all: children: controllers: hosts: controller: null zuul_unreachable: hosts: {} hosts: controller: ansible_connection: ssh ansible_host: 199.204.45.229 ansible_port: 22 ansible_python_interpreter: auto ansible_user: zuul cilium_helm_values: operator: replicas: 1 cilium_ipv4_cidr: 172.24.0.0/16 kube_vip_address: 172.17.0.100 kube_vip_interface: '{{ ansible_facts[''default_ipv4''].interface }}' kubernetes_hostname: '{{ ansible_facts[''default_ipv4''].address }}' kubernetes_version: 1.28.13 molecule_scenario: secretgen-controller nodepool: az: nova cloud: public external_id: 90d594ea-a24b-4db0-bb62-d11fdeab273c host_id: f373a28d302a4990c6af48a982661c254feecb826df4c059c9d84662 interface_ip: 199.204.45.229 label: ubuntu-noble node_properties: {} private_ipv4: 199.204.45.229 private_ipv6: null provider: yul1 public_ipv4: 199.204.45.229 public_ipv6: 2604:e100:1:0:f816:3eff:fee8:fe19 region: ca-ymq-1 slot: null zuul_node: az: nova cloud: public external_id: 90d594ea-a24b-4db0-bb62-d11fdeab273c host_id: f373a28d302a4990c6af48a982661c254feecb826df4c059c9d84662 interface_ip: 199.204.45.229 label: ubuntu-noble node_properties: {} private_ipv4: 199.204.45.229 private_ipv6: null provider: yul1 public_ipv4: 199.204.45.229 public_ipv6: 2604:e100:1:0:f816:3eff:fee8:fe19 region: ca-ymq-1 slot: null uuid: null vars: cilium_helm_values: operator: replicas: 1 kubernetes_version: 1.28.13 molecule_scenario: secretgen-controller zuul: _inheritance_path: - '' - '' - '' - '' - '' ansible_version: '9' attempts: 1 branch: main build: 9910fef712154efba333571183ffc995 build_refs: - branch: main change: '105' change_message: "chore(deps): update helm release cert-manager to v1.19.4\n\nThis PR contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n| [cert-manager](https://cert-manager.io) ([source](https://redirect.github.com/cert-manager/cert-manager)) | minor | `1.18.2` \u2192 `1.19.4` |\n\n---\n\n### Release Notes\n\n
\ncert-manager/cert-manager (cert-manager)\n\n### [`v1.19.4`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.4)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.3...v1.19.4)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nv1.19.4 is a simple patch release to fix some reported vulnerabilities - notably CVE-2026-24051 and CVE-2025-68121. All users should upgrade.\n\n#### Changes by Kind\n\n##### Bug or Regression\n\n- Bump go to address CVE-2025-68121 ([#​8526](https://redirect.github.com/cert-manager/cert-manager/issues/8526), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Bump otel SDK to address GO-2026-4394 ([#​8531](https://redirect.github.com/cert-manager/cert-manager/issues/8531), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.19.3`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.3)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.2...v1.19.3)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis release contains three bug fixes, including a fix for the MODERATE severity DoS issue in GHSA-gx3x-vq4p-mhhv. All users should upgrade to the latest release.\n\n#### Changes by Kind\n\n##### Bug or Regression\n\n- Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#​8415](https://redirect.github.com/cert-manager/cert-manager/issues/8415), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Fixed an issue where HTTP-01 challenges failed when the Host header contained an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#​8436](https://redirect.github.com/cert-manager/cert-manager/issues/8436), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#​8468](https://redirect.github.com/cert-manager/cert-manager/issues/8468), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n##### Other (Cleanup or Flake)\n\n- Bump go to 1.25.6 ([#​8459](https://redirect.github.com/cert-manager/cert-manager/issues/8459), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.19.2`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.2)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.1...v1.19.2)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe updated Go to fix some vulnerabilities in the standard library.\n\n> \U0001F4D6 Read the [full 1.19 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.19) on the cert-manager.io website before upgrading.\n\n#### Changes since `v1.19.1`\n\n##### Bug or Regression\n\n- Address false positive vulnerabilities `CVE-2025-47914` and `CVE-2025-58181` which were reported by Trivy. ([#​8283](https://redirect.github.com/cert-manager/cert-manager/issues/8283), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#​8294](https://redirect.github.com/cert-manager/cert-manager/issues/8294), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#​8233](https://redirect.github.com/cert-manager/cert-manager/issues/8233), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n##### Other (Cleanup or Flake)\n\n- Update cert-manager's ACME client, forked from `golang/x/crypto` ([#​8270](https://redirect.github.com/cert-manager/cert-manager/issues/8270), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Updated Debian 12 distroless base images ([#​8326](https://redirect.github.com/cert-manager/cert-manager/issues/8326), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n### [`v1.19.1`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.1)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.0...v1.19.1)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe reverted the CRD-based API defaults for `Certificate.Spec.IssuerRef` and `CertificateRequest.Spec.IssuerRef` after they were found to cause unexpected certificate renewals after upgrading to 1.19.0. We will try re-introducing these API defaults in cert-manager `1.20`.\nWe fixed a bug that caused certificates to be re-issued unexpectedly if the `issuerRef` kind or group was changed to one of the \"runtime\" default values.\nWe upgraded Go to `1.25.3` to address the following security vulnerabilities: `CVE-2025-61724`, `CVE-2025-58187`, `CVE-2025-47912`, `CVE-2025-58183`, `CVE-2025-61723`, `CVE-2025-58186`, `CVE-2025-58185`, `CVE-2025-58188`, and `CVE-2025-61725`.\n\n> \U0001F4D6 Read the [full 1.19 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.19) on the cert-manager.io website before upgrading.\n\nChanges since `v1.19.0`:\n\n##### Bug or Regression\n\n- BUGFIX: in case kind or group in the `issuerRef` of a Certificate was omitted, upgrading to `1.19.x` incorrectly caused the certificate to be renewed ([#​8175](https://redirect.github.com/cert-manager/cert-manager/issues/8175), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Bump Go to 1.25.3 to fix a backwards incompatible change to the validation of DNS names in X.509 SAN fields which prevented the use of DNS names with a trailing dot ([#​8177](https://redirect.github.com/cert-manager/cert-manager/issues/8177), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#​8178](https://redirect.github.com/cert-manager/cert-manager/issues/8178), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n### [`v1.19.0`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.0)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.18.5...v1.19.0)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\n> \u26A0\uFE0F **Known issues**: The following known issues are fixed in [v1.19.1](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.1):\n>\n> - [Unexpected certificate renewal after upgrading to 1.19.0](https://redirect.github.com/cert-manager/cert-manager/issues/8158)\n\nThis release focuses on expanding platform compatibility, improving deployment flexibility, enhancing observability, and addressing key reliability issues.\n\n> \U0001F4D6 Read the full release notes at cert-manager.io: \n\nChanges since `v1.18.0`:\n\n##### Feature\n\n- Add IPv6 rules to the default network policy ([#​7726](https://redirect.github.com/cert-manager/cert-manager/issues/7726), [@​jcpunk](https://redirect.github.com/jcpunk))\n- Add `global.nodeSelector` to helm chart to allow for a single `nodeSelector` to be set across all services. ([#​7818](https://redirect.github.com/cert-manager/cert-manager/issues/7818), [@​StingRayZA](https://redirect.github.com/StingRayZA))\n- Add a feature gate to default to Ingress `pathType` `Exact` in ACME HTTP01 Ingress challenge solvers. ([#​7795](https://redirect.github.com/cert-manager/cert-manager/issues/7795), [@​sspreitzer](https://redirect.github.com/sspreitzer))\n- Add generated `applyconfigurations` allowing clients to make type-safe server-side apply requests for cert-manager resources. ([#​7866](https://redirect.github.com/cert-manager/cert-manager/issues/7866), [@​erikgb](https://redirect.github.com/erikgb))\n- Added API defaults to issuer references group (cert-manager.io) and kind (Issuer). ([#​7414](https://redirect.github.com/cert-manager/cert-manager/issues/7414), [@​erikgb](https://redirect.github.com/erikgb))\n- Added `certmanager_certificate_challenge_status` Prometheus metric. ([#​7736](https://redirect.github.com/cert-manager/cert-manager/issues/7736), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added `protocol` field for `rfc2136` DNS01 provider ([#​7881](https://redirect.github.com/cert-manager/cert-manager/issues/7881), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added experimental field `hostUsers` flag to all pods. Not set by default. ([#​7973](https://redirect.github.com/cert-manager/cert-manager/issues/7973), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Support configurable resource requests and limits for ACME HTTP01 solver pods through ClusterIssuer and Issuer specifications, allowing granular resource management that overrides global `--acme-http01-solver-resource-*` settings. ([#​7972](https://redirect.github.com/cert-manager/cert-manager/issues/7972), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- The `CAInjectorMerging` feature has been promoted to BETA and is now enabled by default ([#​8017](https://redirect.github.com/cert-manager/cert-manager/issues/8017), [@​ThatsMrTalbot](https://redirect.github.com/ThatsMrTalbot))\n- The controller, webhook and ca-injector now log their version and git commit on startup for easier debugging and support. ([#​8072](https://redirect.github.com/cert-manager/cert-manager/issues/8072), [@​prasad89](https://redirect.github.com/prasad89))\n- Updated `certificate` metrics to the collector approach. ([#​7856](https://redirect.github.com/cert-manager/cert-manager/issues/7856), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n\n##### Bug or Regression\n\n- ACME: Increased challenge authorization timeout to 2 minutes to fix `error waiting for authorization` ([#​7796](https://redirect.github.com/cert-manager/cert-manager/issues/7796), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- BUGFIX: permitted URI domains were incorrectly used to set the excluded URI domains in the CSR's name constraints ([#​7816](https://redirect.github.com/cert-manager/cert-manager/issues/7816), [@​kinolaev](https://redirect.github.com/kinolaev))\n- Enforced ACME HTTP-01 solver validation to properly reject configurations when multiple ingress options (`class`, `ingressClassName`, `name`) are specified simultaneously ([#​8021](https://redirect.github.com/cert-manager/cert-manager/issues/8021), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Increase maximum sizes of PEM certificates and chains which can be parsed in cert-manager, to handle leaf certificates with large numbers of DNS names or other identities ([#​7961](https://redirect.github.com/cert-manager/cert-manager/issues/7961), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Reverted adding the `global.rbac.disableHTTPChallengesRole` Helm option. ([#​7836](https://redirect.github.com/cert-manager/cert-manager/issues/7836), [@​inteon](https://redirect.github.com/inteon))\n- This change removes the `path` label of core ACME client metrics and will require users to update their monitoring dashboards and alerting rules if using those metrics. ([#​8109](https://redirect.github.com/cert-manager/cert-manager/issues/8109), [@​mladen-rusev-cyberark](https://redirect.github.com/mladen-rusev-cyberark))\n- Use the latest version of `ingress-nginx` in E2E tests to ensure compatibility ([#​7792](https://redirect.github.com/cert-manager/cert-manager/issues/7792), [@​wallrj](https://redirect.github.com/wallrj))\n\n##### Other (Cleanup or Flake)\n\n- Helm: Fix naming template of `tokenrequest` RoleBinding resource to improve consistency ([#​7761](https://redirect.github.com/cert-manager/cert-manager/issues/7761), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Improve error messages when certificates, CRLs or private keys fail admission due to malformed or missing PEM data ([#​7928](https://redirect.github.com/cert-manager/cert-manager/issues/7928), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Major upgrade of Akamai SDK. NOTE: The new version has not been fully tested end-to-end due to the lack of cloud infrastructure. ([#​8003](https://redirect.github.com/cert-manager/cert-manager/issues/8003), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Update kind images to include the Kubernetes 1.33 node image ([#​7786](https://redirect.github.com/cert-manager/cert-manager/issues/7786), [@​wallrj](https://redirect.github.com/wallrj))\n- Use `maps.Copy` for cleaner map handling ([#​8092](https://redirect.github.com/cert-manager/cert-manager/issues/8092), [@​quantpoet](https://redirect.github.com/quantpoet))\n- Vault: Migrate Vault E2E add-on tests from deprecated `vault-client-go` to the new `vault/api` client. ([#​8059](https://redirect.github.com/cert-manager/cert-manager/issues/8059), [@​armagankaratosun](https://redirect.github.com/armagankaratosun))\n\n### [`v1.18.5`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.18.5)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.18.4...v1.18.5)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis release contains three bug fixes, including a fix for the MODERATE severity DoS issue in GHSA-gx3x-vq4p-mhhv. All users should upgrade to the latest release.\n\n##### Changes by Kind\n\n##### Bug or Regression\n\n- Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#​8414](https://redirect.github.com/cert-manager/cert-manager/issues/8414), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#​8437](https://redirect.github.com/cert-manager/cert-manager/issues/8437), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#​8467](https://redirect.github.com/cert-manager/cert-manager/issues/8467), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n##### Other (Cleanup or Flake)\n\n- Bump go to 1.24.12 ([#​8460](https://redirect.github.com/cert-manager/cert-manager/issues/8460), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.18.4`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.18.4)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.18.3...v1.18.4)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe updated Go to fix some vulnerabilities in the standard library.\n\n> \U0001F4D6 Read the [full 1.18 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.18) on the cert-manager.io website before upgrading.\n\n##### Changes since `v1.18.3`\n\n##### Bug or Regression\n\n- Address false positive vulnerabilities `CVE-2025-47914` and `CVE-2025-58181` which were reported by Trivy. ([#​8282](https://redirect.github.com/cert-manager/cert-manager/issues/8282), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Update Go to `v1.24.11` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#​8295](https://redirect.github.com/cert-manager/cert-manager/issues/8295), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n##### Other (Cleanup or Flake)\n\n- Update cert-manager's ACME client, forked from `golang/x/crypto` ([#​8271](https://redirect.github.com/cert-manager/cert-manager/issues/8271), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Updated Debian 12 distroless base images ([#​8328](https://redirect.github.com/cert-manager/cert-manager/issues/8328), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n### [`v1.18.3`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.18.3)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.18.2...v1.18.3)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe fixed a bug which caused certificates to be re-issued unexpectedly, if the issuerRef kind or group was changed to one of the \"runtime\" default values. We increased the size limit when parsing PEM certificate chains to handle leaf certificates with large numbers of DNS named or other identities. We upgraded Go to 1.24.9 to fix various non-critical security vulnerabilities.\n\n> \U0001F4D6 Read the [full 1.18 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.18) on the cert-manager.io website before upgrading.\n\nChanges since `v1.18.2`:\n\n##### Bug or Regression\n\n- BUGFIX: in case kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed ([#​8174](https://redirect.github.com/cert-manager/cert-manager/issues/8174), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Bump Go to 1.24.9. Fixes the following vulnerabilities: CVE-2025-61724, CVE-2025-58187, CVE-2025-47912, CVE-2025-58183, CVE-2025-61723, CVE-2025-58186, CVE-2025-58185, CVE-2025-58188, CVE-2025-61725 ([#​8176](https://redirect.github.com/cert-manager/cert-manager/issues/8176), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Increase maximum sizes of PEM certificates and chains which can be parsed in cert-manager, to handle leaf certificates with large numbers of DNS names or other identities ([#​7966](https://redirect.github.com/cert-manager/cert-manager/issues/7966), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n##### Other (Cleanup or Flake)\n\n- Improve error messages when certificates, CRLs or private keys fail admission due to malformed or missing PEM data ([#​7964](https://redirect.github.com/cert-manager/cert-manager/issues/7964), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Upgrades Go to v1.24.6 ([#​7974](https://redirect.github.com/cert-manager/cert-manager/issues/7974), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n
\n\n---\n\n### Configuration\n\n\U0001F4C5 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**: Close this PR and you won't be reminded about this update again.\n\n---\n\n - [ ] If you want to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vexxhost/atmosphere.common).\n\n" change_url: https://github.com/vexxhost/atmosphere.common/pull/105 commit_id: 4d08f80a44bc210fc0d7fbef43a9e342ced77940 patchset: 4d08f80a44bc210fc0d7fbef43a9e342ced77940 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere.common name: vexxhost/atmosphere.common short_name: atmosphere.common src_dir: src/github.com/vexxhost/atmosphere.common src_dir: src/github.com/vexxhost/atmosphere.common topic: null buildset: e7d6a0e8f1854b9ab1b72c7b43c69a8f buildset_refs: - branch: main change: '105' change_message: "chore(deps): update helm release cert-manager to v1.19.4\n\nThis PR contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n| [cert-manager](https://cert-manager.io) ([source](https://redirect.github.com/cert-manager/cert-manager)) | minor | `1.18.2` \u2192 `1.19.4` |\n\n---\n\n### Release Notes\n\n
\ncert-manager/cert-manager (cert-manager)\n\n### [`v1.19.4`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.4)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.3...v1.19.4)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nv1.19.4 is a simple patch release to fix some reported vulnerabilities - notably CVE-2026-24051 and CVE-2025-68121. All users should upgrade.\n\n#### Changes by Kind\n\n##### Bug or Regression\n\n- Bump go to address CVE-2025-68121 ([#​8526](https://redirect.github.com/cert-manager/cert-manager/issues/8526), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Bump otel SDK to address GO-2026-4394 ([#​8531](https://redirect.github.com/cert-manager/cert-manager/issues/8531), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.19.3`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.3)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.2...v1.19.3)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis release contains three bug fixes, including a fix for the MODERATE severity DoS issue in GHSA-gx3x-vq4p-mhhv. All users should upgrade to the latest release.\n\n#### Changes by Kind\n\n##### Bug or Regression\n\n- Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#​8415](https://redirect.github.com/cert-manager/cert-manager/issues/8415), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Fixed an issue where HTTP-01 challenges failed when the Host header contained an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#​8436](https://redirect.github.com/cert-manager/cert-manager/issues/8436), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#​8468](https://redirect.github.com/cert-manager/cert-manager/issues/8468), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n##### Other (Cleanup or Flake)\n\n- Bump go to 1.25.6 ([#​8459](https://redirect.github.com/cert-manager/cert-manager/issues/8459), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.19.2`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.2)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.1...v1.19.2)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe updated Go to fix some vulnerabilities in the standard library.\n\n> \U0001F4D6 Read the [full 1.19 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.19) on the cert-manager.io website before upgrading.\n\n#### Changes since `v1.19.1`\n\n##### Bug or Regression\n\n- Address false positive vulnerabilities `CVE-2025-47914` and `CVE-2025-58181` which were reported by Trivy. ([#​8283](https://redirect.github.com/cert-manager/cert-manager/issues/8283), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#​8294](https://redirect.github.com/cert-manager/cert-manager/issues/8294), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#​8233](https://redirect.github.com/cert-manager/cert-manager/issues/8233), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n##### Other (Cleanup or Flake)\n\n- Update cert-manager's ACME client, forked from `golang/x/crypto` ([#​8270](https://redirect.github.com/cert-manager/cert-manager/issues/8270), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Updated Debian 12 distroless base images ([#​8326](https://redirect.github.com/cert-manager/cert-manager/issues/8326), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n### [`v1.19.1`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.1)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.0...v1.19.1)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe reverted the CRD-based API defaults for `Certificate.Spec.IssuerRef` and `CertificateRequest.Spec.IssuerRef` after they were found to cause unexpected certificate renewals after upgrading to 1.19.0. We will try re-introducing these API defaults in cert-manager `1.20`.\nWe fixed a bug that caused certificates to be re-issued unexpectedly if the `issuerRef` kind or group was changed to one of the \"runtime\" default values.\nWe upgraded Go to `1.25.3` to address the following security vulnerabilities: `CVE-2025-61724`, `CVE-2025-58187`, `CVE-2025-47912`, `CVE-2025-58183`, `CVE-2025-61723`, `CVE-2025-58186`, `CVE-2025-58185`, `CVE-2025-58188`, and `CVE-2025-61725`.\n\n> \U0001F4D6 Read the [full 1.19 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.19) on the cert-manager.io website before upgrading.\n\nChanges since `v1.19.0`:\n\n##### Bug or Regression\n\n- BUGFIX: in case kind or group in the `issuerRef` of a Certificate was omitted, upgrading to `1.19.x` incorrectly caused the certificate to be renewed ([#​8175](https://redirect.github.com/cert-manager/cert-manager/issues/8175), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Bump Go to 1.25.3 to fix a backwards incompatible change to the validation of DNS names in X.509 SAN fields which prevented the use of DNS names with a trailing dot ([#​8177](https://redirect.github.com/cert-manager/cert-manager/issues/8177), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#​8178](https://redirect.github.com/cert-manager/cert-manager/issues/8178), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n### [`v1.19.0`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.0)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.18.5...v1.19.0)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\n> \u26A0\uFE0F **Known issues**: The following known issues are fixed in [v1.19.1](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.1):\n>\n> - [Unexpected certificate renewal after upgrading to 1.19.0](https://redirect.github.com/cert-manager/cert-manager/issues/8158)\n\nThis release focuses on expanding platform compatibility, improving deployment flexibility, enhancing observability, and addressing key reliability issues.\n\n> \U0001F4D6 Read the full release notes at cert-manager.io: \n\nChanges since `v1.18.0`:\n\n##### Feature\n\n- Add IPv6 rules to the default network policy ([#​7726](https://redirect.github.com/cert-manager/cert-manager/issues/7726), [@​jcpunk](https://redirect.github.com/jcpunk))\n- Add `global.nodeSelector` to helm chart to allow for a single `nodeSelector` to be set across all services. ([#​7818](https://redirect.github.com/cert-manager/cert-manager/issues/7818), [@​StingRayZA](https://redirect.github.com/StingRayZA))\n- Add a feature gate to default to Ingress `pathType` `Exact` in ACME HTTP01 Ingress challenge solvers. ([#​7795](https://redirect.github.com/cert-manager/cert-manager/issues/7795), [@​sspreitzer](https://redirect.github.com/sspreitzer))\n- Add generated `applyconfigurations` allowing clients to make type-safe server-side apply requests for cert-manager resources. ([#​7866](https://redirect.github.com/cert-manager/cert-manager/issues/7866), [@​erikgb](https://redirect.github.com/erikgb))\n- Added API defaults to issuer references group (cert-manager.io) and kind (Issuer). ([#​7414](https://redirect.github.com/cert-manager/cert-manager/issues/7414), [@​erikgb](https://redirect.github.com/erikgb))\n- Added `certmanager_certificate_challenge_status` Prometheus metric. ([#​7736](https://redirect.github.com/cert-manager/cert-manager/issues/7736), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added `protocol` field for `rfc2136` DNS01 provider ([#​7881](https://redirect.github.com/cert-manager/cert-manager/issues/7881), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added experimental field `hostUsers` flag to all pods. Not set by default. ([#​7973](https://redirect.github.com/cert-manager/cert-manager/issues/7973), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Support configurable resource requests and limits for ACME HTTP01 solver pods through ClusterIssuer and Issuer specifications, allowing granular resource management that overrides global `--acme-http01-solver-resource-*` settings. ([#​7972](https://redirect.github.com/cert-manager/cert-manager/issues/7972), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- The `CAInjectorMerging` feature has been promoted to BETA and is now enabled by default ([#​8017](https://redirect.github.com/cert-manager/cert-manager/issues/8017), [@​ThatsMrTalbot](https://redirect.github.com/ThatsMrTalbot))\n- The controller, webhook and ca-injector now log their version and git commit on startup for easier debugging and support. ([#​8072](https://redirect.github.com/cert-manager/cert-manager/issues/8072), [@​prasad89](https://redirect.github.com/prasad89))\n- Updated `certificate` metrics to the collector approach. ([#​7856](https://redirect.github.com/cert-manager/cert-manager/issues/7856), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n\n##### Bug or Regression\n\n- ACME: Increased challenge authorization timeout to 2 minutes to fix `error waiting for authorization` ([#​7796](https://redirect.github.com/cert-manager/cert-manager/issues/7796), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- BUGFIX: permitted URI domains were incorrectly used to set the excluded URI domains in the CSR's name constraints ([#​7816](https://redirect.github.com/cert-manager/cert-manager/issues/7816), [@​kinolaev](https://redirect.github.com/kinolaev))\n- Enforced ACME HTTP-01 solver validation to properly reject configurations when multiple ingress options (`class`, `ingressClassName`, `name`) are specified simultaneously ([#​8021](https://redirect.github.com/cert-manager/cert-manager/issues/8021), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Increase maximum sizes of PEM certificates and chains which can be parsed in cert-manager, to handle leaf certificates with large numbers of DNS names or other identities ([#​7961](https://redirect.github.com/cert-manager/cert-manager/issues/7961), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Reverted adding the `global.rbac.disableHTTPChallengesRole` Helm option. ([#​7836](https://redirect.github.com/cert-manager/cert-manager/issues/7836), [@​inteon](https://redirect.github.com/inteon))\n- This change removes the `path` label of core ACME client metrics and will require users to update their monitoring dashboards and alerting rules if using those metrics. ([#​8109](https://redirect.github.com/cert-manager/cert-manager/issues/8109), [@​mladen-rusev-cyberark](https://redirect.github.com/mladen-rusev-cyberark))\n- Use the latest version of `ingress-nginx` in E2E tests to ensure compatibility ([#​7792](https://redirect.github.com/cert-manager/cert-manager/issues/7792), [@​wallrj](https://redirect.github.com/wallrj))\n\n##### Other (Cleanup or Flake)\n\n- Helm: Fix naming template of `tokenrequest` RoleBinding resource to improve consistency ([#​7761](https://redirect.github.com/cert-manager/cert-manager/issues/7761), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Improve error messages when certificates, CRLs or private keys fail admission due to malformed or missing PEM data ([#​7928](https://redirect.github.com/cert-manager/cert-manager/issues/7928), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Major upgrade of Akamai SDK. NOTE: The new version has not been fully tested end-to-end due to the lack of cloud infrastructure. ([#​8003](https://redirect.github.com/cert-manager/cert-manager/issues/8003), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Update kind images to include the Kubernetes 1.33 node image ([#​7786](https://redirect.github.com/cert-manager/cert-manager/issues/7786), [@​wallrj](https://redirect.github.com/wallrj))\n- Use `maps.Copy` for cleaner map handling ([#​8092](https://redirect.github.com/cert-manager/cert-manager/issues/8092), [@​quantpoet](https://redirect.github.com/quantpoet))\n- Vault: Migrate Vault E2E add-on tests from deprecated `vault-client-go` to the new `vault/api` client. ([#​8059](https://redirect.github.com/cert-manager/cert-manager/issues/8059), [@​armagankaratosun](https://redirect.github.com/armagankaratosun))\n\n### [`v1.18.5`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.18.5)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.18.4...v1.18.5)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis release contains three bug fixes, including a fix for the MODERATE severity DoS issue in GHSA-gx3x-vq4p-mhhv. All users should upgrade to the latest release.