AverageMarcus/cluster.fun
1
0
Fork 0
Code Issues 1 Pull Requests 4 Releases Activity

Update registry.k8s.io/kube-state-metrics/kube-state-metrics Docker tag to v2.19.0 #711

Merged
AverageMarcus merged 1 commits from renovate/registry.k8s.io-kube-state-metrics-kube-state-metrics-2.x into master 2026-05-23 10:29:34 +00:00
Conversation 0 Commits 1 Files Changed 1
+1 -1
renovate commented 2026-05-22 03:11:40 +00:00
Collaborator
Copy Link
Copy Source

This PR contains the following updates:

Package Update Change
registry.k8s.io/kube-state-metrics/kube-state-metrics minor v2.18.0 → v2.19.0

Release Notes

kubernetes/kube-state-metrics (registry.k8s.io/kube-state-metrics/kube-state-metrics)

v2.19.0

Compare Source

v2.19.0 / 2026-05-05

Notes
The v2.19.0 tag was force-moved from it's original commit (b18fbda) to the one succeeding it (2ef2454) to address an issue in KSM's image promotion; see #​2964 for more information.

This release addresses a security vulnerability (GHSA-g3c8-4qh2-rhrg) where /debug/pprof/* endpoints were not protected by the --auth-filter flag. The endpoints have been moved to the telemetry server and are now correctly gated. See #​2924 for details. Credits to @​vldevadath for responsible disclosure.

  • This release builds with Go v1.26.2
  • This release builds with k8s.io/client-go: v0.35.4
Changelog
Full Changelog

