chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
alpine	final	digest	865b95f → 2510918
alpine	stage	digest	865b95f → 2510918
cert-manager (source)		patch	v1.19.2 → v1.19.4
contour (source)		minor	0.2.1 → 0.3.0
debian	final	digest	c5f48c9 → 4333240
eclipse-temurin	final	digest	b51543f → f10d625
envoyproxy/envoy		minor	v1.36.4 → v1.37.0
go	uses-with	minor	1.25 → 1.26
golang	final	minor	1.25 → 1.26
golang	stage	minor	1.25-alpine → 1.26-alpine
golang	stage	minor	1.25 → 1.26
golangci/golangci-lint		minor	2.7.2 → 2.10.1
helm/kind-action	action	minor	v1.13.0 → v1.14.0
kube-prometheus-stack (source)		minor	80.13.0 → 80.14.4
kubernetes-sigs/controller-tools		patch	v0.20.0 → v0.20.1
maven	stage	digest	e45339e → 8b2f036
maven	stage	digest	def4551 → 22cd2d8
quay.io/brancz/kube-rbac-proxy		minor	v0.20.1 → v0.21.0
org.springframework.boot:spring-boot-starter-parent (source)	parent	patch	4.0.1 → 4.0.3

---

Release Notes

cert-manager/cert-manager (cert-manager)

v1.19.4

Compare Source

v1.19.3

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

This release contains three bug fixes, including a fix for the MODERATE severity DoS issue in GHSA-gx3x-vq4p-mhhv. All users should upgrade to the latest release.

Changes by Kind

Bug or Regression

• Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. (#​8415, @​cert-manager-bot)
• Fixed an issue where HTTP-01 challenges failed when the Host header contained an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. (#​8436, @​cert-manager-bot)
• Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. (#​8468, @​SgtCoDFish)

Other (Cleanup or Flake)

• Bump go to 1.25.6 (#​8459, @​SgtCoDFish)

projectcontour/helm-charts (contour)

v0.3.0

Compare Source

Helm chart for Contour - an open source Kubernetes ingress controller that works by deploying the Envoy proxy as a reverse proxy and load balancer.

What's Changed

• Upgrade contour to 1.33.2 in #​28

actions/go-versions (go)

v1.26.0: 1.26.0

Compare Source

Go 1.26.0

golangci/golangci-lint (golangci/golangci-lint)

v2.10.1

Compare Source

Released on 2026-02-17

1. Fixes
   • buildssa panic

v2.10.0

Compare Source

Released on 2026-02-17

1. Linters new features or changes
   • ginkgolinter: from 0.22.0 to 0.23.0
   • gosec: from 2.22.11 to 2.23.0 (new rules: G117, G602, G701, G702, G703, G704, G705, G706)
   • staticcheck: from 0.6.1 to 0.7.0
2. Linters bug fixes
   • godoclint: from 0.11.1 to 0.11.2

v2.9.0

Compare Source

Released on 2026-02-10

1. Enhancements
   • 🎉 go1.26 support
2. Linters new features or changes
   • arangolint: from 0.3.1 to 0.4.0 (new rule: detect potential query injections)
   • ginkgolinter: from 0.21.2 to 0.22.0 (support for wrappers)
   • golines: from 0.14.0 to 0.15.0
   • misspell: from 0.7.0 to 0.8.0
   • unqueryvet: from 1.4.0 to 1.5.3 (new options: check-n1, check-sql-injection, check-tx-leaks, allow, custom-rules)
   • wsl: from 5.3.0 to 5.6.0 (new rule: after-block)
3. Linters bug fixes
   • modernize: from 0.41.0 to 0.42.0
   • prealloc: from 1.0.1 to 1.0.2
   • protogetter: from 0.3.18 to 0.3.20
4. Misc.
   • Log information about files when configuration verification
   • Emit an error when no linters enabled
   • Do not collect VCS information when loading code

