fix(deps): update dependencies

[terraform-ibm-modules-ops]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
external-secrets		minor	1.0.0 -> 1.1.1
ghcr.io/external-secrets/external-secrets		minor	v1.0.0-ubi -> v1.1.1-ubi
github.com/gruntwork-io/terratest	require	minor	v0.53.0 -> v0.54.0
github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper	require	minor	v1.60.29 -> v1.61.3
go (source)	toolchain	patch	1.25.4 -> 1.25.5
go (source)	golang	minor	1.24.0 -> 1.25.5
ibm (source)	required_provider	minor	1.85.0 -> 1.86.0
kubernetes (source)	required_provider	major	2.38.0 -> 3.0.0
terraform-ibm-modules/base-ocp-vpc/ibm (source)	module	minor	3.73.2 -> 3.74.0
terraform-ibm-modules/common-utilities/ibm (source)	module	patch	1.3.0 -> 1.3.1
terraform-ibm-modules/iam-serviceid-apikey-secrets-manager/ibm (source)	module	patch	1.2.0 -> 1.2.1
terraform-ibm-modules/resource-group/ibm (source)	module	patch	1.4.0 -> 1.4.1
terraform-ibm-modules/secrets-manager-private-cert/ibm (source)	module	minor	1.8.1 -> 1.9.2
terraform-ibm-modules/secrets-manager-public-cert-engine/ibm (source)	module	minor	1.4.2 -> 1.6.1
terraform-ibm-modules/secrets-manager-public-cert/ibm (source)	module	minor	1.4.0 -> 1.5.1
terraform-ibm-modules/secrets-manager-secret-group/ibm (source)	module	patch	1.3.18 -> 1.3.20
terraform-ibm-modules/vpe-gateway/ibm (source)	module	patch	4.8.4 -> 4.8.5

---

Release Notes

external-secrets/external-secrets (external-secrets)

v1.1.1

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.1.1
Image: ghcr.io/external-secrets/external-secrets:v1.1.1-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.1.1-ubi-boringssl

What's Changed

General

• chore(chart): release helm chart 1.1.0 by @​Skarlso in #​5619
• docs: improve spec.md by exporting generator types by @​gusfcarvalho in #​5624
• chore(deps): remove sprig fork by @​Skarlso in #​5626
• fix: report 404 secrets correctly in Gitlab provider by @​alekc in #​5104
• docs(secretserver): update documentation to include Platform compatibility by @​DelineaSahilWankhede in #​5546
• docs: add llm policy by @​Skarlso in #​5649
• fix: pass in the token to the build and publish container by @​Skarlso in #​5651
• test(secretserver): improve test coverage for SecretServer provider by @​DelineaSahilWankhede in #​5641
• fix: docs pipeline by @​rkferreira in #​5663
• fix: modify the url of the remote to include the token by @​Skarlso in #​5664
• feat(helm): add dynamic labelSelector if not define in topologySpread… by @​fe80 in #​5065
• feat: Support retry settings for Doppler provider by @​maduonline in #​5608
• feat(beyondtrust): enable pushing secrets in BeyondTrust provider by @​btfhernandez in #​5586
• fix: correctly merge map fields during templating by @​Skarlso in #​5671
• fix: use patch instead of update for finalizers addition and removal by @​Skarlso in #​5670
• feat(oracle): implement SecretExists by @​anders-swanson in #​5672
• fix(security): create provider for webhook & fake by @​ShimonDarshan in #​5628
• fix: set client transport to use GitHub Enterprise URL by @​fred-gagnon in #​5662
• feat(generator): Password generator can generate and expose multiple passwords by @​Trojanekkk in #​5669
• fix: run check diff on main by @​Skarlso in #​5681
• feat: bitwardenServerSDKURL is required for bitwardensecretsmanager by @​budimanjojo in #​5679
• fix: update the refreshInterval formatting everywhere by @​Skarlso in #​5680
• clean: Update conjur-api-go; Disable credential storage by @​szh in #​5648
• fix: add live-reload to make docs.serve by @​gusfcarvalho in #​5676
• fix: remove cached artifacts after build by @​gusfcarvalho in #​5686
• fix(keepersecurity): properly handle fields key by @​pepordev in #​5674