New Contributors

Full Changelog: https://github.com/kubernetes/kube-state-metrics/compare/v2.18.0...v2.19.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [registry.k8s.io/kube-state-metrics/kube-state-metrics](https://github.com/kubernetes/kube-state-metrics) | minor | `v2.18.0` → `v2.19.0` | --- ### Release Notes <details> <summary>kubernetes/kube-state-metrics (registry.k8s.io/kube-state-metrics/kube-state-metrics)</summary> ### [`v2.19.0`](https://github.com/kubernetes/kube-state-metrics/releases/tag/v2.19.0) [Compare Source](https://github.com/kubernetes/kube-state-metrics/compare/v2.18.0...v2.19.0) #### v2.19.0 / 2026-05-05 ##### Notes ##### The v2.19.0 tag was force-moved from it's original commit ([`b18fbda`](https://github.com/kubernetes/kube-state-metrics/commit/b18fbda7881baa84f6cf51dff2a727191b58d049)) to the one succeeding it ([`2ef2454`](https://github.com/kubernetes/kube-state-metrics/commit/2ef24549bff9865db214ccb03cc36f1fc214d1be)) to address an issue in KSM's image promotion; see [#&#8203;2964](https://github.com/kubernetes/kube-state-metrics/pull/2964) for more information. This release addresses a security vulnerability (GHSA-g3c8-4qh2-rhrg) where `/debug/pprof/*` endpoints were not protected by the `--auth-filter` flag. The endpoints have been moved to the telemetry server and are now correctly gated. See [#&#8203;2924](https://github.com/kubernetes/kube-state-metrics/pull/2924) for details. Credits to [@&#8203;vldevadath](https://github.com/vldevadath) for responsible disclosure. - This release builds with Go `v1.26.2` - This release builds with `k8s.io/client-go`: `v0.35.4` ##### Changelog - \[SECURITY] Fix authentication bypass: move pprof endpoints to telemetry server and protect with auth filter (GHSA-g3c8-4qh2-rhrg) by [@&#8203;bhope](https://github.com/bhope) in [#&#8203;2924](https://github.com/kubernetes/kube-state-metrics/pull/2924) - \[SECURITY] Bump `go-jose/v4` to `v4.1.4` for CVE-2026-34986 by [@&#8203;marioferh](https://github.com/marioferh) in [#&#8203;2941](https://github.com/kubernetes/kube-state-metrics/pull/2941) - \[SECURITY] Fix CVE-2026-24051 in otel go library by [@&#8203;marvin659](https://github.com/marvin659) in [#&#8203;2908](https://github.com/kubernetes/kube-state-metrics/pull/2908) - \[SECURITY] Fix CVE-2026-39883 in otel go library by [@&#8203;Dinesh-Jilagam](https://github.com/Dinesh-Jilagam) in [#&#8203;2952](https://github.com/kubernetes/kube-state-metrics/pull/2952) - \[SECURITY] Bump `google.golang.org/grpc` to `v1.79.3` by [@&#8203;sturman](https://github.com/sturman) in [#&#8203;2925](https://github.com/kubernetes/kube-state-metrics/pull/2925) - \[FEATURE] Add `PreemptionByScheduler` and `TerminationByKubelet` to `kube_pod_status_reason` by [@&#8203;bhope](https://github.com/bhope) in [#&#8203;2892](https://github.com/kubernetes/kube-state-metrics/pull/2892) - \[FEATURE] Add `SchedulingGated` to `kube_pod_status_reason` by [@&#8203;bhope](https://github.com/bhope) in [#&#8203;2880](https://github.com/kubernetes/kube-state-metrics/pull/2880) - \[FEATURE] Add `container` label to HPA ContainerResource metrics by [@&#8203;bxrne](https://github.com/bxrne) in [#&#8203;2836](https://github.com/kubernetes/kube-state-metrics/pull/2836) - \[FEATURE] Add deployment-based sharding example by [@&#8203;ystkfujii](https://github.com/ystkfujii) in [#&#8203;2931](https://github.com/kubernetes/kube-state-metrics/pull/2931) - \[BUGFIX] Handle DeletedFinalStateUnknown panic in CR informer by [@&#8203;rexagod](https://github.com/rexagod) in [#&#8203;2955](https://github.com/kubernetes/kube-state-metrics/pull/2955) - \[BUGFIX] Fix memory leak from orphaned CR reflector goroutines on repeated CRD discovery by [@&#8203;bhope](https://github.com/bhope) in [#&#8203;2920](https://github.com/kubernetes/kube-state-metrics/pull/2920) - \[BUGFIX] Load CRS config when `--continue-without-custom-resource-state-config-file` is set and file exists by [@&#8203;ybouhachem](https://github.com/ybouhachem) in [#&#8203;2918](https://github.com/kubernetes/kube-state-metrics/pull/2918) - \[BUGFIX] Accept legacy `custom_resource_config_file` as deprecated alias by [@&#8203;nmn3m](https://github.com/nmn3m) in [#&#8203;2926](https://github.com/kubernetes/kube-state-metrics/pull/2926) - \[BUGFIX] Fix order-dependent metric loss from header deduplication by [@&#8203;jfremy-openai](https://github.com/jfremy-openai) in [#&#8203;2866](https://github.com/kubernetes/kube-state-metrics/pull/2866) - \[BUGFIX] Avoid mutating metric families during write by [@&#8203;bhope](https://github.com/bhope) in [#&#8203;2852](https://github.com/kubernetes/kube-state-metrics/pull/2852) - \[BUGFIX] Honor `stderrthreshold` when `logtostderr` is enabled by [@&#8203;pierluigilenoci](https://github.com/pierluigilenoci) in [#&#8203;2906](https://github.com/kubernetes/kube-state-metrics/pull/2906) - \[ENHANCEMENT] Bump to Kubernetes 1.35 by [@&#8203;mrueg](https://github.com/mrueg) in [#&#8203;2861](https://github.com/kubernetes/kube-state-metrics/pull/2861) - \[ENHANCEMENT] Build with Go 1.26 by [@&#8203;mrueg](https://github.com/mrueg) in [#&#8203;2890](https://github.com/kubernetes/kube-state-metrics/pull/2890) - \[ENHANCEMENT] Switch to a maintained fork of `robfig/cron` by [@&#8203;mrueg](https://github.com/mrueg) in [#&#8203;2874](https://github.com/kubernetes/kube-state-metrics/pull/2874) ##### Full Changelog - chore: Merge `release-2.18` back into `main` by [@&#8203;rexagod](https://github.com/rexagod) in [#&#8203;2850](https://github.com/kubernetes/kube-state-metrics/pull/2850) - chore: Define golang version in a single file by [@&#8203;mrueg](https://github.com/mrueg) in [#&#8203;2853](https://github.com/kubernetes/kube-state-metrics/pull/2853) - build(deps): Bump actions/setup-go from 6.1.0 to 6.2.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2858](https://github.com/kubernetes/kube-state-metrics/pull/2858) - build(deps): Bump actions/checkout from 6.0.1 to 6.0.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2859](https://github.com/kubernetes/kube-state-metrics/pull/2859) - docs: Fix typo in scheduler metrics names by [@&#8203;dgrisonnet](https://github.com/dgrisonnet) in [#&#8203;2862](https://github.com/kubernetes/kube-state-metrics/pull/2862) - fix: tests/e2e - derive image tag using docker --format by [@&#8203;bhope](https://github.com/bhope) in [#&#8203;2875](https://github.com/kubernetes/kube-state-metrics/pull/2875) - build(deps): Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2877](https://github.com/kubernetes/kube-state-metrics/pull/2877) - build(deps): Bump actions/setup-go from 6.2.0 to 6.3.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2881](https://github.com/kubernetes/kube-state-metrics/pull/2881) - docs: add code reviews section by [@&#8203;mrueg](https://github.com/mrueg) in [#&#8203;2888](https://github.com/kubernetes/kube-state-metrics/pull/2888) - chore(Dockerfile): Use Debian 13 as base by [@&#8203;mrueg](https://github.com/mrueg) in [#&#8203;2855](https://github.com/kubernetes/kube-state-metrics/pull/2855) - chore: Drop embedmd in favor of gomplate by [@&#8203;mrueg](https://github.com/mrueg) in [#&#8203;2871](https://github.com/kubernetes/kube-state-metrics/pull/2871) - chore: Bump to kubernetes 1.35 by [@&#8203;mrueg](https://github.com/mrueg) in [#&#8203;2861](https://github.com/kubernetes/kube-state-metrics/pull/2861) - chore: Switch to a maintained version for robfig/cron by [@&#8203;mrueg](https://github.com/mrueg) in [#&#8203;2874](https://github.com/kubernetes/kube-state-metrics/pull/2874) - feat: add SchedulingGated to kube\_pod\_status\_reason by [@&#8203;bhope](https://github.com/bhope) in [#&#8203;2880](https://github.com/kubernetes/kube-state-metrics/pull/2880) - fix: order-dependent metric loss from header dedupe by [@&#8203;jfremy-openai](https://github.com/jfremy-openai) in [#&#8203;2866](https://github.com/kubernetes/kube-state-metrics/pull/2866) - chore: Build with go 1.26 by [@&#8203;mrueg](https://github.com/mrueg) in [#&#8203;2890](https://github.com/kubernetes/kube-state-metrics/pull/2890) - feat: add PreemptionByScheduler and TerminationByKubelet to kube\_pod\_status\_reason by [@&#8203;bhope](https://github.com/bhope) in [#&#8203;2892](https://github.com/kubernetes/kube-state-metrics/pull/2892) - chore: add [@&#8203;bhope](https://github.com/bhope) as a reviewer by [@&#8203;bhope](https://github.com/bhope) in [#&#8203;2897](https://github.com/kubernetes/kube-state-metrics/pull/2897) - chore: add [@&#8203;nmn3m](https://github.com/nmn3m) as a reviewer by [@&#8203;nmn3m](https://github.com/nmn3m) in [#&#8203;2900](https://github.com/kubernetes/kube-state-metrics/pull/2900) - fix: CVE-2026-24051 security fix on otel go library by [@&#8203;marvin659](https://github.com/marvin659) in [#&#8203;2908](https://github.com/kubernetes/kube-state-metrics/pull/2908) - fix: honor stderrthreshold when logtostderr is enabled by [@&#8203;pierluigilenoci](https://github.com/pierluigilenoci) in [#&#8203;2906](https://github.com/kubernetes/kube-state-metrics/pull/2906) - build(deps): Bump actions/setup-go from 6.3.0 to 6.4.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2911](https://github.com/kubernetes/kube-state-metrics/pull/2911) - build(deps): Bump kubernetes-sigs/release-actions from 0.4.0 to 0.4.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2912](https://github.com/kubernetes/kube-state-metrics/pull/2912) - build(deps): Bump kubernetes-sigs/release-actions from 0.4.1 to 0.4.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2913](https://github.com/kubernetes/kube-state-metrics/pull/2913) - build(deps): Bump github.com/prometheus/exporter-toolkit from 0.15.1 to 0.16.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2914](https://github.com/kubernetes/kube-state-metrics/pull/2914) - build(deps): Bump github.com/netresearch/go-cron from 0.13.1 to 0.13.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2915](https://github.com/kubernetes/kube-state-metrics/pull/2915) - fix(horizontalpodautoscaler): Added container label to ContainerResource metrics by [@&#8203;bxrne](https://github.com/bxrne) in [#&#8203;2836](https://github.com/kubernetes/kube-state-metrics/pull/2836) - fix: avoid mutating metric families during write by [@&#8203;bhope](https://github.com/bhope) in [#&#8203;2852](https://github.com/kubernetes/kube-state-metrics/pull/2852) - fix: load CRS config when --continue-without-custom-resource-state-config-file is set and file exists by [@&#8203;ybouhachem](https://github.com/ybouhachem) in [#&#8203;2918](https://github.com/kubernetes/kube-state-metrics/pull/2918) - fix(deps): bump google.golang.org/grpc to v1.79.3 by [@&#8203;sturman](https://github.com/sturman) in [#&#8203;2925](https://github.com/kubernetes/kube-state-metrics/pull/2925) - fix: accept legacy custom\_resource\_config\_file as deprecated alias by [@&#8203;nmn3m](https://github.com/nmn3m) in [#&#8203;2926](https://github.com/kubernetes/kube-state-metrics/pull/2926) - build(deps): Bump github.com/netresearch/go-cron from 0.13.4 to 0.14.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2935](https://github.com/kubernetes/kube-state-metrics/pull/2935) - build(deps): Bump goreleaser/goreleaser-action from 7.0.0 to 7.1.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2933](https://github.com/kubernetes/kube-state-metrics/pull/2933) - build(deps): Bump the k8s-dependencies group with 5 updates by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2934](https://github.com/kubernetes/kube-state-metrics/pull/2934) - build(deps): Bump github.com/dlclark/regexp2 from 1.11.5 to 1.12.