feat(container): update image ghcr.io/external-secrets/charts/external-secrets ( 2.5.0 ➔ 2.6.0 )

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/external-secrets/charts/external-secrets	minor	2.5.0 → 2.6.0

---

Release Notes

external-secrets/external-secrets (ghcr.io/external-secrets/charts/external-secrets)

v2.6.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.6.0
Image: ghcr.io/external-secrets/external-secrets:v2.6.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.6.0-ubi-boringssl

What's Changed

General

• chore: release helm chart 2.5.0 by @​Skarlso in #​6352
• feat(keeper): implement provider_api_calls_count metric by @​m-k8s in #​6345
• docs(gcpsm): updates Google Secret Manager authentication guide with WIF usage by @​bharath-b-rh in #​6356
• feat(release): PB-51302 - External secret should support v5-custom-fields resource type by @​cedricherzog-passbolt in #​6377
• feat(testing): OpenBao e2e test by @​phil9909 in #​6396
• docs: Explanation of our labels by @​evrardj-roche in #​6306
• docs: add AGENTS.md and AI setup guide for ESO by @​rowanruseler in #​6141
• fix(makefile): clean up cross-submodule go.mod churn after make test by @​alekc in #​6378
• fix(provider): align TokenRequest body namespace with URL namespace by @​alekc in #​6420
• fix(build): use buildx --load and non-registry image tag by @​alekc in #​6419
• fix(charts): render PDB spec when minAvailable or maxUnavailable is zero by @​blindrood in #​6360
• chore: update go version 1.26.4 by @​Skarlso in #​6426

Dependencies

• chore(deps): bump golang from 91eda97 to 91eda97 by @​dependabot[bot] in #​6363
• chore(deps): bump pymdown-extensions from 10.21.2 to 10.21.3 in /hack/api-docs by @​dependabot[bot] in #​6370
• chore(deps): bump hashicorp/setup-terraform from 4.0.0 to 4.0.1 by @​dependabot[bot] in #​6364
• chore(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 by @​dependabot[bot] in #​6365
• chore(deps): bump step-security/harden-runner from 2.19.1 to 2.19.4 by @​dependabot[bot] in #​6366
• chore(deps): bump github/codeql-action from 4.35.4 to 4.36.0 by @​dependabot[bot] in #​6368
• chore(deps): bump distroless/static from 47b2d72 to 3592aa8 by @​dependabot[bot] in #​6362
• chore(deps): bump ubi9/ubi from 2323fcf to 151fc1b by @​dependabot[bot] in #​6361
• chore(deps): bump actions/create-github-app-token from 3.1.1 to 3.2.0 by @​dependabot[bot] in #​6367
• chore(deps): bump idna from 3.14 to 3.16 in /hack/api-docs by @​dependabot[bot] in #​6369
• chore(deps): bump golang from 91eda97 to 91eda97 by @​dependabot[bot] in #​6383
• chore(deps): bump golang from 252599a to 386d475 in /e2e by @​dependabot[bot] in #​6389
• chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 by @​dependabot[bot] in #​6384
• chore(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 by @​dependabot[bot] in #​6387
• chore(deps): bump docker/login-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​6386
• chore(deps): bump actions/stale from 10.2.0 to 10.3.0 by @​dependabot[bot] in #​6388
• chore(deps): bump zipp from 3.23.1 to 4.1.0 in /hack/api-docs by @​dependabot[bot] in #​6390
• chore(deps): bump click from 8.3.3 to 8.4.1 in /hack/api-docs by @​dependabot[bot] in #​6391
• chore(deps): bump certifi from 2026.4.22 to 2026.5.20 in /hack/api-docs by @​dependabot[bot] in #​6392
• chore(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @​dependabot[bot] in #​6385
• chore(deps): bump requests from 2.33.1 to 2.34.2 in /hack/api-docs by @​dependabot[bot] in #​6372
• chore(deps): bump tornado from 6.5.5 to 6.5.6 in /hack/api-docs by @​dependabot[bot] in #​6412
• chore(deps): bump ubi9/ubi from 151fc1b to 8942b73 by @​dependabot[bot] in #​6407
• chore(deps): bump aws-actions/configure-aws-credentials from 6.1.1 to 6.2.0 by @​dependabot[bot] in #​6408
• chore(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0 by @​dependabot[bot] in #​6409
• chore(deps): bump idna from 3.16 to 3.17 in /hack/api-docs by @​dependabot[bot] in #​6411

New Contributors

• @​m-k8s made their first contribution in #​6345
• @​phil9909 made their first contribution in #​6396
• @​blindrood made their first contribution in #​6360

Full Changelog: external-secrets/external-secrets@v2.5.0...v2.6.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-cert-controller

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-cert-controller

@@ -34,13 +34,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v2.5.0
+        image: ghcr.io/external-secrets/external-secrets:v2.6.0
         imagePullPolicy: IfNotPresent
         args:
         - certcontroller
         - --crd-requeue-interval=5m
         - --service-name=external-secrets-webhook
         - --service-namespace=external-secrets
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets

@@ -34,13 +34,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v2.5.0
+        image: ghcr.io/external-secrets/external-secrets:v2.6.0
         imagePullPolicy: IfNotPresent
         args:
         - --concurrent=1
         - --metrics-addr=:8080
         - --loglevel=info
         - --zap-time-encoding=epoch
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-webhook

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-webhook

@@ -34,13 +34,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v2.5.0
+        image: ghcr.io/external-secrets/external-secrets:v2.6.0
         imagePullPolicy: IfNotPresent
         args:
         - webhook
         - --port=10250
         - --dns-name=external-secrets-webhook.external-secrets.svc
         - --cert-dir=/tmp/certs

[github-actions]

--- kubernetes/apps/external-secrets/external-secrets/app Kustomization: external-secrets/external-secrets OCIRepository: external-secrets/external-secrets

+++ kubernetes/apps/external-secrets/external-secrets/app Kustomization: external-secrets/external-secrets OCIRepository: external-secrets/external-secrets

@@ -10,9 +10,9 @@

 spec:
   interval: 15m
   layerSelector:
     mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
     operation: copy
   ref:
-    tag: 2.5.0
+    tag: 2.6.0
   url: oci://ghcr.io/external-secrets/charts/external-secrets