Skip to content

chore(deps): update iac-support-deps#2768

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/iac-support-deps
Open

chore(deps): update iac-support-deps#2768
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/iac-support-deps

Conversation

@renovate

@renovate renovate Bot commented Jun 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
aws-actions/configure-aws-credentials (changelog) action digest e7f100c → 517a711
aws-load-balancer-controller patch 3.4.0 → 3.4.2
dorny/paths-filter (changelog) action digest fbd0ab8 → 7b450ff
ghcr.io/zarf-dev/packages/init minor v0.79.0 → v0.81.1
kubernetes-sigs/aws-load-balancer-controller patch v3.4.0 → v3.4.2
opentofu/opentofu patch 1.12.3 → 1.12.4
opentofu/setup-opentofu action patch v2.0.1 → v2.0.2
terraform-aws-modules/eks/aws (source) module minor ~> 21.23.0 → ~> 21.24.0
terraform-aws-modules/s3-bucket/aws (source) module minor 5.14.0 → 5.15.1

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

kubernetes-sigs/aws-load-balancer-controller (kubernetes-sigs/aws-load-balancer-controller)

v3.4.2

Compare Source

v3.4.2 Release Notes
📚 Quick Links
v3.4.2 (requires Kubernetes 1.22+)
Image: public.ecr.aws/eks/aws-load-balancer-controller:v3.4.2
Documentation
Thanks to all our contributors!💜💜💜
⚠️ Action Required
CRD Updates
  • No CRD updates required for this release.
IAM Policy Updates
  • No IAM policy changes required for this release.
Gateway API updates
  • No Gateway API CRD updates required for this release.
🔒 Security Fix

  • Cross-Kind Route Precedence Fix (PR #​4818): Fixed a vulnerability where ALB listener rule priority was determined by route kind rather than route specificity when HTTPRoute and GRPCRoute share a hostname on the same Gateway listener. Previously, HTTPRoute would always receive a lower ALB priority number (evaluated first) than a specific GRPCRoute, allowing cross-namespace traffic interception. The controller now uses a unified precedence comparator that orders rules by hostname specificity → path type → path length → method constraint → header count → creation timestamp, regardless of route kind.

    Affected configurations: Shared Gateways with AllowedRoutes.Namespaces.From: All (or a namespace selector admitting multiple tenants) where both HTTPRoute and GRPCRoute attach to the same HTTPS listener with the same hostname.

    Workaround for unpatched versions: Restrict Gateway listener AllowedRoutes.Namespaces.From to Same or use a restrictive namespace Selector.

🔧 Enhancements and Fixes
  • [Security fix] Unified cross-kind route precedence for HTTPRoute/GRPCRoute — specific routes now correctly outrank catch-all routes regardless of kind (#​4818)
  • [Bug fix] Fix e2e test gRPC service name mismatch in cross-kind precedence test (#​4830)
  • [Enhancement] Upgrade Go toolchain from 1.26.4 to 1.26.5 — fixes CVE-2026-39822 and CVE-2026-42505
Documentation Updates
  • Add guidance on migrating between services without downtime (#​4819)
🌟 Complete Change Log
New Contributors

Full Changelog: v3.4.1...v3.4.2

v3.4.1

Compare Source

[!CAUTION]
⚠️ Security Notice: This release contains a known vulnerability. Please upgrade to v3.4.2 or later.

A cross-kind route precedence vulnerability allows a namespace-scoped user to hijack gRPC traffic on shared Gateways by creating a catch-all HTTPRoute. This affects configurations where AllowedRoutes.Namespaces.From: All is used with both HTTPRoute and GRPCRoute on the same listener with the same hostname

Fix: Upgrade to v3.4.2
Workaround: Restrict AllowedRoutes.Namespaces.From to Same or use a restrictive namespace Selector.
Details: PR #​4818

v3.4.1 Release Notes

📚 Quick Links

v3.4.1 (requires Kubernetes 1.22+)

Image: public.ecr.aws/eks/aws-load-balancer-controller:v3.4.1
Documentation
Thanks to all our contributors!💜💜💜

⚠️ Action Required

CRD Updates

Action : Please apply the latest CRD definitions

  • kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master"
IAM Policy Updates
  • No IAM policy changes required for this release.
Gateway API updates
  • No Gateway API CRD updates required for this release.

🚀 What's New

Ingress Features

  • ECDSA/RSA Certificate Auto-Discovery (PR #​4490): The controller now supports automatic discovery of both ECDSA and RSA certificates from ACM when building the certificate list for Ingress resources. This enables dual-certificate configurations for optimized TLS performance across different client types.
    Gateway API Features
  • Shared Hostname for HTTPRoute and GRPCRoute (PR #​4794): HTTPRoute and GRPCRoute resources can now share the same hostname on a Gateway listener. The overlapping hostname restriction between HTTP and gRPC routes has been removed, enabling mixed protocol configurations on the same domain.

🔧 Enhancements and Fixes

  • [Bug fix] Filter EndpointSlices by IP family for target group registration — prevents IPv4 addresses from being registered to IPv6 target groups (#​4783)
  • [Bug fix] Match hosted zones by longest suffix in GetHostedZoneID — fixes DNS validation for deeply nested subdomains and wildcard SANs (#​4785)
  • [Bug fix] Fix non-transitive rule precedence for routes without hostnames — catch-all routes no longer intermittently sort above host-specific rules (#​4809)
  • [Bug fix] Fix ICMP Type/Code constants (#​4799)
  • [Bug fix] Fix render feature gates as parseable key-value pairs (#​4757)
  • [Enhancement] Add enableCertificateManagement controller flag to Helm chart (#​4726)

Documentation Updates

  • Correct enableEndpointSlices default value in Helm values comment (#​4806)
  • Clarify WAF addon ownership and document IngressGroup security risks (#​4797)
  • Fix stale contributor setup and invalid IAM role ARN examples (#​4791)
  • Fix doc annotation name (#​4787)

🌟 Complete Change Log

New Contributors

Full Changelog: kubernetes-sigs/aws-load-balancer-controller@v3.4.0...v3.4.1

opentofu/opentofu (opentofu/opentofu)

v1.12.4

Compare Source

BUG FIXES:

  • tofu plan -out no longer fails when the plan includes a resource with lifecycle { destroy = false } that needs replacement, which previously errored with invalid change action ForgetThenCreate. (#​4324)
  • Moved block now correctly compares provider source addresses. (#​4280)[#​4280]
  • Correct Source Provider Address now passed into Provider MoveResource requests. (#​4355)[#​4355]

Full Changelog: opentofu/opentofu@v1.12.3...v1.12.4

opentofu/setup-opentofu (opentofu/setup-opentofu)

v2.0.2

Compare Source

What's Changed

New Contributors

Full Changelog: opentofu/setup-opentofu@v2...v2.0.2

terraform-aws-modules/terraform-aws-eks (terraform-aws-modules/eks/aws)

v21.24.0

Compare Source

Features
terraform-aws-modules/terraform-aws-s3-bucket (terraform-aws-modules/s3-bucket/aws)

v5.15.1

Compare Source

Bug Fixes
  • Replace deprecated data.aws_region.current.name with .region in example (#​402) (d2f5642)

v5.15.0

Compare Source

Features

v5.14.1

Compare Source

Bug Fixes

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner June 23, 2026 20:57
@github-actions github-actions Bot added the needs-review Label used for Renovate PRs that are ready for review/test label Jun 23, 2026
@renovate
renovate Bot force-pushed the renovate/iac-support-deps branch 3 times, most recently from 316e9b9 to 6757ce3 Compare June 27, 2026 02:48
@renovate
renovate Bot force-pushed the renovate/iac-support-deps branch 4 times, most recently from 5537584 to e3fa930 Compare July 7, 2026 23:44
@renovate
renovate Bot force-pushed the renovate/iac-support-deps branch 4 times, most recently from a0ee06b to 3ab8741 Compare July 16, 2026 16:46
@renovate
renovate Bot force-pushed the renovate/iac-support-deps branch 2 times, most recently from c044ebb to d0a0b30 Compare July 17, 2026 15:56
@renovate
chore(deps): update iac-support-deps
eb55d08 
| datasource       | package                                      | from    | to      |
| ---------------- | -------------------------------------------- | ------- | ------- |
| helm             | aws-load-balancer-controller                 | 3.4.0   | 3.4.2   |
| docker           | ghcr.io/zarf-dev/packages/init               | v0.79.0 | v0.81.1 |
| github-tags      | kubernetes-sigs/aws-load-balancer-controller | v3.4.0  | v3.4.2  |
| github-tags      | opentofu/opentofu                            | 1.12.3  | 1.12.4  |
| github-tags      | opentofu/setup-opentofu                      | v2.0.1  | v2.0.2  |
| terraform-module | terraform-aws-modules/eks/aws                | 21.23.0 | 21.24.0 |
| terraform-module | terraform-aws-modules/s3-bucket/aws          | 5.14.0  | 5.15.1  |
@renovate
renovate Bot force-pushed the renovate/iac-support-deps branch from d0a0b30 to eb55d08 Compare July 18, 2026 10:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

needs-review Label used for Renovate PRs that are ready for review/test

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants