volker.raschek/prometheus-x509-certificate-exporter-pkg
1
0
Fork 0
Code Issues 1 Pull Requests 1 Packages Projects Releases Wiki Activity

chore(deps): update dependency enix/x509-certificate-exporter to v4.2.0 #17

Open
CSRBot wants to merge 1 commits from renovate/enix-x509-certificate-exporter-4.x into master
pull from: renovate/enix-x509-certificate-exporter-4.x
merge into: :master
Conversation 0 Commits 1 Files Changed 1
+1 -1
CSRBot commented 2026-06-15 20:15:16 +02:00
Collaborator
Copy Link
Copy Source

This PR contains the following updates:

Package Update Change
enix/x509-certificate-exporter minor 4.0.0 → 4.2.0

Release Notes

enix/x509-certificate-exporter (enix/x509-certificate-exporter)

v4.2.0

Compare Source

⚠️ Breaking Changes

While not a new major version, this release ships significant changes that close issues inherited from the v3 → v4 jump. Please review your alerting chains after upgrading — silent regressions are possible, particularly around exporter health reporting.

  • Helm chart built-in Prometheus rules
    • The X509ExporterReadErrors alert has been broken since 4.0.0: the underlying metric was renamed from x509_read_errors to x509_source_errors_total, but the chart kept pointing at the old name. It is now replaced by SourceErrors and SourceErrorsSustained. See What's New.
    • Several keys under prometheusRules.* have been renamed. Affected users will see schema validation errors at upgrade time pointing to the keys that need adjustment.
  • The chart's JSON schema is now strict end-to-end: every key under values.yaml is explicitly declared and typed, and anything else — typos, removed fields, unexpected nested keys, wrong-type values like a string where a boolean is expected — is rejected by helm install / helm upgrade instead of silently ignored. Configurations that worked by accident in 4.0.x and 4.1.x will surface precise JSON-path errors at upgrade time and need cleaning up.

✨ What's New

This release closes implementation gaps in the supported certificate formats and broadens the surface of what can be observed inside a Kubernetes cluster.

  • DER format for single-blob certs and CRLs. Format detection is opt-in — declare format: der explicitly; the exporter will never probe formats automatically.
  • CRL monitoring from PEM blocks/bundles or single-blob DER sources, with a new x509_crl_* metric family (next_update, this_update, stale, etc.) and chart-shipped alerts CRLNeedsRefresh and CRLStale.
  • Kubernetes CABundle monitoring — a long-overdue source for the inline caBundle field of MutatingWebhookConfiguration, ValidatingWebhookConfiguration, APIService, and CRD conversion webhooks. Closes a frequent blind spot for control-plane operators.
  • Cross-Secret passphrase references for PKCS#12 and JKS/JCEKS via passphraseSecretRef. A promised but broken feature of 4.0.0, now with schema and end-to-end tests coverage.
  • JKS and JCEKS
    • JCEKS truststore/keystore support via a native parser (keystore-go rejected the JCEKS magic byte).
    • New metric x509_jks_passphrase_failures_total, and a chart alert KeystorePassphraseFailures that covers PKCS#12 too. It fires on bad_passphrase events from either x509_pkcs12_passphrase_failures_total (pre-existing) or x509_jks_passphrase_failures_total (new).
  • Glob patterns everywhere
    • Shell-style globs in include/exclude directives (namespaces, Secret names, ConfigMap names).
    • Glob and recursive ** patterns in hostPathsExporter.watchDirectories.
  • New observability metrics
    • x509_cert_collision_total keeps its existing "any collision detected" semantics; a sibling x509_cert_collision_dropped_total only increments under the Collision=Never policy and is the actual data-loss signal the chart now alerts on.
    • x509_kube_transport_errors_total with 5 reasons (list_failed, watch_start_failed, watch_error_event, watch_flapped, namespace_sync_failed). Closes the blind spot where the exporter could silently degrade on Kubernetes API issues with no metric to alert on.
  • New chart-shipped PrometheusRule alerts with opt-out toggles and sensible defaults.
    • SourceDown: source failed initial sync or stopped reporting (x509_source_up == 0) — common cause of silently expired certs.
    • KeystorePassphraseFailures: PKCS#12 or JKS/JCEKS decode failed with bad_passphrase — flags a misconfigured passphraseKey or passphraseSecretRef.
    • CertificateNotYetValid: notBefore is in the future — clock drift, misdated issuance, or a planned-future cert that shipped early.
    • CertificateCollision: at least one certificate was dropped because of a label collision under the Collision=Never policy.
    • KubeTransportErrors[Sustained]: two-band alert on x509_kube_transport_errors_total — warning at >5 transport errors in 15 minutes, critical once that condition has held for 30+ minutes.
    • SourceErrors[Sustained]: same two-band shape on x509_source_errors_total — catches sustained decode or transport failures aggregated across reasons.
  • Per-alert overrides for advanced setups.
    • alertExprOverrides: replace the default expr: of any built-in alert. Useful for multi-cluster deployments that need max by (cluster, …) aggregations or extra label filters without disabling the whole built-in group.
    • alertForOverrides: replace the default for: duration of any built-in alert. Validated against Prometheus's duration syntax.
  • Supply-chain transparency on container images — every published image now carries org.opencontainers.image.base.name and org.opencontainers.image.base.digest labels, surfacing the exact base image identity for downstream scanners.
  • Empty image.registry is now honoured properly — setting it to "" omits the registry segment from the rendered image reference, letting the container runtime fall back to its configured default (typically docker.io). Previously rendered an empty leading slash.