Dependencies

• chore(deps): bump golang from d3f0cf7 to d3f0cf7 by @​dependabot[bot] in #​5630
• chore(deps): bump golang from 7419f54 to e174196 in /e2e by @​dependabot[bot] in #​5638
• chore(deps): bump zizmorcore/zizmor-action from 0.2.0 to 0.3.0 by @​dependabot[bot] in #​5637
• chore(deps): bump actions/setup-go from 6.0.0 to 6.1.0 by @​dependabot[bot] in #​5636
• chore(deps): bump anchore/sbom-action from 0.20.9 to 0.20.10 by @​dependabot[bot] in #​5635
• chore(deps): bump actions/create-github-app-token from 2.1.4 to 2.2.0 by @​dependabot[bot] in #​5634
• chore(deps): bump github/codeql-action from 4.31.3 to 4.31.4 by @​dependabot[bot] in #​5633
• chore(deps): bump aws-actions/configure-aws-credentials from f2964c7 to 4a54c24 by @​dependabot[bot] in #​5632
• chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 by @​dependabot[bot] in #​5631
• chore(deps): bump pymdown-extensions from 10.17.1 to 10.17.2 in /hack/api-docs by @​dependabot[bot] in #​5660
• chore(deps): bump softprops/action-gh-release from 2.4.2 to 2.5.0 by @​dependabot[bot] in #​5656
• chore(deps): bump actions/setup-python from 6.0.0 to 6.1.0 by @​dependabot[bot] in #​5657
• chore(deps): bump peter-evans/slash-command-dispatch from 4.0.0 to 5.0.0 by @​dependabot[bot] in #​5658
• chore(deps): bump hashicorp/setup-terraform from 4c5fdab to 712b439 by @​dependabot[bot] in #​5659

New Contributors

• @​fe80 made their first contribution in #​5065
• @​maduonline made their first contribution in #​5608
• @​fred-gagnon made their first contribution in #​5662
• @​Trojanekkk made their first contribution in #​5669
• @​budimanjojo made their first contribution in #​5679

Full Changelog: external-secrets/external-secrets@v1.1.0...v1.1.1

v1.1.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.1.0
Image: ghcr.io/external-secrets/external-secrets:v1.1.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.1.0-ubi-boringssl

What's Changed

!NOTE!: During last community meeting we discussed that we are retiring our scarf account. With that, we will be changing back to ghcr.io/external-secrets/external-secrets instead of oci.external-secrets.io/external-secrets/external-secrets.

For now, the old domain will live for a couple months to give people to change back. With this release , the values in the helm chart that define where the image is switched back to ghcr.

The helm-chart itself is served from under github-pages so that does not move.

General

• chore(chart): release helm chart 1.0.0 by @​Skarlso in #​5552
• feat(security): add support for ECDSA ssh keys by @​bigjazzsound in #​5559
• fix: minor typo in comment of KeeperSecurity example by @​mdjong1 in #​5573
• docs(gcp): update documentation for using WorkloadIdentityFederation in non-GKE cluster by @​jennweir in #​5556
• chore(release): add darwin_arm64 releases by @​lbordowitz in #​5583
• feat: support override IAM endpoint in IBM provider for APIkey auth by @​fidel-ruiz in #​5550
• feat(security): build tags for all the providers to disable them on d… by @​ShimonDarshan in #​5578
• fix: do not include the last element of the path in the iteration by @​Skarlso in #​5588
• fix(k8s): support deleting whole secret by @​tiagolobocastro in #​5538
• fix(provider): configure TLS for secret server provider by @​Lumexralph in #​5558
• chore(aws): remove any usage of aws-sdk-v1 by @​Skarlso in #​5590
• fix(gcp): check for secret version exists in PushSecret by @​bpalko in #​5593
• feat(vault): add GCP Workload Identity authentication support by @​SamuelMolling in #​5356
• chore: fix sonar cloud issues by @​Skarlso in #​5405
• chore(aws-sdk-v2): update dependencies to accept new aws regions by @​damienpuig in #​5577
• feat(chart): use ghcr.io instead of our own domain by @​evrardjp in #​5617

