Skip to content

Update mono-repo packages - #41

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/mono-repo-packages
Open

Update mono-repo packages#41
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/mono-repo-packages

Conversation

@renovate

@renovate renovate Bot commented Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
VictoriaMetrics/operator minor v0.72.0 → v0.74.1
argoproj/argo-cd minor v3.4.6 → v3.5.1

Release Notes

VictoriaMetrics/operator (VictoriaMetrics/operator)

v0.74.1

Compare Source

  • BUGFIX: vldistributed: add validation webhook for VLDistributed resources.

v0.74.0

Compare Source

Update note 1: vmoperator: validation webhooks for prometheus-operator CRDs added to the operator in 0.72.0 is now disabled by default. Use VM_PROMCR_VALIDATION_ENABLED env var to enable it explicitly.

  • Dependency: vmoperator: Updated default versions for VM apps to v1.148.0 version

  • Dependency: vmoperator: Updated default versions for VL apps to v1.52.0.

  • Dependency: vmoperator: Updated default versions for VT apps to v0.10.0 version.

  • Dependency: vmoperator: Updated default versions for VMAnomaly to v1.30.0 version

  • FEATURE: vmanomaly: support Temporal Envelope models, online-model history strength and warmup settings, causal and complexity-aware autotune options, and separate reader fetch and processing controls introduced in vmanomaly v1.30.0. See #​2440.

  • FEATURE: vmoperator: add networkPolicy field to all supported CRDs (VMSingle, VMAgent, VMAlert, VMAlertmanager, VMAuth, VLSingle, VLAgent, VTSingle, VMAnomaly, and all cluster sub-components). When set, the operator creates and manages a NetworkPolicy resource that restricts ingress/egress to the component's pods. See #​2977.

  • BUGFIX: vmoperator: grant the operator's ClusterRole permissions on networking.k8s.io/networkpolicies. The networkPolicy feature above was shipped without this grant, so the operator would fail with a Forbidden error creating/updating/deleting NetworkPolicy objects on a real cluster.

  • FEATURE: vmauth: add opt-in spec.waitForConfigReload field. When enabled, the operator confirms that every replica has actually picked up a config change before marking dependent VMUser objects as applied, so their status can be trusted to reflect what's actually running rather than what was merely written out. vmdistributed's internal VMAuth load balancer always waits for this confirmation before rotating a zone in or out of the backend list, regardless of spec.vmAuth.spec.waitForConfigReload, so traffic is never routed to a zone that's still running a stale config.

  • FEATURE: vlagent: add basicAuth field support to remoteWrite entries. See #​2371.

  • FEATURE: vmcluster: support VMCluster extraStorageNodes for vmselect component.

  • FEATURE: vmuser: add defaultVMAccessClaim field to spec.jwt, mapped to vmauth's jwt.default_vm_access_claim. It lets a VMUser accept JWTs that don't carry a vm_access claim, matching vmauth v1.147.0+ behavior. See #​2375.

  • FEATURE: helm-converter: parse the victoria-metrics-auth chart's config value (vmauth's own native config file). Each config.users entry is converted into a standalone VMUser CR, and config.unauthorized_user is converted into the VMAuth CR's spec.unauthorizedUserAccessSpec. The generated VMUser CRs are appended to the same output file as additional YAML documents, and the VMAuth CR's spec.userSelector is set to a dedicated label matching them, so the operator actually loads them (a bare VMAuth CR's default selectors match nothing). See #​2397.

  • FEATURE: vmoperator: introduce VLDistributed CR, which controls multiple region-distributed VictoriaLogs clusters.

  • BUGFIX: vmoperator: support Ignored status for child objects that were not picked, also do not set Failed status if object was applied on at least one parent object. See #​2432.

  • BUGFIX: vmoperator: removed library/ component, while building CR images that do not contain / in repo name. See #​2409.

  • BUGFIX: vmoperator: log only the changed key names and value sizes, instead of the full values, when updating ConfigMap. Previously a single data_diff log line could reach multiple megabytes for large ConfigMaps and break downstream log pipelines with per-line size limits. See #​2426.

  • BUGFIX: vmagent, vmsingle: add missing list verb to config-reloader's secrets RBAC rule. See #​2384.

