Security

• Oct 18, 2026 Security kyverno-policies v0.28.2

  Changed

  • Align files according to platform standards in #480 by @giantswarm-align-files[bot]

  Full Changelog: https://github.com/giantswarm/kyverno-policies/compare/v0.28.1...v0.28.2

• Oct 18, 2026 Security dex-app v3.4.2

  Changed

  • (deps) Update dependency architect to v10.14.1 in #495 by @renovate[bot]

  Full Changelog: https://github.com/giantswarm/dex-app/compare/v3.4.1...v3.4.2

• Oct 18, 2026 Security dex-app v3.4.1

  Changed

  • Align files according to platform standards in #489 by @giantswarm-align-files[bot]
  • Align files according to platform standards in #535 by @giantswarm-align-files[bot]

  Full Changelog: https://github.com/giantswarm/dex-app/compare/v3.4.0...v3.4.1

• Oct 18, 2026 Security starboard-exporter v1.2.25

  Changed

  • Align files according to platform standards in #631 by @giantswarm-align-files[bot]
  • Align files according to platform standards in #633 by @giantswarm-align-files[bot]
  • Align files according to platform standards in #634 by @giantswarm-align-files[bot]
  • Align files according to platform standards in #635 by @giantswarm-align-files[bot]
  • Align files according to platform standards in #636 by @giantswarm-align-files[bot]
  • Align files according to platform standards in #638 by @giantswarm-align-files[bot]
  • Align files according to platform standards in #639 by @giantswarm-align-files[bot]
  • Align files according to platform standards in #645 by @giantswarm-align-files[bot]
  • Align files according to platform standards in #647 by @giantswarm-align-files[bot]
  • Align files according to platform standards in #649 by @giantswarm-align-files[bot]
  • Align files according to platform standards in #650 by @giantswarm-align-files[bot]
  • Align files according to platform standards in #651 by @giantswarm-align-files[bot]
  • Align files according to platform standards in #653 by @giantswarm-align-files[bot]

  Fixed

  • (deps) Update module github.com/prometheus/client_golang to v1.25.0 in #632 by @renovate[bot]
  • (nancy) Remediate nancy findings in #646 by @heraldbot[bot]
  • Accept the full RelabelConfig in serviceMonitor relabelings and tolerate the deprecated psp key in #648 by @stone-z

  Full Changelog: https://github.com/giantswarm/starboard-exporter/compare/v1.2.24...v1.2.25

• Oct 18, 2026 Security kyverno-policies v0.28.1

  Changed

  • (chart) Update kyverno-policies to v1.19.1 from upstream in #450 by @taylorbot
  • (deps) Update dependency architect to v10.4.1 in #449 by @renovate[bot]
  • (deps) Update dependency architect to v10.5.0 in #451 by @renovate[bot]
  • (deps) Update dependency architect to v10.6.0 in #452 by @renovate[bot]
  • (deps) Update dependency architect to v10.10.0 in #453 by @renovate[bot]
  • Align files according to platform standards in #455 by @giantswarm-align-files[bot]
  • (deps) Update dependency architect to v10.12.1 in #456 by @renovate[bot]
  • Align files according to platform standards in #458 by @giantswarm-align-files[bot]
  • (deps) Update dependency architect to v10.12.2 in #457 by @renovate[bot]
  • Align files according to platform standards in #459 by @giantswarm-align-files[bot]
  • Align files according to platform standards in #460 by @giantswarm-align-files[bot]
  • (deps) Update dependency architect to v10.13.2 in #461 by @renovate[bot]
  • Align files according to platform standards in #464 by @giantswarm-align-files[bot]
  • Align files according to platform standards in #465 by @giantswarm-align-files[bot]
  • Align files according to platform standards in #467 by @giantswarm-align-files[bot]
  • Align files according to platform standards in #468 by @giantswarm-align-files[bot]
  • Align files according to platform standards in #470 by @giantswarm-align-files[bot]
  • (deps) Update dependency architect to v10.13.3 in #469 by @renovate[bot]
  • (deps) Update dependency architect to v10.13.6 in #471 by @renovate[bot]
  • Align files according to platform standards in #473 by @giantswarm-align-files[bot]
  • (deps) Update dependency architect to v10.13.7 in #472 by @renovate[bot]
  • Align files according to platform standards in #474 by @giantswarm-align-files[bot]
  • Align files according to platform standards in #477 by @giantswarm-align-files[bot]
  • Align files according to platform standards in #479 by @giantswarm-align-files[bot]

  Fixed

  • (chart) Helm.sh/chart label is valid for long versions in #454 by @teemow
  • (require-emptydir-requests-and-limits) Pass a workload whose emptyDir volumes carry a sizeLimit in #466 by @teemow

  Full Changelog: https://github.com/giantswarm/kyverno-policies/compare/v0.28.0...v0.28.1

• Oct 17, 2026 Security dex-app v3.4.0

  Changed

  • Dex runs two replicas by default, spread one per node (topologySpreadConstraints on kubernetes.io/hostname, DoNotSchedule, and on topology.kubernetes.io/zone, ScheduleAnyway; a preferred pod anti-affinity on kubernetes.io/hostname), behind a PodDisruptionBudget of minAvailable: 1: a node drain or consolidation waits until another replica is Ready, so the identity provider stays up. With dex.replicaCount: 1 and no autoscaling the budget stays maxUnavailable: 1.
• Oct 14, 2026 Security kyverno-app v0.25.3

  Changed

  • Updated policy-reporter to upstream version v3.11.1.
• Oct 14, 2026 Security cert-manager-app v4.1.2

  Added

  • cert-manager-giantswarm-clusterissuer: Allow setting cnameStrategy per DNS01 solver with acme.dns01.cloudflare.cnameStrategy, acme.dns01.route53.cnameStrategy and acme.dns01.azureDNS.cnameStrategy, so a _acme-challenge CNAME can delegate the challenge to a zone the solver can write to.

  Changed

  • Use imagePullPolicy: IfNotPresent for the cert-manager-giantswarm-clusterissuer hook Job, so a retried Helm hook reuses the image already present on the node instead of downloading it again.
  • Run the E2E test suites automatically on release PRs by adding .github/release-pr-body.md.
  • Increase clusterIssuer job memory limit from 250Mi to 512Mi.

  Fixed

  • Trim the helm.sh/chart label of the Giant Swarm resources (VPAs, PodLogs, proxy ConfigMap) to end on an alphanumeric character. A long dev version cut at 63 characters could end on a ., and the API server rejected the resource.
• Oct 12, 2026 Security kyverno-app v0.25.2

  Fixed

  • Set the chart appVersion to the Kyverno version the kyverno subchart deploys (v1.18.2), so the app.kubernetes.io/version label shows it.

  Added

  • Check that the chart appVersion equals the kyverno subchart’s appVersion in pull requests.

  Changed

  • Updated policy-reporter to upstream version v3.11.0.
• Oct 10, 2026 Security dex-app v3.3.0

  Added

  • oidc.staticClients.<client>.extraRedirectURIs on the pre-defined clients that authenticate with a secret (gitopsui, muster, mcpKubernetes, mcpCapi, mcpPrometheus): further redirect URIs, rendered after redirectURI in their order, for a second application that signs in through the same client. Empty by default; installations without it render unchanged.

  Fixed

  • The helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.

• Newer entries
• Older entries