Dependencies

• chore(deps): bump golang from 1.25.3 to 1.25.4 by @​dependabot[bot] in #​5560
• chore(deps): bump golang from 1.25.3-bookworm to 1.25.4-bookworm in /e2e by @​dependabot[bot] in #​5568
• chore(deps): bump step-security/harden-runner from 2.13.1 to 2.13.2 by @​dependabot[bot] in #​5561
• chore(deps): bump softprops/action-gh-release from 2.4.1 to 2.4.2 by @​dependabot[bot] in #​5564
• chore(deps): bump helm/chart-testing-action from 2.7.0 to 2.8.0 by @​dependabot[bot] in #​5565
• chore(deps): bump aws-actions/configure-aws-credentials from 0d00a56 to 2475ef7 by @​dependabot[bot] in #​5562
• chore(deps): bump helm/kind-action from 1.12.0 to 1.13.0 by @​dependabot[bot] in #​5563
• chore(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 by @​dependabot[bot] in #​5567
• chore(deps): bump regex from 2025.10.23 to 2025.11.3 in /hack/api-docs by @​dependabot[bot] in #​5570
• chore(deps): bump markdown from 3.9 to 3.10 in /hack/api-docs by @​dependabot[bot] in #​5569
• chore(deps): bump hashicorp/setup-terraform from 982f6f0 to 4c5fdab by @​dependabot[bot] in #​5566
• chore(deps): bump golang from d3f0cf7 to d3f0cf7 by @​dependabot[bot] in #​5595
• chore(deps): bump github/codeql-action from 4.31.2 to 4.31.3 by @​dependabot[bot] in #​5596
• chore(deps): bump click from 8.3.0 to 8.3.1 in /hack/api-docs by @​dependabot[bot] in #​5602
• chore(deps): bump ubi9/ubi from dec374e to dcd8128 by @​dependabot[bot] in #​5594
• chore(deps): bump aws-actions/configure-aws-credentials from 2475ef7 to f2964c7 by @​dependabot[bot] in #​5597
• chore(deps): bump actions/dependency-review-action from 4.8.1 to 4.8.2 by @​dependabot[bot] in #​5598
• chore(deps): bump pymdown-extensions from 10.16.1 to 10.17.1 in /hack/api-docs by @​dependabot[bot] in #​5599
• chore(deps): bump certifi from 2025.10.5 to 2025.11.12 in /hack/api-docs by @​dependabot[bot] in #​5600
• chore(deps): bump mkdocs-material from 9.6.23 to 9.7.0 in /hack/api-docs by @​dependabot[bot] in #​5601
• chore(deps): bump mkdocs-macros-plugin from 1.4.1 to 1.5.0 in /hack/api-docs by @​dependabot[bot] in #​5603

New Contributors

• @​bigjazzsound made their first contribution in #​5559
• @​mdjong1 made their first contribution in #​5573
• @​jennweir made their first contribution in #​5556
• @​lbordowitz made their first contribution in #​5583
• @​fidel-ruiz made their first contribution in #​5550
• @​ShimonDarshan made their first contribution in #​5578
• @​bpalko made their first contribution in #​5593
• @​SamuelMolling made their first contribution in #​5356
• @​damienpuig made their first contribution in #​5577

Full Changelog: external-secrets/external-secrets@v1.0.0...v1.1.0

gruntwork-io/terratest (github.com/gruntwork-io/terratest)

v0.54.0

Compare Source

What's Changed

• Fix TerragruntArgs and TerraformArgs being ignored by @​james00012 in #​1617
• Simplify terragrunt function names by @​james00012 in #​1621
• Refactor: Extract formatting utilities to internal/lib by @​james00012 in #​1620
• Bump golang.org/x/crypto from 0.41.0 to 0.45.0 by @​dependabot[bot] in #​1625
• Add missing terragrunt commands: ValidateAll, RunAll, FormatAll, OutputListAll by @​james00012 in #​1622
• Upgrade terragrunt module tests to v0.93.10 by @​james00012 in #​1627