  • BUGFIX: vmoperator: return an error instead of panicking when a Labels map value is malformed (missing the = separator) during config parsing.

  • BUGFIX: vmalert: when no notifiers are configured, ignore alerting rules from selected VMRules instead of failing reconciliation; recording rules in the same group are kept and still reconciled. See #​2388.

  • BUGFIX: vmalertmanager: default pod securityContext.fsGroup to 65534 when persistent storage is configured and neither useStrictSecurity nor a user securityContext is set. Without it the alertmanager process cannot write notification log and silences to a freshly provisioned volume, so silences are silently lost on pod restart. User-provided securityContext and useStrictSecurity keep their previous behaviour.

  • BUGFIX: vmoperator: allow pinning images by digest via the image.tag field of all operator CRs. When tag is a digest (e.g. sha256:<hex>) it is now joined to the repository with @ instead of :, producing a valid repository@sha256:<digest> reference. Regular tags are unaffected.

  • BUGFIX: helm-converter: fix persistentVolume.storageClassName being dropped during conversion due to a stale storageClass field name. See #​2389.

  • BUGFIX: helm-converter: fix securityContext.runAsNonRoot, runAsUser, runAsGroup, seccompProfile, appArmorProfile, seLinuxOptions, and windowsOptions being silently dropped during conversion; these are now promoted to spec.securityContext.podSecurityContext, matching how the operator applies them to containers. See #​2391.

  • BUGFIX: helm-converter: fix TLS/mTLS settings (tlsCAFile, tlsCertFile, tlsKeyFile, tlsServerName, tlsInsecureSkipVerify) on remoteWrite entries being dropped during conversion for vmagent, vlagent, vlcollector, and vmalert charts. See #​2390.

  • BUGFIX: helm-converter: fix cannot unmarshal object into Go struct field ... headers of type []string error when a chart's default values.yaml ships a headers: {} map (e.g. vmalert's datasource.headers, notifier.headers, remoteWrite.headers); such maps are now normalized to the operator's key:value string-slice format before conversion. See #​2398.

  • BUGFIX: helm-converter: fix extraVolumes/extraVolumeMounts being silently dropped during conversion for vmsingle, vmagent, vmalert, vmanomaly, vmcluster, vlcluster, vtcluster, vtsingle, vlogs, and vmauth charts. See #​2424.

  • BUGFIX: vmagent, vmanomaly: target spec.vpa at the VMAgent/VMAnomaly custom resource itself instead of its underlying Deployment/StatefulSet. VPA rejects a targetRef whose owner chain includes another scalable controller, so a VerticalPodAutoscaler targeting the workload directly was silently non-functional whenever the CR exposed a scale subresource. See #​2415.

  • BUGFIX: vlagent: remove a vestigial scale subresource declaration referencing nonexistent spec/status fields, which unconditionally broke spec.vpa for VLAgent the same way as #​2415.

  • BUGFIX: vmalert, vmagent, vmalertmanager, vmauth, vmsingle: fix child object selection (VMRule, scrape objects, VMAlertmanagerConfig, VMUser) being silently skipped whenever the parent CR's spec contains a field the running operator version doesn't recognize (e.g. after a CRD/operator version mismatch), even though the CR otherwise reconciles successfully with no errors. See #​2444.

v0.73.1

Compare Source

  • BUGFIX: vmrule: removed strategic-merge list semantics from rules as it breaks many rules, where it's a common practice to use a same rule name with different thresholds and severities.

v0.73.0

Compare Source

  • Dependency: vmoperator: Updated default versions for VM apps to v1.147.0 version

  • Dependency: vmoperator: Updated default versions for VL apps to v1.51.0.

  • Dependency: vmoperator: Updated default versions for VT apps to v0.9.4 version.

  • SECURITY: vmagent, vmsingle: remove cluster-wide secrets and configmaps permissions from the operator-managed ClusterRole. Secret access for the config-reloader is now granted via a namespace-scoped Role limited to the single operator-managed config secret. For vmsingle in ingest-only mode (the default), no secret or configmap permissions are granted at all.

  • FEATURE: vmuser, vmauth: add access_log field support. See docs and #​2359.