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2936](https://github.com/kubernetes/kube-state-metrics/pull/2936) - feat: add deployment-based sharding example by [@&#8203;ystkfujii](https://github.com/ystkfujii) in [#&#8203;2931](https://github.com/kubernetes/kube-state-metrics/pull/2931) - build(deps): Bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2938](https://github.com/kubernetes/kube-state-metrics/pull/2938) - fix: bump go-jose/v4 to v4.1.4 for CVE-2026-34986 by [@&#8203;marioferh](https://github.com/marioferh) in [#&#8203;2941](https://github.com/kubernetes/kube-state-metrics/pull/2941) - build(deps): Bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2944](https://github.com/kubernetes/kube-state-metrics/pull/2944) - chore: Rebase [#&#8203;2924](https://github.com/kubernetes/kube-state-metrics/issues/2924) with an additional commit by [@&#8203;rexagod](https://github.com/rexagod) in [#&#8203;2947](https://github.com/kubernetes/kube-state-metrics/pull/2947) - fix: stop memory leak from orphaned CR reflector goroutines on repeated CRD discovery by [@&#8203;bhope](https://github.com/bhope) in [#&#8203;2920](https://github.com/kubernetes/kube-state-metrics/pull/2920) - chore: bump Go from 1.26.1 to 1.26.2 by [@&#8203;bhope](https://github.com/bhope) in [#&#8203;2950](https://github.com/kubernetes/kube-state-metrics/pull/2950) - fix: CVE-2026-39883 security fix on otel go library by [@&#8203;Dinesh-Jilagam](https://github.com/Dinesh-Jilagam) in [#&#8203;2952](https://github.com/kubernetes/kube-state-metrics/pull/2952) - fix: Handle DeletedFinalStateUnknown panic by [@&#8203;rexagod](https://github.com/rexagod) in [#&#8203;2955](https://github.com/kubernetes/kube-state-metrics/pull/2955) - chore: Release v2.19.0 by [@&#8203;bhope](https://github.com/bhope) in [#&#8203;2949](https://github.com/kubernetes/kube-state-metrics/pull/2949) #### New Contributors - [@&#8203;jfremy-openai](https://github.com/jfremy-openai) made their first contribution in [#&#8203;2866](https://github.com/kubernetes/kube-state-metrics/pull/2866) - [@&#8203;marvin659](https://github.com/marvin659) made their first contribution in [#&#8203;2908](https://github.com/kubernetes/kube-state-metrics/pull/2908) - [@&#8203;pierluigilenoci](https://github.com/pierluigilenoci) made their first contribution in [#&#8203;2906](https://github.com/kubernetes/kube-state-metrics/pull/2906) - [@&#8203;bxrne](https://github.com/bxrne) made their first contribution in [#&#8203;2836](https://github.com/kubernetes/kube-state-metrics/pull/2836) - [@&#8203;ybouhachem](https://github.com/ybouhachem) made their first contribution in [#&#8203;2918](https://github.com/kubernetes/kube-state-metrics/pull/2918) - [@&#8203;sturman](https://github.com/sturman) made their first contribution in [#&#8203;2925](https://github.com/kubernetes/kube-state-metrics/pull/2925) - [@&#8203;ystkfujii](https://github.com/ystkfujii) made their first contribution in [#&#8203;2931](https://github.com/kubernetes/kube-state-metrics/pull/2931) - [@&#8203;marioferh](https://github.com/marioferh) made their first contribution in [#&#8203;2941](https://github.com/kubernetes/kube-state-metrics/pull/2941) - [@&#8203;Dinesh-Jilagam](https://github.com/Dinesh-Jilagam) made their first contribution in [#&#8203;2952](https://github.com/kubernetes/kube-state-metrics/pull/2952) **Full Changelog**: <https://github.com/kubernetes/kube-state-metrics/compare/v2.18.0...v2.19.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=-->
renovate added 1 commit 2026-05-23 03:09:37 +00:00
Update registry.k8s.io/kube-state-metrics/kube-state-metrics Docker tag to v2.19.0 6e8275454e
renovate force-pushed renovate/registry.k8s.io-kube-state-metrics-kube-state-metrics-2.x from a8361a2a90 to 6e8275454e 2026-05-23 03:09:37 +00:00 Compare
AverageMarcus merged commit 0521df9e92 into master 2026-05-23 10:29:34 +00:00
AverageMarcus deleted branch renovate/registry.k8s.io-kube-state-metrics-kube-state-metrics-2.x 2026-05-23 10:29:34 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Assignees
Clear assignees
renovate (Renovate Bot) AverageMarcus (Marcus Noble)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: AverageMarcus/cluster.fun#711
Delete Branch "renovate/registry.k8s.io-kube-state-metrics-kube-state-metrics-2.x"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?