cert-manager

Action needed (9)

• securitycriticalgolang.org/x/net HTTP/2 fixes

  golang.org/x/net is updated to v0.60.0 to fix CVE-2026-78669, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, and CVE-2026-97032 in HTTP/2.

  CVE-2026-78669CVE-2026-78659CVE-2026-78660

• securityhighgithub.com/go-jose/go-jose/v4 updated to v4.1.6

  github.com/go-jose/go-jose/v4 is updated to v4.1.6 to fix CVE-2026-116587 and GHSA-mgcc-cww5-fp2q, a denial of service when parsing JWKs containing RSA keys.

  CVE-2026-116587

• securityhighgolang.org/x/crypto updated to v0.57.0

  golang.org/x/crypto is updated to v0.57.0 to fix CVE-2026-56855 and CVE-2026-78662.

  CVE-2026-56855CVE-2026-78662

• securitycrypto/x509 certificate-chain rejection

  crypto/x509 now rejects certificate chains that pass through compromised intermediates. This behavior ships with Go 1.26.10 and addresses CVE-2026-111943 and GO-2026-6809.

  CVE-2026-111943

• securityTrust in compromised certificate authority roots removed

  The base images now use Debian 13, which no longer trusts the compromised emSign ECC Root CA - G3 and AAA Certificate Services roots.

• securityGo 1.26.10 security update

  Go is updated to 1.26.10, which fixes issues in the crypto/tls, crypto/x509, net/http, net/textproto, mime/multipart, and html/template packages.

• securityOpenTelemetry OTLP trace exporters updated to v1.45.0

  go.opentelemetry.io/otel/exporters/otlp/otlptrace and otlptracegrpc are updated to v1.45.0 to fix a reported security vulnerability.

• securitygolang.org/x/net html package fixes

  golang.org/x/net is updated to v0.62.0 to fix CVE-2026-78661 and CVE-2026-97045 in the html package.

  CVE-2026-78661CVE-2026-97045

• breakingThe go directive, raised to 1.26

  The go directive in cert-manager's go.mod files is now 1.26. Source builds use the Go 1.26 toolchain requirement.