Changelog

Security Updates
Features
  • 5291d5a: feat: split collision counter metric into total + dropped (@​npdgm)
  • 52e9c2e: feat: emit x509_kube_transport_errors_total for LIST/WATCH/informer failures (@​npdgm)
  • ab1ce3a: feat(k8s): support shell-glob patterns in include/exclude names (@​npdgm)
  • 0f01346: feat(k8s, config): add jks.passphraseSecretRef for parity with pkcs12 (@​npdgm)
  • 0f8672e: feat(k8s, cmd): wire pkcs12 passphraseSecretRef end-to-end with API lookup (@​npdgm)
  • 176e25c: feat(registry): emit x509_crl_* metric family from Bundle.RevocationItems (@​npdgm)
  • 36aaf39: feat(registry): add x509_jks_passphrase_failures_total + format-aware routing (@​npdgm)
  • 19305f0: feat(config, cmd): wire format: jks + jks: passphrase block (@​npdgm)
  • fcc6dd2: feat(cert/pem): parse X509 CRL blocks into Bundle.RevocationItems (@​npdgm)
  • 7ce1092: feat(cert/der): parse single-blob DER as cert or CRL via x509 stdlib (@​npdgm)
  • 58b2ec8: feat(cert/jks): implement native JCEKS reader (keystore-go rejects JCEKS magic) (@​npdgm)
  • 3d571b6: feat(cert/jks): parse JKS and JCEKS keystores and truststores (@​npdgm)
  • 7610ca6: feat(cabundle): extend source to APIService and CRD conversion webhooks (@​npdgm)
  • 6f8d783: feat(source/cabundle): watch MWC + VWC caBundles cluster-wide (@​npdgm)
  • d73f3c0: feat(chart): per-alert expr and for overrides + render ratchet (@​npdgm)
  • ee273b4: feat(chart): add SourceDown, PassphraseFailures, NotYetValid, Collision alerts (@​npdgm)
  • 0eed4da: feat(chart, docs): expose jks.passphraseSecretRef in schema + examples (@​npdgm)
  • 9626e52: feat(chart): support glob and recursive (**) patterns in watchDirectories (@​npdgm)
  • 587d0f1: feat(chart): expose include/exclude secrets and configmaps by name (@​npdgm)
  • 830ca14: feat(chart): expose cluster-scoped cabundle exporter (opt-in) (@​npdgm)
  • 3bcafda: feat(chart): add jks format + jks: passphrase block to secretTypes schema (@​npdgm)
  • 9d4b97f: feat(chart): add CRLNeedsRefresh and CRLStale PrometheusRule alerts (@​npdgm)
Bug Fixes
  • 074db88: fix(k8s): trim only CR/LF from secret-sourced passphrases, not all whitespace (@​npdgm)
  • 17fb83c: fix(k8s): skip parse when passphraseKey absent and tryEmptyPassphrase false (@​npdgm)
  • cdf7ce8: fix(k8s): skip parse on passphraseSecretRef failure when tryEmptyPassphrase false (@​npdgm)
  • efe153a: fix(k8s,jks): preserve passphrase resolution cause, sort JKS aliases (@​npdgm)
  • e95dfcb: fix(log): drop source_kind from k8s base logger to avoid collision with SourceRef.Kind (@​npdgm)
  • e24b0e7: fix(log): debug log when passphraseKey is absent from secret data (@​npdgm)
  • 2958d64: fix(chart): omit registry segment when image.registry is empty (@​npdgm)
  • a782c9b: fix(chart): rename x509_read_errors to x509_source_errors_total and use increase() (@​npdgm)
  • 9d32abf: fix(chart): use backticks instead of double quotes in alert descriptions (@​npdgm)
  • a8c305e: fix(lint): pass ctx in onSecret test call sites (@​npdgm)
  • e69b3d0: fix(lint): contextcheck + gosec nosec + ineffassign + unconvert (@​npdgm)
  • 305a284: fix(e2e): clean up Docker network leak from k3d teardown (@​npdgm)
Documentation
  • 0e186d8: docs(README): announce support for DER and CRLs (@​npdgm)
  • a163963: docs(README, metrics): announce JKS/JCEKS support and x509_jks_passphrase_failures_total (@​npdgm)
  • 9b02f8f: docs(metrics): describe the x509_crl_* family (@​npdgm)
  • c6e9aec: docs(chart, metrics): document DER format and add a positive schema fixture (@​npdgm)
Other
  • 86fb1c1: test+docs(cabundle): e2e scenarios, README + metrics.md, opt-in example (@​npdgm)