  • FEATURE: vmuser: add useExtraService boolean field to crd.namespacedName and crd.objects entries in VMUser target references. When set to true, the operator resolves the target URL using the CR's additional service (configured via spec.serviceSpec) instead of the default service. This lets you route VMAuth traffic to a dedicated service with different port mappings or service type without changing the primary service. See related types: CRDRef, NamespacedName. See #​2333.

  • FEATURE: vmoperator: add useLegacyNaming field to all operator CRs. When enabled, managed resources are named using the standalone Helm chart convention (CR name directly for single-component CRs; <name>-<component> for cluster CRs) instead of the default operator prefix convention. Useful when migrating from standalone charts to operator-managed resources without recreating existing resources.

  • FEATURE: vmdistributed: support using VMSingle backends alongside VMCluster backends in separate zones.

  • FEATURE: vmoperator: add VM_OPENSHIFT_COMPATIBILITY env var (OpenshiftCompatibilityMode config field, default auto) to enable OpenShift-specific compatibility features for managed pods. In auto mode the operator detects OpenShift at startup via presence of security.openshift.io/v1 API group. Currently covers automatic mounting of the openshift-service-ca.crt ConfigMap into VMAgent and VMSingle pods at /etc/ssl/certs/openshift-service-ca/service-ca.crt, so that targets signed with the OpenShift service signing CA could be verified without additional TLS config. Supported values: auto, enabled, disabled. See #​2971.

  • BUGFIX: vmcluster: fix CR getting permanently stuck in expanding status after an image update when HPA is enabled on vminsert, vmselect, or vmstorage. The operator was comparing a stale replica count (captured at reconcile start) against live status fields, so the readiness check could never pass once HPA changed the replica count mid-rollout. The same issue affected VMAuth, VLCluster, and VTCluster components with HPA enabled. See #​2324.

  • BUGFIX: config-reloader: fix possible panic on Secret watch events when the informer's local cache fell out of sync and Kubernetes delivered a stale tombstone entry instead of the Secret object. The config-reloader now unwraps tombstones correctly and logs an error for any other unexpected types.

  • BUGFIX: vmanomaly: add missing scatter_infer_jobs field to the periodic scheduler config struct. See #​2328.

  • BUGFIX: vmoperator: switch default app probes to tcpSocket startupProbe when TLS is enabled on the managed HTTP endpoint. This avoids broken kubelet httpGet checks against TLS and mTLS-protected workloads. See #​1824.

  • BUGFIX: vmagent, vmsingle: create a Role and RoleBinding in each namespace listed in WATCH_NAMESPACES so that vmagent/vmsingle can perform service discovery in all watched namespaces, not only its own. Previously, in namespaced mode, vmagent/vmsingle could only scrape targets from its own namespace due to missing RBAC in other watched namespaces.

  • BUGFIX: vmagent: fix missing credential secret and config-reloader setup in ingestOnlyMode when remote write entries carry authentication secrets (basicAuth.password, bearerTokenSecret, or oauth2.clientSecret). Previously the operator-managed secret containing the credential files was never created in ingest-only mode, causing vmagent to start with dangling file references. The secret is now reconciled and the config-reloader is configured to watch it for credential rotation.

argoproj/argo-cd (argoproj/argo-cd)

v3.5.1

Compare Source

v3.5.0

Compare Source

Quick Start

Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.0/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.0/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Features
Bug fixes

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined
Post-upgrade command 'pkl project resolve packages/*/' has not been added to the allowed list in allowedCommands
File name: undefined
Post-upgrade command 'for f in packages/*/_generate.pkl; do (cd "${f%/*}" && pkl eval -m . ./_generate.pkl); done' has not been added to the allowed list in allowedCommands
File name: undefined
Post-upgrade command 'pkl format -w packages/' has not been added to the allowed list in allowedCommands

@renovate
renovate Bot force-pushed the renovate/mono-repo-packages branch from b63ce1e to 84b5afa Compare August 4, 2026 13:40
@renovate renovate Bot changed the title Update dependency VictoriaMetrics/operator to v0.74.0 Update mono-repo packages Aug 4, 2026
@renovate
renovate Bot force-pushed the renovate/mono-repo-packages branch from 84b5afa to ce8b4ac Compare August 12, 2026 14:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants