cert-manager

Update Helm release cert-manager to v1.20.3

No problems deploying cert-manager to Proxmox VE K3s Kubernetes cluster via Helm Chart and Flux V2 reconciliation in a GitOps approach with dependency update facilitated by Mend's Renovate Bot.

This MR contains the following updates:

Package	Update	Change
cert-manager (source)	patch	`v1.20.2` → `v1.20.3`

Release Notes

cert-manager/cert-manager (cert-manager)

`v1.20.3`

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

This patch release fixes a security issue (GHSA-8rvj-mm4h-c258, HIGH) where the default cert-manager-edit aggregate ClusterRole granted namespace users permission to create ACME Challenge and Order resources directly. A user who could create a Challenge referencing a ClusterIssuer could supply attacker-controlled solver configuration while cert-manager loaded credentials from the ClusterIssuer's namespace, bypassing Issuer solver selectors (dnsZones, dnsNames, matchLabels). With the acme-dns provider specifically, this could disclose DNS credentials to an attacker-controlled endpoint.

This release also removes the issuer owner reference from Challenges which was blocking Challenge garbage collection, and updates Go to fix reported CVEs.

All users should upgrade.

[!WARNING]
Potentially breaking change: The cert-manager-edit aggregate ClusterRole no longer grants create for challenges.acme.cert-manager.io or create, patch, update for orders.acme.cert-manager.io. These resources are internal to cert-manager's ACME workflow and are not intended to be created or modified directly by users. If you have tooling or workflows that create Challenge or Order resources directly (outside of the normal Certificate → CertificateRequest → Order → Challenge flow), you will need to grant those permissions explicitly.

Changes by Kind

Bug or Regression

Security (HIGH): Remove Challenge create and Order create, patch, update verbs from the cert-manager-edit aggregate ClusterRole (GHSA-8rvj-mm4h-c258). (#8940, @wallrj-cyberark)
Remove issuer owner reference from challenges blocking challenge garbage collection (#8759, @cert-manager-bot)

Other (Cleanup or Flake)

Bump go to 1.26.3, other deps to fix several govulncheck issues (#8789, @SgtCoDFish)
Update Go to v1.26.4 to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 (#8926, @wallrj-cyberark)

Update Helm release longhorn to v1.11.3

No problems deploying to Proxmox VE K3s Kubernetes cluster via Helm Chart and Flux V2 reconciliation in a GitOps approach. This MR contains the following updates: Package Update Change longhorn (source) patch 1.11.2 → 1.11.3 Release Notes longhorn/longhorn (longhorn) v1.11.3: Longhorn v1.11.3

Update docker.io/davidcrty/databasement Docker tag to v1.6.2

No problems upgrading the Docker container with a Docker compose yaml file by means of Watchtower DevOps resp. GitOps with dependency update facilitated by Mend's Renovate Bot. This MR contains the following updates: Package Update Change docker.io/davidcrty/databasement patch 1.6.1 → 1.6.2 Release

Update docker.io/nextcloud Docker tag to v34

Fully automated major upgrade by means of Watchtower Docker container management with dependency update facilitated by Mend's Renovate Bot. This MR contains the following updates: Package Update Change docker.io/nextcloud major 33.0.5-apache → 34.0.1-apache Release Notes nextcloud/server (docker.io/nextcloud) v34.

Update docker.io/ghost Docker tag to v6.50.0

On both domains I upgraded Ghost successfully by means of Watchtower Docker container update with dependency update facilitated by Mend's Renovate Bot. This MR contains the following updates: Package Update Change docker.io/ghost minor 6.49.0 → 6.50.0 Release Notes TryGhost/Ghost (docker.io/ghost)