependabot[bot] in #​5234
• chore(deps): bump actions/dependency-review-action from 4.7.2 to 4.7.3 by @​dependabot[bot] in #​5236
• chore(deps): bump ubi8/ubi from 7010e70 to 534c2c0 by @​dependabot[bot] in #​5237
• chore(deps): bump actions/attest-build-provenance from 2.4.0 to 3.0.0 by @​dependabot[bot] in #​5238
• chore(deps): bump regex from 2025.7.34 to 2025.8.29 in /hack/api-docs by @​dependabot[bot] in #​5242
• chore(deps): bump platformdirs from 4.3.8 to 4.4.0 in /hack/api-docs by @​dependabot[bot] in #​5241
• chore(deps): bump distroless/static from 2e114d2 to f2ff10a by @​dependabot[bot] in #​5240
• chore(deps): bump golang from 1.25.0 to 1.25.1 by @​dependabot[bot] in #​5275
• chore(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @​dependabot[bot] in #​5274
• chore(deps): bump actions/stale from 9.1.0 to 10.0.0 by @​dependabot[bot] in #​5273
• chore(deps): bump actions/setup-go from 5.5.0 to 6.0.0 by @​dependabot[bot] in #​5276
• chore(deps): bump mkdocs-material from 9.6.18 to 9.6.19 in /hack/api-docs by @​dependabot[bot] in #​5279
• chore(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 by @​dependabot[bot] in #​5278
• chore(deps): bump github/codeql-action from 3.29.11 to 3.30.1 by @​dependabot[bot] in #​5277
• chore(deps): bump markdown from 3.8.2 to 3.9 in /hack/api-docs by @​dependabot[bot] in #​5281
• chore(deps): bump golang from 1.25.0-bookworm to 1.25.1-bookworm in /e2e by @​dependabot[bot] in #​5280
• chore(deps): bump regex from 2025.8.29 to 2025.9.1 in /hack/api-docs by @​dependabot[bot] in #​5282
• chore(deps): bump golang from b6ed3fd to b6ed3fd by @​dependabot[bot] in #​5318
• chore(deps): bump actions/setup-python from 5.6.0 to 6.0.0 by @​dependabot[bot] in #​5317
• chore(deps): bump github/codeql-action from 3.30.1 to 3.30.3 by @​dependabot[bot] in #​5319
• chore(deps): bump distroless/static from f2ff10a to 87bce11 by @​dependabot[bot] in #​5320
• chore(deps): bump actions/labeler from 5.0.0 to 6.0.1 by @​dependabot[bot] in #​5323
• chore(deps): bump softprops/action-gh-release from 2.3.2 to 2.3.3 by @​dependabot[bot] in #​5321
• chore(deps): bump actions/create-github-app-token from 2.1.1 to 2.1.4 by @​dependabot[bot] in #​5322
• chore(deps): bump actions/create-github-app-token from 2.1.1 to 2.1.4 by @​dependabot[bot] in #​5339
• chore(deps): bump aquasecurity/trivy-action from 0.33.0 to 0.33.1 by @​dependabot[bot] in #​5344
• chore(deps): bump mkdocs-material from 9.6.19 to 9.6.20 in /hack/api-docs by @​dependabot[bot] in #​5345
• chore(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 by [@​dependa

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[bde-dev]

AI Assessment

Field	Value
Decision	NEEDS_REVIEW
Risk Level	MEDIUM
Update Type	MINOR
Component	external-secrets
Version	v0.18.2 -> v0.20.4
Breaking Changes	false

Analysis

This is a MINOR version update spanning 2 minor versions (0.18→0.20) with multiple patch levels. While no breaking changes are documented and the changelog shows primarily bug fixes and new features, external-secrets is a core infrastructure component in Kubernetes environments. The significant version jump (skipping v0.19.x) warrants manual validation to ensure compatibility with existing SecretStore and ExternalSecret configurations in the homelab environment.

Recommendation

Perform manual review and testing. Verify that: 1) Existing SecretStore and ExternalSecret resources continue to function correctly; 2) No CRD schema changes break existing manifests; 3) Test the update in a staging environment first before applying to production. If comfortable with testing, merge after validation. Otherwise, consider a more incremental approach (0.18.2 → 0.19.x first).

---

Analyzed by n8n AI Agent using Claude