Full Changelog: gruntwork-io/terratest@v0.53.0...v0.54.0

terraform-ibm-modules/ibmcloud-terratest-wrapper (github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper)

v1.61.3

Compare Source

Bug Fixes

• deps: update dependency go to v1.25.5 (#​1089) (06cc2da)

v1.61.2

Compare Source

Bug Fixes

• Fixing addon test teardown messages (#​1087) (76ce4d8)

v1.61.1

Compare Source

Bug Fixes

• identify and list missing members (#​1086) (89a9519)

v1.61.0

Compare Source

Features

• support netrc auth and refactor git auth (#​1084) (8f19824)

v1.60.35

Compare Source

Bug Fixes

• cat type_metadata validaiton (#​1081) (9c89404)

v1.60.34

Compare Source

Bug Fixes

• deps: update dependencies (#​1078) (58feae3)

v1.60.33

Compare Source

Bug Fixes

• update region selector error message and add ssh troubleshooting docs (#​1082) (d4aa7b8)

v1.60.32

Compare Source

Bug Fixes

• guard against panic when configuration does not have a schematics workspace id (#​1080) (b2c9858)

v1.60.31

Compare Source

Bug Fixes

• set failure result correctly on deploy failure (#​1077) (0758d4a)

v1.60.30

Compare Source

Bug Fixes

• error on invalid offering flavour (#​1076) (f59aaf9)

IBM-Cloud/terraform-provider-ibm (ibm)

v1.86.0

Compare Source

Bug Fixes

Cloud Logs

• fix entity_label in logs_alert_Definition resource (6554)

AppConfig

• Fixing Issues in App Configuration Service (6545)

Global Catalog

• fixed import of ibm_cm_object (6553)
• renamed error variable for GlobalSearchV2 (6547)

IAM

• fix(ibm_iam_account_settings) when only updating user domain restrictions (6549)
• update trusted profile id policies to support both iam_id and profile_id (6543)

Power Systems

• Fix instance data sources to use id (6506)
• Refactor terraform errors to use new toolchain in network and route data sources (6552)

Schematics

• Fixed agent create crash (6570)

CIS

• handled nil pointer exceptions during runtime (6550)

Enhancements

VPC Infrastructure

• feat(vpn-gateway) - Add support for VPN Gateway as spoke of Transit Gateway (6546)
• updated the import for vpc resources (6548)

Resource Management

• added support for resource_groups datasource (6499)
• Added support for working with resource reclamations (6396)

DR Automation

• DR Automation Terraform Apis (6481)

Backup/Recovery

• Add instance and region update in connection token resource (6566)

Cloud Databases

• block unsupported Gen 2 plans with helpful validation message (6571)

Event Notification

• support for smtp user credentials clone (6535)

General

• bump actions/checkout from 5.0.0 to 5.0.1 (6556)
• bump golang.org/x/crypto from 0.41.0 to 0.45.0 (6562)
• bump bluemix-go (6574)

IAM

• add role templates & assignments (6539)

Transit Gateway

• tgw95 - vpn gateway changes (6339)

Documentation

General

• add provider-wide best practices section to CONTRIBUTING.md (6573)

Project

• regenerate projects provider with new go sdk level and API doc (6557)

hashicorp/terraform-provider-kubernetes (kubernetes)

v3.0.0

Compare Source

ENHANCEMENTS:

• • Add support for sidecar containers via restart_policy field in init_container spec [GH-2786]
• Add ip_mode attribute to service status [GH-2784]
• Add support for ValidatingAdmissionPolicy [GH-2794]
• Bump Kubernetes dependencies to v1.33 [GH-2774]

DEPRECATIONS:

