What cert-manager/cert-manager shipped
Written by FoxPlug from the repository's own releases; not affiliated with Cert-manager. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/cert-manager/cert-manager; Cert-manager did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- ACME order polling now uses the order URL after finalize instead of the Location header, addressing intermittent 403 orderNotReady failures in e2e tests. Pull request #9430
- IPAddressesFromStrings now returns an error for zoned IPv6 addresses like fe80::1%eth0 instead of silently returning no error and dropping IP SANs from the CSR. Pull request #9104
- Secret list selectors that match unlabelled Secrets are now rejected, so listing serves from the typed cache instead of making one live GET per Secret. Pull request #9409
- Issuer and ClusterIssuer now accept an optional spec.venafi.ngts.workspaceID field, passed to vcert for NGTS tenants split into workspaces. Pull request #9486
- Static CRD release manifests no longer include the helm.sh/resource-policy keep annotation when crds.keep is not explicitly enabled. Pull request #9547
Why it matters
This week fixes two correctness issues that could surprise users: zoned IPv6 addresses no longer silently produce CSRs without IP SANs, and Secret list selectors that match unlabelled Secrets are rejected rather than causing one live GET per Secret. It also makes ACME order finalization more reliable and lets Venafi NGTS users target a specific workspace.
Changelog entry
- Poll the ACME order URL after finalize instead of the Location header. Pull request #9430
- Return an error for zoned IPv6 addresses in IPAddressesFromStrings. Pull request #9104
- Reject Secret LIST selectors that match unlabelled Secrets. Pull request #9409
- Add an optional workspaceID to the Venafi NGTS issuer. Pull request #9486
- Omit the Helm keep annotation from static CRDs. Pull request #9547
This week: ACME order polling fixed after finalize, zoned IPv6 addresses now error in IPAddressesFromStrings, Secret list selectors matching unlabelled Secrets are rejected, optional Venafi NGTS workspaceID added, and static CRDs drop the Helm keep annotation.
This week in cert-manager: ACME order polling now uses the order URL after finalize instead of the Location header, fixing intermittent orderNotReady failures. IPAddressesFromStrings now returns an error for zoned IPv6 addresses such as fe80::1%eth0 instead of silently building a CSR with no IP SANs. Secret list selectors that match unlabelled Secrets are rejected, so listing no longer causes one live GET per Secret. Issuer and ClusterIssuer gain an optional Venafi NGTS workspaceID. Static CRD release manifests no longer include the Helm keep annotation unless crds.keep is enabled.
Week of October 26, 2026
What shipped
- Released v1.20.5, which removes trust in the compromised eMudhra CA, moves base images to Debian 13, and updates Go. Release
- Added ML-DSA (FIPS 204) private key support. Pull request #9469
- Invalid Ingress, Gateway and ListenerSet annotations now record a BadConfig event. Pull request #9532
- Updated release-1.20 base images to Debian 13 to drop the emSign ECC Root CA G3 root certificate. Pull request #9511
- Raised the go directive on release-1.20 to 1.26 to take golang.org/x/net v0.60.0 and fix five reachable HTTP/2 vulnerabilities. Pull request #9524
- Updated the feature gates example in the Helm chart values.yaml to v1.21.0, adding the missing ACMEUseARI and MLDSAPrivateKeys alpha gates. Pull request #9389
- Simplified the renewal watcher loop in DynamicSource.Start by replacing the closure with explicit cancel handling. Pull request #8957
- Fixed a flake in TestDynamicAuthority by waiting for rotation after the CA Secret is deleted. Pull request #9243
Why it matters
This week matters because v1.20.5 removes trust in a compromised CA and moves base images to Debian 13, which is a security-relevant change for anyone using release-1.20. ML-DSA private key support adds a post-quantum signing option, and invalid annotations now produce a BadConfig event so misconfigurations are easier to spot.
