What cert-manager/cert-manager shipped
Written by FoxPlug from the repository's own releases; not affiliated with Cert-manager. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/cert-manager/cert-manager; Cert-manager did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of September 28, 2026
What shipped
- Fixed Helm chart rendering of proxy environment variables so values like *.example.com no longer produce invalid YAML by quoting them. Pull request #9402
- Fixed certificates getting stuck in Issuing state when a CertificateRequest has a failureTime but no Ready condition. Pull request #9287
- Registered acmesolver logging flags so they can actually be configured instead of being ignored. Pull request #9358
- Bumped Pebble in release-1.21 to fix a deadlock that was causing all ACME end-to-end tests to fail. Pull request #9416
- Applied server-side apply in release-1.21 private key rotation tests to reduce flakiness. Pull request #9386
- Applied server-side apply in release-1.20 private key rotation tests to reduce flakiness. Pull request #9385
- Deflaked notAfter assertions in release-1.21 CSR signing tests by increasing tolerance for timing variations. Pull request #9399
- Deflaked notAfter assertions in CSR signing tests by increasing tolerance for timing variations on loaded CI nodes. Pull request #9247
Why it matters
This week's fixes address test reliability issues that were blocking CI pipelines, a critical certificate state recovery problem that could leave certificates in Issuing state indefinitely, and configuration issues in both the Helm chart and logging setup that affected real deployments.
Changelog entry
- Fixed Helm chart proxy environment variable rendering to properly quote values like *.example.com Pull request #9402
- Fixed certificates remaining in Issuing state when CertificateRequest has failureTime but no Ready condition Pull request #9287
- Registered acmesolver logging flags so they can be configured Pull request #9358
- Bumped Pebble in release-1.21 to fix ACME e2e test deadlock Pull request #9416
- Applied server-side apply in release-1.21 private key rotation tests to reduce flakiness Pull request #9386
- Applied server-side apply in release-1.20 private key rotation tests to reduce flakiness Pull request #9385
- Increased timing tolerance in CSR signing tests to reduce flakiness on loaded CI nodes Pull request #9247
This week: fixed certificates stuck in Issuing state, improved Helm chart proxy env var handling, made acmesolver logging configurable, and reduced test flakiness across releases.
This week's updates focus on reliability and configuration. We fixed an issue where certificates could get stuck in Issuing state when CertificateRequests failed, improved Helm chart rendering of proxy environment variables, made acmesolver logging flags actually configurable, and reduced flakiness in private key rotation and CSR signing tests across multiple release branches.
Week of September 14, 2026
What shipped
- Fixed a security issue where writing to a Certificate's status subresource allowed obtaining private keys from any TLS Secret in the namespace by pointing status.nextPrivateKeySecretName at an unowned Secret. Pull request #9224
- Backported fix to v1.21.3 ensuring cert-manager only consumes private key Secrets owned by the Certificate resource. Pull request #9368
- Backported ACME ARI certificate ID status fix to v1.21.2. Pull request #9292
- Released v1.20.4 with Go and dependency updates for security vulnerabilities and a fix for ingress-shim removing applyset labels from cached Ingress and Gateway objects. Release
- Fixed elliptic curve parameter parsing with added unit tests. Pull request #9294
- Improved error wrapping across 13 files to use %w format specifier instead of %s, enabling proper error chain inspection with errors.Is() and errors.As(). Pull request #9079
- Added test coverage for Helm chart PodMonitor metrics selector values and container port configurations. Pull request #9367
- Fixed flaking Certificate foreground deletion e2e tests. Pull request #9256
- Replaced reflect.DeepEqual usage in tests with more readable assertion patterns for better test failure output. Pull request #9333
Why it matters
This week includes a security fix for private key access control in Certificate status subresources, critical patches backported to maintenance branches, and improvements to error handling and test quality. These changes improve both the security posture and maintainability of cert-manager for production deployments.
Changelog entry
- Security: Fixed unauthorized private key access through Certificate status.nextPrivateKeySecretName by restricting consumption to Secrets owned by the Certificate Pull request #9224
- V1.20.4: Updated Go and dependencies for security fixes; fixed ingress-shim applyset label removal from cached Ingress and Gateway objects Release
- Fixed elliptic curve parameter parsing with unit tests Pull request #9294
- Improved error wrapping to use %w format specifier for proper error chain handling Pull request #9079
- Fixed flaking Certificate foreground deletion e2e tests Pull request #9256
Cert-manager updates: security fix for Certificate status subresource access, v1.20.4 released with dependency updates, elliptic curve parsing fixed, and improved error handling throughout the codebase.
This week's cert-manager updates address a security vulnerability in Certificate status subresource access control, release v1.20.4 with important security dependency updates and ingress-shim fixes, backports of ARI and private key ownership checks to maintenance branches, fixes for elliptic curve parameter parsing, and code quality improvements including better error wrapping and test assertions.