• Data Sources

• kubernetes_config_map → use kubernetes_config_map_v1
• kubernetes_namespace → use kubernetes_namespace_v1
• kubernetes_secret → use kubernetes_secret_v1
• kubernetes_service → use kubernetes_service_v1
• kubernetes_pod → use kubernetes_pod_v1
• kubernetes_service_account → use kubernetes_service_account_v1
• kubernetes_persistent_volume_claim → use kubernetes_persistent_volume_claim_v1
• kubernetes_storage_class → use kubernetes_storage_class_v1
• kubernetes_ingress → use kubernetes_ingress_v1

Resources

• kubernetes_namespace → use kubernetes_namespace_v1
• kubernetes_service → use kubernetes_service_v1
• kubernetes_service_account → use kubernetes_service_account_v1
• kubernetes_default_service_account → use kubernetes_default_service_account_v1
• kubernetes_config_map → use kubernetes_config_map_v1
• kubernetes_secret → use kubernetes_secret_v1
• kubernetes_pod → use kubernetes_pod_v1
• kubernetes_endpoints → use kubernetes_endpoints_v1
• kubernetes_limit_range → use kubernetes_limit_range_v1
• kubernetes_persistent_volume → use kubernetes_persistent_volume_v1
• kubernetes_persistent_volume_claim → use kubernetes_persistent_volume_claim_v1
• kubernetes_replication_controller → use kubernetes_replication_controller_v1
• kubernetes_resource_quota → use kubernetes_resource_quota_v1
• kubernetes_api_service → use kubernetes_api_service_v1
• kubernetes_deployment → use kubernetes_deployment_v1
• kubernetes_daemonset → use kubernetes_daemon_set_v1
• kubernetes_stateful_set → use kubernetes_stateful_set_v1
• kubernetes_job → use kubernetes_job_v1
• kubernetes_cron_job → use kubernetes_cron_job_v1
• kubernetes_horizontal_pod_autoscaler → use kubernetes_horizontal_pod_autoscaler_v1 or kubernetes_horizontal_pod_autoscaler_v2
• kubernetes_certificate_signing_request → use kubernetes_certificate_signing_request_v1
• kubernetes_role → use kubernetes_role_v1
• kubernetes_role_binding → use kubernetes_role_binding_v1
• kubernetes_cluster_role → use kubernetes_cluster_role_v1
• kubernetes_cluster_role_binding → use kubernetes_cluster_role_binding_v1
• kubernetes_ingress → use kubernetes_ingress_v1
• kubernetes_ingress_class → use kubernetes_ingress_class_v1
• kubernetes_network_policy → use kubernetes_network_policy_v1
• kubernetes_pod_disruption_budget → use kubernetes_pod_disruption_budget_v1
• kubernetes_pod_security_policy → removed upstream; use Pod Security Admission instead
• kubernetes_priority_class → use kubernetes_priority_class_v1
• kubernetes_validating_webhook_configuration → use kubernetes_validating_webhook_configuration_v1
• kubernetes_mutating_webhook_configuration → use kubernetes_mutating_webhook_configuration_v1
• kubernetes_storage_class → use kubernetes_storage_class_v1
• kubernetes_csi_driver → use kubernetes_csi_driver_v1 [GH-2770]

BUG FIXES:

• Environment variables should not override configuration when using kubernetes_manifest. [GH-2788]
• resource/kubernetes_daemon_set_v1: fix an issue with the provider not waiting for rollout with wait_for_rollout = true. [GH-2789]

terraform-ibm-modules/terraform-ibm-base-ocp-vpc (terraform-ibm-modules/base-ocp-vpc/ibm)

v3.74.0

Compare Source

Features

• added support to install required binary jq and kubectl if they do not exist. This can be disabled using the install_required_binaries boolean. NOTE: public access is required to pull the binaries from the internet. The binaries will be placed in /tmp. (#​867) (7a7aad3)

v3.73.6

Compare Source

Bug Fixes

• binary widget minor fixes (#​877) (d9499e3)

v3.73.5

Compare Source

Bug Fixes

• deps: update terraform terraform-ibm-modules/secrets-manager-secret-group/ibm to v1.3.19 (#​881) (514d0ac)