Changelog entry
- Release v1.20.5 removes trust in the compromised eMudhra CA and moves base images to Debian 13. Release
- Add ML-DSA (FIPS 204) private key support. Pull request #9469
- Record a BadConfig event for invalid Ingress and Gateway annotations. Pull request #9532
- Update release-1.20 base images to Debian 13. Pull request #9511
- Raise the go directive on release-1.20 to 1.26 to take golang.org/x/net v0.60.0. Pull request #9524
- Update feature gates list in Helm chart values.yaml to v1.21.0. Pull request #9389
- Simplify the renewal watcher loop in DynamicSource.Start. Pull request #8957
- Deflake TestDynamicAuthority. Pull request #9243
Cert-manager v1.20.5 is out: removes trust in the compromised eMudhra CA, moves base images to Debian 13, raises Go to 1.26 for x/net v0.60.0. Also landed: ML-DSA (FIPS 204) private keys and BadConfig events for invalid Ingress/Gateway annotations.
Cert-manager v1.20.5 has been released. It removes trust in the compromised eMudhra CA and moves base images to Debian 13, which no longer includes the emSign ECC Root CA G3 root certificate. The release branch's go directive was raised to 1.26 so v1.20.5 can take golang.org/x/net v0.60.0, fixing five reachable HTTP/2 vulnerabilities. On master, ML-DSA (FIPS 204) private key support was added, invalid Ingress, Gateway and ListenerSet annotations now record a BadConfig event, the Helm chart's feature gates example was updated to v1.21.0, the renewal watcher loop in DynamicSource.Start was simplified, and a flake in TestDynamicAuthority was fixed.
Week of October 19, 2026
What shipped
- Released v1.21.3, which removes trust in the compromised eMudhra CA so the updated base images no longer include the emSign ECC Root CA - G3 root certificate. Release
- Updated the Go dependency to v1.26.10 on release-1.21 to fix a reported vulnerability. Pull request #9501
- Updated the Go dependency to v1.26.10 on release-1.20 to address vulnerabilities reported in the older standard library. Pull request #9503
- Changed CloudDNS cleanup so it no longer fails when no managed zone matches, since it previously repeated the same lookup error as Present. Pull request #9490
- Fixed the field name reported in request mismatch violations for postal codes, which was shown as spec.subject.postCodes. Pull request #9488
- Applied the modernize embedlit fixes, a follow-up to an earlier change, using Go 1.27's allowance for omitting embedded field types in struct literals. Pull request #9441
Why it matters
This week brings a patch release that stops trusting a compromised CA in the shipped base images, which matters to anyone relying on the default trust store. The release branches also move to Go 1.26.10 to pick up standard library fixes. Two smaller changes improve CloudDNS challenge cleanup and the accuracy of mismatch messages for certificate requests.
Changelog entry
- Release v1.21.3: removes trust in the compromised eMudhra CA; base images no longer include the emSign ECC Root CA - G3 root certificate. Release
- Update Go to v1.26.10 on release-1.21. Pull request #9501
- Update Go to v1.26.10 on release-1.20. Pull request #9503
- CloudDNS: do not fail CleanUp when no managed zone matches the challenge domain. Pull request #9490
- Pki: report spec.subject.postalCodes in request mismatch violations. Pull request #9488
- Apply the modernize embedlit fixes. Pull request #9441
Cert-manager v1.21.3 is out: trust in the compromised eMudhra CA is removed and base images no longer include the emSign ECC Root CA - G3 root. We also moved release-1.20 and release-1.21 to Go 1.26.10 and fixed CloudDNS cleanup erroring when no managed zone matches.
Cert-manager v1.21.3 is released. It removes trust in the compromised eMudhra CA, and the updated base images no longer include the emSign ECC Root CA - G3 root certificate. Go 1.26.10 is now used on the release-1.20 and release-1.21 branches, picking up standard library fixes. Also this week: CloudDNS cleanup no longer fails when no managed zone matches the challenge domain, postal code mismatches in certificate requests are reported under the correct field name, and the modernize embedlit fixes were applied.