v2.8.0

Compare Source

Released on 2026-01-07

1. Linters new features or changes
   • godoc-lint: from 0.10.2 to 0.11.1 (new rule: require-stdlib-doclink)
   • golines: from 442fd00 to 0.14.0
   • gomoddirectives: from 0.7.1 to 0.8.0
   • gosec: from daccba6 to 2.22.11 (new rule: G116)
   • modernize: from 0.39.0 to 0.40.0 (new analyzers: stringscut, unsafefuncs)
   • prealloc: from 1.0.0 to 1.0.1 (message changes)
   • unqueryvet: from 1.3.0 to 1.4.0 (new options: check-aliased-wildcard, check-string-concat, check-format-strings, check-string-builder, check-subqueries, ignored-functions, sql-builders)
2. Linters bug fixes
   • go-critic: from 0.14.2 to 0.14.3
   • go-errorlint: from 1.8.0 to 1.9.0
   • govet: from 0.39.0 to 0.40.0
   • protogetter: from 0.3.17 to 0.3.18
   • revive: add missing enable-default-rules setting
3. Documentation
   • docs: split installation page

helm/kind-action (helm/kind-action)

v1.14.0

Compare Source

What's Changed

• Bump actions/checkout from 5.0.0 to 6.0.1 by @​dependabot[bot] in #​153
• bump kind to v0.31.0 and k8s to v1.35.0 by @​MrFreezeex in #​155
• Bump actions/checkout from 6.0.1 to 6.0.2 in the actions group by @​dependabot[bot] in #​156

New Contributors

• @​MrFreezeex made their first contribution in #​155

Full Changelog: helm/kind-action@v1...v1.14.0

prometheus-community/helm-charts (kube-prometheus-stack)

v80.14.4

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [CI] Update dependency helm/helm to v4.0.5 by @​renovate[bot] in #​6486
• [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​6487

Full Changelog: prometheus-community/helm-charts@prometheus-28.4.0...kube-prometheus-stack-80.14.4

v80.14.3

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​6484

Full Changelog: prometheus-community/helm-charts@prometheus-node-exporter-4.51.0...kube-prometheus-stack-80.14.3

v80.14.2

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-state-metrics] Probes use ports by name rather than number by @​jcpunk in #​6442
• [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​6483

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-80.14.1...kube-prometheus-stack-80.14.2

v80.14.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Make thanosService clusterIP optional by @​randrusiak in #​6476

Full Changelog: prometheus-community/helm-charts@prometheus-node-exporter-4.50.1...kube-prometheus-stack-80.14.1

v80.14.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​6477

Full Changelog: prometheus-community/helm-charts@prometheus-nginx-exporter-1.17.3...kube-prometheus-stack-80.14.0

v80.13.3

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​6465

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-80.13.2...kube-prometheus-stack-80.13.3

v80.13.2

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​6464

Full Changelog: prometheus-community/helm-charts@prometheus-28.2.1...kube-prometheus-stack-80.13.2

v80.13.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update quay.io/prometheus/prometheus Docker tag to v3.9.1 by @​renovate[bot] in #​6462

Full Changelog: prometheus-community/helm-charts@prometheus-28.2.0...kube-prometheus-stack-80.13.1

kubernetes-sigs/controller-tools (kubernetes-sigs/controller-tools)

v0.20.1

Compare Source

What's Changed

• ✨ Support nested pointer to type-aliased slices by @​k8s-infra-cherrypick-robot in #​1336

Full Changelog: kubernetes-sigs/controller-tools@v0.20.0...v0.20.1

spring-projects/spring-boot (org.springframework.boot:spring-boot-starter-parent)

v4.0.3

Compare Source

⭐ New Features

• Add TWENTY_SIX to JavaVersion enum #​49193

🐞 Bug Fixes

• Jackson properties may not be applied correctly to RestClients #​49223
• ClassNotFoundException when using Actuator without spring-boot-health #​49196
• Using the OTel and Zipkin starters together creates invalid configuration #​49183
• Whitespace can be incorrectly removed when spring-boot-configuration-processor runs on multi-line javadoc #​49060
• Jackson2HttpMessageConvertersConfiguration uses ConditionOn Jackson3 XMLMapper class #​49015
• server.jetty.threads.max is ignored when using virtual threads #​48989
• Slice test includes fail to load when using spring-boot-starter-test-classic #​48981
• Docker credential helpers with file extensions cannot be executed on Windows #​48979
• Java version requirement check for native image is confusing if AOT didn't run #​48963
• TestPropertyValues.Pair.fromMapEntry(Entry<String, String>) does not comply with its nullability contract #​48948

📔 Documentation

• Couchbase and Kafka are incorrectly listed as supporting SSL with Docker Compose #​49212
• Document that use of non idiomatic format for '@Value' still apply for environment variables #​49109
• Document naming convention for custom test-scoped starters #​49017
• Delay removal of Jackson 2 support until 4.3 at the earliest #​49010
• LICENSE.txt and NOTICE.txt files have the wrong content in the latest releases #​49003
• ApplicationContextAssert documents a non-existent assertion in getFailure() #​48977
• Highlight the importance of the preStop hook when configuring Kubernetes probes #​48946

🔨 Dependency Upgrades

• Upgrade to AssertJ 3.27.7 #​49095
• Upgrade to Elasticsearch Client 9.2.5 #​49184
• Upgrade to Groovy 5.0.4 #​49097
• Upgrade to Hibernate 7.2.3.Final #​49098
• Upgrade to Hibernate 7.2.4.Final #​49167
• Upgrade to Jaybird 6.0.4 #​49099
• Upgrade to JBoss Logging 3.6.2.Final #​49100
• Upgrade to Jersey 4.0.2 #​49101
• Upgrade to Jetty 12.1.6 #​49102
• Upgrade to jOOQ 3.19.30 #​49103
• Upgrade to JUnit Jupiter 6.0.3 #​49233
• Upgrade to Logback 1.5.29 #​49169
• Upgrade to Logback 1.5.32 #​49245
• Upgrade to Micrometer 1.16.3 #​49111
• Upgrade to Micrometer Tracing 1.6.3 #​49112
• Upgrade to MongoDB 5.6.3 #​49105
• Upgrade to MySQL 9.6.0 #​49106
• Upgrade to Netty 4.2.10.Final #​49107
• Upgrade to Postgresql 42.7.10 #​49202
• Upgrade to Reactor Bom 2025.0.3 #​49087
• Upgrade to Spring Data Bom 2025.1.3 #​49088
• Upgrade to Spring Framework 7.0.5 #​49216
• Upgrade to Spring Integration 7.0.3 #​49217
• Upgrade to Spring Kafka 4.0.3 #​49090
• Upgrade to Spring LDAP 4.0.2 #​49091
• Upgrade to Spring Pulsar 2.0.3 #​49092
• Upgrade to Spring Security 7.0.3 #​49093
• Upgrade to Spring Session 4.0.2 #​49094
• Upgrade to Tomcat 11.0.18 #​49108

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​GaetanoCerciello, @​dsyer, @​linkian209, @​nosan, @​quaff, @​scordio, and @​srt

v4.0.2

Compare Source

⚠️ Noteworthy Changes

• The dependency on org.eclipse.jetty.ee11:jetty-ee11-servlets has been removed from spring-boot-jetty as it was unnecessary and unused. If your application code depends on a class from jetty-ee11-servlets, declare a dependency on it in your build configuration. #​48677

🐞 Bug Fixes

• No TransactionAutoConfiguration with spring-boot-starter-kafka for Spring Boot 4 #​48880
• Evaluation of bean conditions unnecessarily queries the bean factory for types that are not present #​48840
• When a bean condition references a type that is not present, it appears as ? in the condition evaluation report #​48838
• SessionAutoConfiguration creates a DefaultCookieSerializer with a default SameSite of null instead of Lax #​48830
• Setting graphql schema location to "classpath*:graphql/**/" causes failure due to incorrectly packaged test resource #​48829
• Message interpolation by MVC and WebFlux's Validators does not work correctly in a native image #​48828
• CloudFoundry integration fails in Servlet-based web app without a dependency on spring-boot-starter-restclient #​48826
• RestTestClientAutoConfiguration and TestRestTemplateAutoConfiguration should be package-private #​48820
• SSL metrics are no longer auto-configured #​48819
• Actuator /info endpoint fails in Java 25 Native Image (VirtualThreadSchedulerMXBean support) #​48812
• DataSourceBuilder cannot create oracle.ucp.jdbc.PoolDataSourceImpl in a native image #​48703
• The spring-boot-cloudfoundry module should only have an optional dependency on spring-boot-security #​48685
• Application JAR created by extract command is not reproductible #​48678
• AOT processing of tests should not be disabled when 'skipTests' is set #​48662
• @SpringBootTest(webEnvironment = WebEnvironment.RANDOM_PORT) is no longer applied to the management server #​48653
• Fix zero-length byte buffer in InspectedContent #​48650
• Can no longer override JacksonJsonHttpMessageConverter with ServerHttpMessageConvertersCustomizer #​48635
• HttpServiceClientProperties incorrectly uses the @ConfigurationProperties annotation on a LinkedHashMap class #​48616
• spring-boot-micrometer-tracing-opentelemetry fails if spring-boot-opentelemetry isn't there #​48585
• App fails to start with starter-webmvc and starter-zipkin #​48581
• Micrometer test modules should have an api dependency on micrometer-observation-test #​48386

📔 Documentation

• Fix typo in REST client documentation #​48907
• Remove duplicate word #​48874
• Document support for configuring arguments passed to Docker Compose #​48806
• The documentation related to EnvironmentPostProcessor links to deprecated interface #​48803
• Update documentation for Buildpack's AOT Cache support #​48769
• Correct docs to use new location for error handling configuration properties #​48767
• Document spring-boot-starter-cloudfoundry on Cloud Foundry Support Page #​48675
• Clarify javadoc to make it clear that HazelcastConfigCustomizer beans are only applied if Hazelcast is configured via a config file #​48659
• Example using excludeDevtools property should document that optional dependencies should be enabled #​48641
• Fix grammar and typos in the reference guide #​48601
• Update Tracing section for Spring Boot 4's modularity #​48576

🔨 Dependency Upgrades

• Upgrade to Classmate 1.7.3 #​48783
• Upgrade to Elasticsearch Client 9.2.3 #​48721
• Upgrade to Hibernate 7.2.1.Final #​48857
• Upgrade to HttpClient5 5.5.2 #​48784
• Upgrade to Jackson 2 Bom 2.20.2 #​48910
• Upgrade to Jackson Bom 3.0.4 #​48931
• Upgrade to JUnit Jupiter 6.0.2 #​48785
• Upgrade to Lettuce 6.8.2.RELEASE #​48859
• Upgrade to Logback 1.5.24 #​48786
• Upgrade to Logback 1.5.25 #​48885
• Upgrade to Micrometer 1.16.2 #​48712
• Upgrade to Micrometer Tracing 1.6.2 #​48713
• Upgrade to Native Build Tools Plugin 0.11.4 #​48911
• Upgrade to Pooled JMS 3.1.9 #​48787
• Upgrade to Postgresql 42.7.9 #​48886
• Upgrade to R2DBC MSSQL 1.0.4.RELEASE #​48858
• Upgrade to Reactor Bom 2025.0.2 #​48714
• Upgrade to Spring AMQP 4.0.2 #​48832
• Upgrade to Spring Batch 6.0.2 #​48715
• Upgrade to Spring Data Bom 2025.1.2 #​48716
• Upgrade to Spring Framework 7.0.3 #​48717
• Upgrade to Spring GraphQL 2.0.2 #​48718
• Upgrade to Spring HATEOAS 3.0.2 #​48834
• Upgrade to Spring Integration 7.0.2 #​48833
• Upgrade to Spring Kafka 4.0.2 #​48719
• Upgrade to Spring Pulsar 2.0.2 #​48720
• Upgrade to WebJars Locator Lite 1.1.3 #​48788
• Upgrade to XML Maven Plugin 1.2.1 #​48887

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​GaoSSR, @​ShaunHaldane, @​Zuohuang-Cai, @​izeye, @​mspiess, @​ngocnhan-tran1996, and @​philipbolting

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.