chore(deps): update helm release external-secrets to v2.12.0

[renovate]

This PR contains the following updates:

Package	Update	Change
external-secrets	minor	2.11.0 → 2.12.0

---

Release Notes

external-secrets/external-secrets (external-secrets)

v2.12.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.12.0
Image: ghcr.io/external-secrets/external-secrets:v2.12.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.12.0-ubi-boringssl

What's Changed

General

• fix: Revert breaking change to change imageRegistry by @​evrardj-roche in #​6996
• fix: e2e test should not override default vars by @​evrardj-roche in #​6995
• chore: release helm chart for 2.11.0 by @​evrardj-roche in #​6997
• fix: Remove fail from templates by @​evrardj-roche in #​7019
• docs(generators): describe UUID output as lowercase version 4 by @​alekc in #​7027
• fix(akeyless): return esv1.NoSecretErr when a secret does not exist in GetSecret by @​wankhede04 in #​7013
• feat(generators): add prefix and suffix to the Password generator by @​alekc in #​7028
• fix(aws): return esv1.NoSecretErr when a certificate does not exist in Certificate Manager GetSecret by @​wankhede04 in #​7015
• fix: use preinstalled-runtimes to match v2 bump by @​evrardj-roche in #​7031
• chore: update dependencies by @​eso-service-account-app[bot] in #​7047
• fix(pulumi): preserve environment definition on PushSecret by @​KR-Ravindra in #​6933
• docs: set Orphan on ClusterExternalSecret fan-out example by @​guanchzhou in #​6885
• feat(conjur): Cloud Authenticators support by @​hdabrowski in #​6729
• docs: add Vault custom metadata example by @​PCDattt in #​6982
• feat(charts): add rbac.leaderElection.create toggle by @​kriszkern in #​6950
• feat(charts): warn when replicas > 1 without leader election by @​anikievev in #​7036
• fix: Never template strings in errors by @​evrardj-roche in #​7021
• fix: Validate Secret before writing by @​evrardj-roche in #​7065
• chore: Update docs for new release by @​evrardj-roche in #​7085

Dependencies

• chore(deps): bump ubi9/ubi from c5cc9c2 to a4b9ec0 by @​dependabot[bot] in #​7001
• chore(deps): bump docker/setup-buildx-action from 4.3.0 to 4.4.1 by @​dependabot[bot] in #​7006
• chore(deps): bump jlumbroso/free-disk-space from 1.3.1 to 2.0.0 by @​dependabot[bot] in #​7005
• chore(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 by @​dependabot[bot] in #​7004
• chore(deps): bump golang from 648f440 to 69a7b97 in /e2e by @​dependabot[bot] in #​7044
• chore(deps): bump alpine from 3.24.1 to 3.24.2 in /e2e by @​dependabot[bot] in #​7043
• chore(deps): bump alpine from 28bd5fe to 294b683 by @​dependabot[bot] in #​7042
• chore(deps): bump alpine from 28bd5fe to 294b683 in /hack/api-docs by @​dependabot[bot] in #​7045
• chore(deps): bump ubi9/ubi from a4b9ec0 to 7a38d75 by @​dependabot[bot] in #​7041
• chore(deps): bump docker/setup-qemu-action from 4.3.0 to 4.4.0 by @​dependabot[bot] in #​7003
• chore(deps): bump aws-actions/configure-aws-credentials from 6.2.4 to 6.3.0 by @​dependabot[bot] in #​7002
• chore(deps): bump azure/login from 3.0.2 to 3.1.0 by @​dependabot[bot] in #​6959
• chore(deps): bump the codeql group across 1 directory with 3 updates by @​dependabot[bot] in #​6958
• chore(deps): bump distroless/static from f2ea270 to 5813399 by @​dependabot[bot] in #​6957
• chore(deps): bump anchore/sbom-action/download-syft from 0.24.2 to 0.24.3 by @​dependabot[bot] in #​7080
• chore(deps): bump ubi9/ubi from 7a38d75 to 803a35a by @​dependabot[bot] in #​7079

New Contributors

• @​wankhede04 made their first contribution in #​7013
• @​KR-Ravindra made their first contribution in #​6933
• @​guanchzhou made their first contribution in #​6885
• @​PCDattt made their first contribution in #​6982
• @​anikievev made their first contribution in #​7036

Full Changelog: external-secrets/external-secrets@v2.11.0...v2.12.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on tuesday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

@@ spec.chart.spec.version @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/secrets/external-secrets
! ± value change
- 2.11.0
+ 2.12.0

@@ spec.template.spec.containers.cert-controller.image @@
# apps/v1/Deployment/secrets/external-secrets-cert-controller
! ± value change
- ghcr.io/external-secrets/external-secrets:v2.11.0
+ ghcr.io/external-secrets/external-secrets:v2.12.0

@@ spec.template.spec.containers.external-secrets.image @@
# apps/v1/Deployment/secrets/external-secrets
! ± value change
- ghcr.io/external-secrets/external-secrets:v2.11.0
+ ghcr.io/external-secrets/external-secrets:v2.12.0

@@ spec.template.spec.containers.webhook.image @@
# apps/v1/Deployment/secrets/external-secrets-webhook
! ± value change
- ghcr.io/external-secrets/external-secrets:v2.11.0
+ ghcr.io/external-secrets/external-secrets:v2.12.0

[futo-kritika]

Kritika Review

Updates the external-secrets Helm chart to 2.12.0.

No findings

Confidence 4/5 · high risk: No findings were reported, and the review checked the image repositories, the leader-election default, the new Secret validation against the repo's Secret types, and the OnePassword store. The risk is high because external-secrets is a cluster-wide controller that many workloads depend on, and this is a minor bump that also moves the controller and webhook images to v2.12.0.

Not approved: high risk is above the medium this repository approves

Summary

The version bump also advances the controller, webhook, and cert-controller images through the chart’s appVersion. Existing image overrides and leader-election settings remain compatible with the new chart defaults.

Sources consulted

• https://redirect.github.com/external-secrets/external-secrets/compare/v2.11.0...v2.12.0
• https://redirect.github.com/external-secrets/external-secrets/compare/helm-chart-2.11.0...helm-chart-2.12.0

Commands offered: curl, fd, gh, jq, rg, yq; run: rg.

_{Reviews (1) · Last reviewed commit: "chore(deps): update helm release externa..." · openai/gpt-6.1-sol · $0.08}