Week of October 12, 2026
What shipped
- Added a design proposal for post-quantum ML-DSA (FIPS 204) private keys, using crypto/mldsa and the ML-DSA support in crypto/x509 from the Go 1.27 standard library, with a privateKey.algorithm value of MLDSA and sizes 44, 65 and 87, defaulting to 44. Pull request #9436
- Changed the ACME webhook DNS01 end-to-end test to use a local DNS zone instead of example.com, so the DNS01 SOA lookup no longer depends on external DNS recursion and the outdated DNSSEC trust anchor in the pinned BIND image. Pull request #9464
- Fixed the end-to-end test failure that had blocked every pull-cert-manager-master-e2e run since the IANA Root Zone KSK rollover, by changing the BIND image used in CI tests. Pull request #9467
- Cherry-picked the CI BIND image test fix onto release-1.21. Pull request #9474
- Cherry-picked the CI BIND image test fix onto release-1.20. Pull request #9476
- Cherry-picked the local DNS zone change for the ACME webhook test onto release-1.20. Pull request #9477
- Cherry-picked the local DNS zone change for the ACME webhook test onto release-1.21. Pull request #9475
Why it matters
End-to-end test runs on the master branch had been blocked since the IANA Root Zone KSK rollover, and this week's BIND image change and switch to a local DNS zone for the ACME webhook test addressed the causes. The same fixes were backported to the 1.20 and 1.21 release branches. A design for ML-DSA private key support was also added, setting out the planned API.
Changelog entry
- Added a design proposal for post-quantum ML-DSA (FIPS 204) private keys. Pull request #9436
- Fixed e2e test failures by updating the BIND image used in CI tests. Pull request #9467
- Changed the ACME webhook DNS01 e2e test to use a local DNS zone. Pull request #9464
- Backported the CI BIND image test fix to release-1.21. Pull request #9474
- Backported the CI BIND image test fix to release-1.20. Pull request #9476
- Backported the local DNS zone change for the ACME webhook test to release-1.21. Pull request #9475
- Backported the local DNS zone change for the ACME webhook test to release-1.20. Pull request #9477
This week: CI e2e tests fixed after the IANA Root Zone KSK rollover broke the pinned BIND image, and the ACME webhook test now uses a local DNS zone. Both changes backported to 1.20 and 1.21. A design for ML-DSA private keys was also added.
This week in cert-manager: the end-to-end test failure that had blocked master runs since the IANA Root Zone KSK rollover was fixed by updating the BIND image used in CI tests. The ACME webhook DNS01 test now uses a local DNS zone instead of example.com, so its SOA lookup no longer needs external DNS recursion. Both changes were backported to the 1.20 and 1.21 release branches. A design proposal for post-quantum ML-DSA (FIPS 204) private keys was also added, covering a privateKey.algorithm value of MLDSA with sizes 44, 65 and 87, defaulting to 44.
Week of September 28, 2026
What shipped
- Fixed Helm chart rendering of proxy environment variables so values like *.example.com no longer produce invalid YAML by quoting them. Pull request #9402
- Fixed certificates getting stuck in Issuing state when a CertificateRequest has a failureTime but no Ready condition. Pull request #9287
- Registered acmesolver logging flags so they can actually be configured instead of being ignored. Pull request #9358
- Bumped Pebble in release-1.21 to fix a deadlock that was causing all ACME end-to-end tests to fail. Pull request #9416
- Applied server-side apply in release-1.21 private key rotation tests to reduce flakiness. Pull request #9386
- Applied server-side apply in release-1.20 private key rotation tests to reduce flakiness. Pull request #9385
- Deflaked notAfter assertions in release-1.21 CSR signing tests by increasing tolerance for timing variations. Pull request #9399
- Deflaked notAfter assertions in CSR signing tests by increasing tolerance for timing variations on loaded CI nodes. Pull request #9247
Why it matters
This week's fixes address test reliability issues that were blocking CI pipelines, a critical certificate state recovery problem that could leave certificates in Issuing state indefinitely, and configuration issues in both the Helm chart and logging setup that affected real deployments.
