cert-manager
v1.19.5SecurityApr 22, 2026
Pure security patch: Go runtime bumped to 1.23.9 and vulnerable dependencies updated. No functional changes — upgrade is the only action needed.
securityUpgrade to v1.19.5 immediately — this is a pure CVE fix
The cert-manager team explicitly recommends all users upgrade. The changes are limited to Go runtime and dependency bumps, so there is no functional risk in upgrading. If you are on any v1.19.x release, this is a straight swap with no migration steps. Check your deployment method (Helm, static manifests, OperatorHub) and roll it out to all clusters. Delaying leaves your cert-manager pods running with known vulnerable Go packages.
Key changes (3)
- Go runtime upgraded from an older 1.23.x to 1.23.9 to address multiple CVEs in the Go toolchain
- Third-party Go dependencies with reported vulnerabilities bumped to patched versions
- No API, behavioral, or configuration changes — drop-in replacement for v1.19.x