v3.73.4

Compare Source

Bug Fixes

• deps: update dependencies (#​876) (4c782ad)

v3.73.3

Compare Source

Bug Fixes

• updated the validation logic used to validate OS (#​870) (794961f)

terraform-ibm-modules/terraform-ibm-common-utilities (terraform-ibm-modules/common-utilities/ibm)

v1.3.1

Compare Source

Bug Fixes

• deps: update dependencies (#​125) (fe515a2)

terraform-ibm-modules/terraform-ibm-iam-serviceid-apikey-secrets-manager (terraform-ibm-modules/iam-serviceid-apikey-secrets-manager/ibm)

v1.2.1

Compare Source

Bug Fixes

• deps: update dependencies (#​345) (761b270)

terraform-ibm-modules/terraform-ibm-resource-group (terraform-ibm-modules/resource-group/ibm)

v1.4.1

Compare Source

Bug Fixes

• deps: update dependencies (#​762) (9e7f05a)

terraform-ibm-modules/terraform-ibm-secrets-manager-private-cert (terraform-ibm-modules/secrets-manager-private-cert/ibm)

v1.9.2

Compare Source

Bug Fixes

• deps: update terraform terraform-ibm-modules/secrets-manager-secret-group/ibm to v1.3.19 (#​391) (4d356a1)

v1.9.1

Compare Source

Bug Fixes

• deps: update dependencies (#​386) (1f75d1b)

v1.9.0

Compare Source

Features

• renamed the service_endpoints input to endpoint_type (#​385) (6aa2443)

terraform-ibm-modules/terraform-ibm-secrets-manager-public-cert-engine (terraform-ibm-modules/secrets-manager-public-cert-engine/ibm)

v1.6.1

Compare Source

Bug Fixes

• deps: update dependencies (#​296) (d81c8fe)

v1.6.0

Compare Source

Features

• renamed the service_endpoints input to endpoint_type (#​298) (cd33d56)

[v1.5.0](ht

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[terraform-ibm-modules-dev]

/run pipeline

[terraform-ibm-modules-ops]

ℹ Artifact update notice

File name: tests/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 11 additional dependencies were updated

Details:

Package	Change
github.com/IBM-Cloud/power-go-client	v1.13.0 -> v1.14.3
github.com/IBM/go-sdk-core/v5	v5.21.0 -> v5.21.2
github.com/IBM/platform-services-go-sdk	v0.90.0 -> v0.90.4
github.com/IBM/project-go-sdk	v0.3.9 -> v0.4.0
github.com/gabriel-vasile/mimetype	v1.4.9 -> v1.4.11
github.com/go-git/go-git/v5	v5.16.3 -> v5.16.4
github.com/go-playground/validator/v10	v10.26.0 -> v10.28.0
github.com/hashicorp/go-retryablehttp	v0.7.7 -> v0.7.8
go.yaml.in/yaml/v2	v2.4.2 -> v2.4.3
golang.org/x/crypto	v0.44.0 -> v0.45.0
golang.org/x/net	v0.46.0 -> v0.47.0

[terraform-ibm-modules-dev]

/run pipeline

[terraform-ibm-modules-dev]

/run pipeline

[terraform-ibm-modules-dev]

/run pipeline

[terraform-ibm-modules-dev]

/run pipeline

[terraform-ibm-modules-dev]

/run pipeline

[terraform-ibm-modules-dev]

/run pipeline

[terraform-ibm-modules-dev]

/run pipeline

[terraform-ibm-modules-dev]

/run pipeline

[terraform-ibm-modules-dev]

/run pipeline

[terraform-ibm-modules-dev]

/run pipeline

[terraform-ibm-modules-dev]

/run pipeline

[terraform-ibm-modules-dev]

/run pipeline

[terraform-ibm-modules-dev]

/run pipeline

[terraform-ibm-modules-dev]

/run pipeline

[terraform-ibm-modules-dev]

/run pipeline

[terraform-ibm-modules-dev]

/run pipeline

[terraform-ibm-modules-dev]

/run pipeline

[terraform-ibm-modules-dev]

/run pipeline