Changelog entry
- Fixed Helm chart proxy environment variable rendering to properly quote values like *.example.com Pull request #9402
- Fixed certificates remaining in Issuing state when CertificateRequest has failureTime but no Ready condition Pull request #9287
- Registered acmesolver logging flags so they can be configured Pull request #9358
- Bumped Pebble in release-1.21 to fix ACME e2e test deadlock Pull request #9416
- Applied server-side apply in release-1.21 private key rotation tests to reduce flakiness Pull request #9386
- Applied server-side apply in release-1.20 private key rotation tests to reduce flakiness Pull request #9385
- Increased timing tolerance in CSR signing tests to reduce flakiness on loaded CI nodes Pull request #9247
This week: fixed certificates stuck in Issuing state, improved Helm chart proxy env var handling, made acmesolver logging configurable, and reduced test flakiness across releases.
This week's updates focus on reliability and configuration. We fixed an issue where certificates could get stuck in Issuing state when CertificateRequests failed, improved Helm chart rendering of proxy environment variables, made acmesolver logging flags actually configurable, and reduced flakiness in private key rotation and CSR signing tests across multiple release branches.
Week of September 14, 2026
What shipped
- Fixed a security issue where writing to a Certificate's status subresource allowed obtaining private keys from any TLS Secret in the namespace by pointing status.nextPrivateKeySecretName at an unowned Secret. Pull request #9224
- Backported fix to v1.21.3 ensuring cert-manager only consumes private key Secrets owned by the Certificate resource. Pull request #9368
- Backported ACME ARI certificate ID status fix to v1.21.2. Pull request #9292
- Released v1.20.4 with Go and dependency updates for security vulnerabilities and a fix for ingress-shim removing applyset labels from cached Ingress and Gateway objects. Release
- Fixed elliptic curve parameter parsing with added unit tests. Pull request #9294
- Improved error wrapping across 13 files to use %w format specifier instead of %s, enabling proper error chain inspection with errors.Is() and errors.As(). Pull request #9079
- Added test coverage for Helm chart PodMonitor metrics selector values and container port configurations. Pull request #9367
- Fixed flaking Certificate foreground deletion e2e tests. Pull request #9256
- Replaced reflect.DeepEqual usage in tests with more readable assertion patterns for better test failure output. Pull request #9333
Why it matters
This week includes a security fix for private key access control in Certificate status subresources, critical patches backported to maintenance branches, and improvements to error handling and test quality. These changes improve both the security posture and maintainability of cert-manager for production deployments.
Changelog entry
- Security: Fixed unauthorized private key access through Certificate status.nextPrivateKeySecretName by restricting consumption to Secrets owned by the Certificate Pull request #9224
- V1.20.4: Updated Go and dependencies for security fixes; fixed ingress-shim applyset label removal from cached Ingress and Gateway objects Release
- Fixed elliptic curve parameter parsing with unit tests Pull request #9294
- Improved error wrapping to use %w format specifier for proper error chain handling Pull request #9079
- Fixed flaking Certificate foreground deletion e2e tests Pull request #9256
Cert-manager updates: security fix for Certificate status subresource access, v1.20.4 released with dependency updates, elliptic curve parsing fixed, and improved error handling throughout the codebase.
This week's cert-manager updates address a security vulnerability in Certificate status subresource access control, release v1.20.4 with important security dependency updates and ingress-shim fixes, backports of ARI and private key ownership checks to maintenance branches, fixes for elliptic curve parameter parsing, and code quality improvements including better error wrapping and test assertions.