v4.1.0

Compare Source

Changelog

Features
  • e4457ef: feat(chart): drop privileged from hostPathsExporter securityContext defaults (@​npdgm)
Bug Fixes
  • 8f1a1f9: fix(chart): preserve build metadata in pre-upgrade version detection (@​npdgm)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [enix/x509-certificate-exporter](https://github.com/enix/x509-certificate-exporter) | minor | `4.0.0` → `4.2.0` | --- ### Release Notes <details> <summary>enix/x509-certificate-exporter (enix/x509-certificate-exporter)</summary> ### [`v4.2.0`](https://github.com/enix/x509-certificate-exporter/releases/tag/v4.2.0) [Compare Source](https://github.com/enix/x509-certificate-exporter/compare/v4.1.0...v4.2.0) #### ⚠️ Breaking Changes While not a new major version, this release ships significant changes that close issues inherited from the v3 → v4 jump. Please review your alerting chains after upgrading — silent regressions are possible, particularly around exporter health reporting. - **Helm chart built-in Prometheus rules** - The `X509ExporterReadErrors` alert has been broken since 4.0.0: the underlying metric was renamed from `x509_read_errors` to `x509_source_errors_total`, but the chart kept pointing at the old name. It is now replaced by `SourceErrors` and `SourceErrorsSustained`. See *What's New*. - Several keys under `prometheusRules.*` have been renamed. Affected users will see schema validation errors at upgrade time pointing to the keys that need adjustment. - The **chart's JSON schema is now strict** end-to-end: every key under `values.yaml` is explicitly declared and typed, and anything else — typos, removed fields, unexpected nested keys, wrong-type values like a string where a boolean is expected — is rejected by `helm install` / `helm upgrade` instead of silently ignored. Configurations that worked by accident in 4.0.x and 4.1.x will surface precise JSON-path errors at upgrade time and need cleaning up. #### ✨ What's New This release closes implementation gaps in the supported certificate formats and broadens the surface of what can be observed inside a Kubernetes cluster. - **DER format** for single-blob certs and CRLs. Format detection is opt-in — declare `format: der` explicitly; the exporter will never probe formats automatically. - **CRL monitoring** from PEM blocks/bundles or single-blob DER sources, with a new `x509_crl_*` metric family (`next_update`, `this_update`, `stale`, etc.) and chart-shipped alerts `CRLNeedsRefresh` and `CRLStale`. - **Kubernetes CABundle monitoring** — a long-overdue source for the inline `caBundle` field of `MutatingWebhookConfiguration`, `ValidatingWebhookConfiguration`, `APIService`, and CRD conversion webhooks. Closes a frequent blind spot for control-plane operators. - **Cross-Secret passphrase references** for [PKCS#12](https://github.com/PKCS/x509-certificate-exporter/issues/12) and JKS/JCEKS via `passphraseSecretRef`. A promised but broken feature of 4.0.0, now with schema and end-to-end tests coverage. - **JKS and JCEKS** - JCEKS truststore/keystore support via a native parser (`keystore-go` rejected the JCEKS magic byte). - New metric `x509_jks_passphrase_failures_total`, and a chart alert `KeystorePassphraseFailures` that covers [PKCS#12](https://github.com/PKCS/x509-certificate-exporter/issues/12) too. It fires on `bad_passphrase` events from either `x509_pkcs12_passphrase_failures_total` (pre-existing) or `x509_jks_passphrase_failures_total` (new). - **Glob patterns everywhere** - Shell-style globs in `include/exclude` directives (namespaces, Secret names, ConfigMap names). - Glob and recursive `**` patterns in `hostPathsExporter.watchDirectories`. - **New observability metrics** - `x509_cert_collision_total` keeps its existing "any collision detected" semantics; a sibling `x509_cert_collision_dropped_total` only increments under the `Collision=Never` policy and is the actual data-loss signal the chart now alerts on. - `x509_kube_transport_errors_total` with 5 reasons (`list_failed`, `watch_start_failed`, `watch_error_event`, `watch_flapped`, `namespace_sync_failed`). Closes the blind spot where the exporter could silently degrade on Kubernetes API issues with no metric to alert on. - **New chart-shipped PrometheusRule alerts** with opt-out toggles and sensible defaults. - `SourceDown`: source failed initial sync or stopped reporting (`x509_source_up == 0`) — common cause of silently expired certs. - `KeystorePassphraseFailures`: [PKCS#12](https://github.com/PKCS/x509-certificate-exporter/issues/12) or JKS/JCEKS decode failed with `bad_passphrase` — flags a misconfigured `passphraseKey` or `passphraseSecretRef`. - `CertificateNotYetValid`: `notBefore` is in the future — clock drift, misdated issuance, or a planned-future cert that shipped early. - `CertificateCollision`: at least one certificate was dropped because of a label collision under the `Collision=Never` policy. - `KubeTransportErrors[Sustained]`: two-band alert on `x509_kube_transport_errors_total` — warning at >5 transport errors in 15 minutes, critical once that condition has held for 30+ minutes. - `SourceErrors[Sustained]`: same two-band shape on `x509_source_errors_total` — catches sustained decode or transport failures aggregated across reasons. - **Per-alert overrides** for advanced setups. - `alertExprOverrides`: replace the default `expr:` of any built-in alert. Useful for multi-cluster deployments that need `max by (cluster, …)` aggregations or extra label filters without disabling the whole built-in group. - `alertForOverrides`: replace the default `for:` duration of any built-in alert. Validated against Prometheus's duration syntax. - **Supply-chain transparency on container images** — every published image now carries `org.opencontainers.image.base.name` and `org.opencontainers.image.base.digest` labels, surfacing the exact base image identity for downstream scanners. - **Empty `image.registry`** is now honoured properly — setting it to `""` omits the registry segment from the rendered image reference, letting the container runtime fall back to its configured default (typically `docker.io`). Previously rendered an empty leading slash. #### Changelog ##### Security Updates - [`50ee4ab`](https://github.com/enix/x509-certificate-exporter/commit/50ee4ab72fb0a1b07d506bcfe463c12a0fa57ce5): security: update module golang.org/x/net to v0.55.0 \[security] ([@&#8203;enix-renovate](https://github.com/enix-renovate)\[bot]) - [`3c016bf`](https://github.com/enix/x509-certificate-exporter/commit/3c016bf0e381678a347af54026961cb516b2c38f): security: update module golang.org/x/crypto to v0.52.0 \[security] ([@&#8203;enix-renovate](https://github.com/enix-renovate)\[bot]) ##### Features - [`5291d5a`](https://github.com/enix/x509-certificate-exporter/commit/5291d5a9895f8c24ab1cbb10ceda12eeba7af256): feat: split collision counter metric into total + dropped ([@&#8203;npdgm](https://github.com/npdgm)) - [`52e9c2e`](https://github.com/enix/x509-certificate-exporter/commit/52e9c2e66c2637d8ad5c3f8d85c18b823b4a8015): feat: emit x509\_kube\_transport\_errors\_total for LIST/WATCH/informer failures ([@&#8203;npdgm](https://github.com/npdgm)) - [`ab1ce3a`](https://github.com/enix/x509-certificate-exporter/commit/ab1ce3ad77d18a59341756bdb1f1295500fd3de2): feat(k8s): support shell-glob patterns in include/exclude names ([@&#8203;npdgm](https://github.com/npdgm)) - [`0f01346`](https://github.com/enix/x509-certificate-exporter/commit/0f013463a693a5e9cb6e24fb9bb554247ed6a38b): feat(k8s, config): add jks.passphraseSecretRef for parity with pkcs12 ([@&#8203;npdgm](https://github.com/npdgm)) - [`0f8672e`](https://github.com/enix/x509-certificate-exporter/commit/0f8672e9aaff8a872f29518b343e7a69bd165c59): feat(k8s, cmd): wire pkcs12 passphraseSecretRef end-to-end with API lookup ([@&#8203;npdgm](https://github.com/npdgm)) - [`176e25c`](https://github.com/enix/x509-certificate-exporter/commit/176e25ce1f6fd8dee0af03dcd513884ed4ff9327): feat(registry): emit x509\_crl\_\* metric family from Bundle.RevocationItems ([@&#8203;npdgm](https://github.com/npdgm)) - [`36aaf39`](https://github.com/enix/x509-certificate-exporter/commit/36aaf393da45df65f4652c195a05d86633fd13fe): feat(registry): add x509\_jks\_passphrase\_failures\_total + format-aware routing ([@&#8203;npdgm](https://github.com/npdgm)) - [`19305f0`](https://github.com/enix/x509-certificate-exporter/commit/19305f077425e0c04e89baf8690d604f7d420a25): feat(config, cmd): wire format: jks + jks: passphrase block ([@&#8203;npdgm](https://github.com/npdgm)) - [`fcc6dd2`](https://github.com/enix/x509-certificate-exporter/commit/fcc6dd22055fa48d10481f6d67bd5a503b8c1768): feat(cert/pem): parse X509 CRL blocks into Bundle.RevocationItems ([@&#8203;npdgm](https://github.com/npdgm)) - [`7ce1092`](https://github.com/enix/x509-certificate-exporter/commit/7ce10926935bacaa5439a346327a30631b7a6008): feat(cert/der): parse single-blob DER as cert or CRL via x509 stdlib ([@&#8203;npdgm](https://github.com/npdgm)) - [`58b2ec8`](https://github.com/enix/x509-certificate-exporter/commit/58b2ec8d2186ecc2ca29060f3b39ea2533d511c1): feat(cert/jks): implement native JCEKS reader (keystore-go rejects JCEKS magic) ([@&#8203;npdgm](https://github.com/npdgm)) - [`3d571b6`](https://github.com/enix/x509-certificate-exporter/commit/3d571b6de39450355904e56ca96cb368d75b0283): feat(cert/jks): parse JKS and JCEKS keystores and truststores ([@&#8203;npdgm](https://github.com/npdgm)) - [`7610ca6`](https://github.com/enix/x509-certificate-exporter/commit/7610ca68fee8c96338b7fae15f9e0b67a0bc5b0b): feat(cabundle): extend source to APIService and CRD conversion webhooks ([@&#8203;npdgm](https://github.com/npdgm)) - [`6f8d783`](https://github.com/enix/x509-certificate-exporter/commit/6f8d78396a8ae3ffe56a2e1b68cc74048f5cc1ee): feat(source/cabundle): watch MWC + VWC caBundles cluster-wide ([@&#8203;npdgm](https://github.com/npdgm)) - [`d73f3c0`](https://github.com/enix/x509-certificate-exporter/commit/d73f3c0c764d912e2c556424a44c828ac3586112): feat(chart): per-alert expr and for overrides + render ratchet ([@&#8203;npdgm](https://github.com/npdgm)) - [`ee273b4`](https://github.com/enix/x509-certificate-exporter/commit/ee273b4b044bf1f96d928a44515621bc3c106f95): feat(chart): add SourceDown, PassphraseFailures, NotYetValid, Collision alerts ([@&#8203;npdgm](https://github.com/npdgm)) - [`0eed4da`](https://github.com/enix/x509-certificate-exporter/commit/0eed4da25d10472fc103e205a500b8b44df1839e): feat(chart, docs): expose jks.passphraseSecretRef in schema + examples ([@&#8203;npdgm](https://github.com/npdgm)) - [`9626e52`](https://github.com/enix/x509-certificate-exporter/commit/9626e52baf1b14b84e96522ffd8776c5c3bf6c65): feat(chart): support glob and recursive (\*\*) patterns in watchDirectories ([@&#8203;npdgm](https://github.com/npdgm)) - [`587d0f1`](https://github.com/enix/x509-certificate-exporter/commit/587d0f158978f97865ba2dc0b1e152e4ef7ab600): feat(chart): expose include/exclude secrets and configmaps by name ([@&#8203;npdgm](https://github.com/npdgm)) - [`830ca14`](https://github.com/enix/x509-certificate-exporter/commit/830ca14902262cfb1008812e1dc1081b39f17c14): feat(chart): expose cluster-scoped cabundle exporter (opt-in) ([@&#8203;npdgm](https://github.com/npdgm)) - [`3bcafda`](https://github.com/enix/x509-certificate-exporter/commit/3bcafda799f5466c9f56d47693f8659ba631b0a5): feat(chart): add jks format + jks: passphrase block to secretTypes schema ([@&#8203;npdgm](https://github.com/npdgm)) - [`9d4b97f`](https://github.com/enix/x509-certificate-exporter/commit/9d4b97f1f141294bf86f0fa53166eda80253ad5b): feat(chart): add CRLNeedsRefresh and CRLStale PrometheusRule alerts ([@&#8203;npdgm](https://github.com/npdgm)) ##### Bug Fixes - [`074db88`](https://github.com/enix/x509-certificate-exporter/commit/074db8806a3651bbd436006f9355fa741d37ff10): fix(k8s): trim only CR/LF from secret-sourced passphrases, not all whitespace ([@&#8203;npdgm](https://github.com/npdgm)) - [`17fb83c`](https://github.com/enix/x509-certificate-exporter/commit/17fb83c174215d4e96f02c89baaa1e8bd860543d): fix(k8s): skip parse when passphraseKey absent and tryEmptyPassphrase false ([@&#8203;npdgm](https://github.com/npdgm)) - [`cdf7ce8`](https://github.com/enix/x509-certificate-exporter/commit/cdf7ce8e460475fb51f920f9081d2677a8052cca): fix(k8s): skip parse on passphraseSecretRef failure when tryEmptyPassphrase false ([@&#8203;npdgm](https://github.com/npdgm)) - [`efe153a`](https://github.com/enix/x509-certificate-exporter/commit/efe153a148465871a89e12a77f6e093d8e9a9bb7): fix(k8s,jks): preserve passphrase resolution cause, sort JKS aliases ([@&#8203;npdgm](https://github.com/npdgm)) - [`e95dfcb`](https://github.com/enix/x509-certificate-exporter/commit/e95dfcb0bfff02fabc47a614ec2c1b5e929638ec): fix(log): drop source\_kind from k8s base logger to avoid collision with SourceRef.Kind ([@&#8203;npdgm](https://github.com/npdgm)) - [`e24b0e7`](https://github.com/enix/x509-certificate-exporter/commit/e24b0e735475f9e1be7761c77ac869a2ebb02024): fix(log): debug log when passphraseKey is absent from secret data ([@&#8203;npdgm](https://github.com/npdgm)) - [`2958d64`](https://github.com/enix/x509-certificate-exporter/commit/2958d64ecd733ed5b0ad8e6c8da29917fef2f8b3): fix(chart): omit registry segment when image.registry is empty ([@&#8203;npdgm](https://github.com/npdgm)) - [`a782c9b`](https://github.com/enix/x509-certificate-exporter/commit/a782c9b20d0d879e079d986f1243948061646cc9): fix(chart): rename x509\_read\_errors to x509\_source\_errors\_total and use increase() ([@&#8203;npdgm](https://github.com/npdgm)) - [`9d32abf`](https://github.com/enix/x509-certificate-exporter/commit/9d32abf486a45ff3dfc2d6177a36e1bc2a244012): fix(chart): use backticks instead of double quotes in alert descriptions ([@&#8203;npdgm](https://github.com/npdgm)) - [`a8c305e`](https://github.com/enix/x509-certificate-exporter/commit/a8c305ed828335b603813a846e097914f8db608c): fix(lint): pass ctx in onSecret test call sites ([@&#8203;npdgm](https://github.com/npdgm)) - [`e69b3d0`](https://github.com/enix/x509-certificate-exporter/commit/e69b3d0172dcf6988a1683f33ad961ae6ba3c103): fix(lint): contextcheck + gosec nosec + ineffassign + unconvert ([@&#8203;npdgm](https://github.com/npdgm)) - [`305a284`](https://github.com/enix/x509-certificate-exporter/commit/305a28419cc5d2a24cd32784c3ba7854f5ea9bfe): fix(e2e): clean up Docker network leak from k3d teardown ([@&#8203;npdgm](https://github.com/npdgm)) ##### Documentation - [`0e186d8`](https://github.com/enix/x509-certificate-exporter/commit/0e186d805993d621265bc6f1d36620a6ad631230): docs(README): announce support for DER and CRLs ([@&#8203;npdgm](https://github.com/npdgm)) - [`a163963`](https://github.com/enix/x509-certificate-exporter/commit/a163963eeb465f2d6476ef489b5c53c10eb8a4d5): docs(README, metrics): announce JKS/JCEKS support and x509\_jks\_passphrase\_failures\_total ([@&#8203;npdgm](https://github.com/npdgm)) - [`9b02f8f`](https://github.com/enix/x509-certificate-exporter/commit/9b02f8f7d4be058e6770f7d2aa0ae07d72eb93b6): docs(metrics): describe the x509\_crl\_\* family ([@&#8203;npdgm](https://github.com/npdgm)) - [`c6e9aec`](https://github.com/enix/x509-certificate-exporter/commit/c6e9aecf02df33542bd0904be6bfb30336b64c3b): docs(chart, metrics): document DER format and add a positive schema fixture ([@&#8203;npdgm](https://github.com/npdgm)) ##### Other - [`86fb1c1`](https://github.com/enix/x509-certificate-exporter/commit/86fb1c11b9b79964566fd5204aad2e5b6a9d6516): test+docs(cabundle): e2e scenarios, README + metrics.md, opt-in example ([@&#8203;npdgm](https://github.com/npdgm)) ### [`v4.1.0`](https://github.com/enix/x509-certificate-exporter/releases/tag/v4.1.0) [Compare Source](https://github.com/enix/x509-certificate-exporter/compare/v4.0.0...v4.1.0) #### Changelog ##### Features - [`e4457ef`](https://github.com/enix/x509-certificate-exporter/commit/e4457ef2c35abf886fb4798e3a40a5584b6b7d01): feat(chart): drop privileged from hostPathsExporter securityContext defaults ([@&#8203;npdgm](https://github.com/npdgm)) ##### Bug Fixes - [`8f1a1f9`](https://github.com/enix/x509-certificate-exporter/commit/8f1a1f95856810403f4c3798beb3522d7bb8e298): fix(chart): preserve build metadata in pre-upgrade version detection ([@&#8203;npdgm](https://github.com/npdgm)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMzYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjIzLjAiLCJ0YXJnZXRCcmFuY2giOiJtYXN0ZXIiLCJsYWJlbHMiOltdfQ==-->
volker.raschek was assigned by CSRBot 2026-06-15 20:15:17 +02:00
CSRBot added 1 commit 2026-08-06 02:14:50 +02:00
chore(deps): update dependency enix/x509-certificate-exporter to v4.2.0 d130556b2b
CSRBot force-pushed renovate/enix-x509-certificate-exporter-4.x from c7df394d55 to d130556b2b 2026-08-06 02:14:50 +02:00 Compare
CSRBot changed title from chore(deps): update dependency enix/x509-certificate-exporter to v4.1.0 to chore(deps): update dependency enix/x509-certificate-exporter to v4.2.0 2026-08-06 02:14:51 +02:00
Some checks are pending
continuous-integration/drone/pr
Required
continuous-integration/drone/push
Required
Some required checks are missing.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/enix-x509-certificate-exporter-4.x:renovate/enix-x509-certificate-exporter-4.x
git checkout renovate/enix-x509-certificate-exporter-4.x
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
CSRBot (CSRBot) volker.raschek (Markus Pesch)
No Assignees volker.raschek
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: volker.raschek/prometheus-x509-certificate-exporter-pkg#17