chore(deps): update dependency argoproj/argo-cd to v2.11.2

[uniget-bot]

This PR contains the following updates:

Package	Update	Change
argoproj/argo-cd	patch	2.11.0 -> 2.11.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

argoproj/argo-cd (argoproj/argo-cd)

v2.11.2

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.2/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.2/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 212a6ed: fix(deps): upgrade otel dependency (#​18285) (#​18324) (@​gcp-cherry-pick-bot[bot])
• 2b463d4: fix: remove Egress NetworkPolicy for argocd-redis and argocd-redis-ha-haproxy (#​18367) (#​18372) (@​gcp-cherry-pick-bot[bot])
• 9d58e7e: fix: revert registry change (#​18328) (@​crenshaw-dev)

Documentation

• 140ffdd: docs: add v2.11 notes to upgrading page (#​18333) (@​crenshaw-dev)

Other work

• 47e7470: chore(ci): fix release notes (#​18132) (#​18330) (@​gcp-cherry-pick-bot[bot])

Full Changelog: argoproj/argo-cd@v2.11.1...v2.11.2

v2.11.1

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.1/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.1/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Full Changelog: argoproj/argo-cd@v2.11.0...v2.11.1

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[nicholasdille-bot]

Auto-approved because label type/renovate is present.

[github-actions]

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/argocd:2.11.2

📦 Image Reference ghcr.io/uniget-org/tools/argocd:2.11.2

digest	sha256:6e862f17816ceddf78ed37f67f0289123deb60580cd15d312f1e95157421e7e7
vulnerabilities
platform	linux/amd64
size	67 MB
packages	260

github.com/cloudflare/circl 1.3.3 (golang) pkg:golang/github.com/cloudflare/circl@1.3.3 Affected range <1.3.7 Fixed version 1.3.7 Description Impact On some platforms, when an attacker can time decapsulation of Kyber on forged cipher texts, they could possibly learn (parts of) the secret key. Does not apply to ephemeral usage, such as when used in the regular way in TLS. Patches Patched in 1.3.7. References kyberslash.cr.yp.to OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range Fixed version v1.3.7 Description Impact On some platforms, when an attacker can time decapsulation of Kyber on forged cipher texts, they could possibly learn (parts of) the secret key. Does not apply to ephemeral usage, such as when used in the regular way in TLS. Patches Patched in 1.3.7. References kyberslash.cr.yp.to

github.com/aws/aws-sdk-go 1.50.8 (golang) pkg:golang/github.com/aws/aws-sdk-go@1.50.8 Affected range >=0 Fixed version Not Fixed Description The Go AWS S3 Crypto SDK contains vulnerabilities that can permit an attacker with write access to a bucket to decrypt files in that bucket. Files encrypted by the V1 EncryptionClient using either the AES-CBC content cipher or the KMS key wrap algorithm are vulnerable. Users should migrate to the V1 EncryptionClientV2 API, which will not create vulnerable files. Old files will remain vulnerable until re-encrypted with the new client. Affected range >=0 Fixed version Not Fixed Description The Go AWS S3 Crypto SDK contains vulnerabilities that can permit an attacker with write access to a bucket to decrypt files in that bucket. Files encrypted by the V1 EncryptionClient using either the AES-CBC content cipher or the KMS key wrap algorithm are vulnerable. Users should migrate to the V1 EncryptionClientV2 API, which will not create vulnerable files. Old files will remain vulnerable until re-encrypted with the new client.

k8s.io/apiserver 0.26.11 (golang) pkg:golang/k8s.io/apiserver@0.26.11 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <1.15.10 Fixed version 1.15.10, 1.16.7, 1.17.3 CVSS Score 4.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Description The Kubernetes API server component has been found to be vulnerable to a denial of service attack via successful API requests.

golang.org/x/net 0.19.0 (golang) pkg:golang/golang.org/x/net@0.19.0 Uncontrolled Resource Consumption Affected range <0.23.0 Fixed version 0.23.0 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Description An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.

k8s.io/kubernetes 1.26.11 (golang) pkg:golang/k8s.io/kubernetes@1.26.11 Improper Input Validation Affected range <1.27.13 Fixed version 1.27.13 CVSS Score 2.7 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N Description A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.

[github-actions]

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/9178242651.

[github-actions]

PR has unknown mergeable_state (unstable) and can not be merged. See https://github.com/uniget-org/tools/actions/runs/9178242651.

[nicholasdille-bot]

Auto-approved because label type/renovate is present.

[github-actions]

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/9211659969.

[github-actions]

PR is clean and can be merged. See https://github.com/uniget-org/tools/actions/runs/9211659969.