\n\n##### Changes by Kind\n\n##### Bug or Regression\n\n- Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#​8414](https://redirect.github.com/cert-manager/cert-manager/issues/8414), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#​8437](https://redirect.github.com/cert-manager/cert-manager/issues/8437), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#​8467](https://redirect.github.com/cert-manager/cert-manager/issues/8467), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n##### Other (Cleanup or Flake)\n\n- Bump go to 1.24.12 ([#​8460](https://redirect.github.com/cert-manager/cert-manager/issues/8460), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.18.4`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.18.4)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.18.3...v1.18.4)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe updated Go to fix some vulnerabilities in the standard library.\n\n> \U0001F4D6 Read the [full 1.18 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.18) on the cert-manager.io website before upgrading.\n\n##### Changes since `v1.18.3`\n\n##### Bug or Regression\n\n- Address false positive vulnerabilities `CVE-2025-47914` and `CVE-2025-58181` which were reported by Trivy. ([#​8282](https://redirect.github.com/cert-manager/cert-manager/issues/8282), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Update Go to `v1.24.11` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#​8295](https://redirect.github.com/cert-manager/cert-manager/issues/8295), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n##### Other (Cleanup or Flake)\n\n- Update cert-manager's ACME client, forked from `golang/x/crypto` ([#​8271](https://redirect.github.com/cert-manager/cert-manager/issues/8271), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Updated Debian 12 distroless base images ([#​8328](https://redirect.github.com/cert-manager/cert-manager/issues/8328), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n### [`v1.18.3`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.18.3)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.18.2...v1.18.3)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe fixed a bug which caused certificates to be re-issued unexpectedly, if the issuerRef kind or group was changed to one of the \"runtime\" default values. We increased the size limit when parsing PEM certificate chains to handle leaf certificates with large numbers of DNS named or other identities. We upgraded Go to 1.24.9 to fix various non-critical security vulnerabilities.\n\n> \U0001F4D6 Read the [full 1.18 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.18) on the cert-manager.io website before upgrading.\n\nChanges since `v1.18.2`:\n\n##### Bug or Regression\n\n- BUGFIX: in case kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed ([#​8174](https://redirect.github.com/cert-manager/cert-manager/issues/8174), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Bump Go to 1.24.9. Fixes the following vulnerabilities: CVE-2025-61724, CVE-2025-58187, CVE-2025-47912, CVE-2025-58183, CVE-2025-61723, CVE-2025-58186, CVE-2025-58185, CVE-2025-58188, CVE-2025-61725 ([#​8176](https://redirect.github.com/cert-manager/cert-manager/issues/8176), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Increase maximum sizes of PEM certificates and chains which can be parsed in cert-manager, to handle leaf certificates with large numbers of DNS names or other identities ([#​7966](https://redirect.github.com/cert-manager/cert-manager/issues/7966), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n##### Other (Cleanup or Flake)\n\n- Improve error messages when certificates, CRLs or private keys fail admission due to malformed or missing PEM data ([#​7964](https://redirect.github.com/cert-manager/cert-manager/issues/7964), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Upgrades Go to v1.24.6 ([#​7974](https://redirect.github.com/cert-manager/cert-manager/issues/7974), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n
\n\n---\n\n### Configuration\n\n\U0001F4C5 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**: Close this PR and you won't be reminded about this update again.\n\n---\n\n - [ ] If you want to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vexxhost/atmosphere.common).\n\n" change_url: https://github.com/vexxhost/atmosphere.common/pull/105 commit_id: 4d08f80a44bc210fc0d7fbef43a9e342ced77940 patchset: 4d08f80a44bc210fc0d7fbef43a9e342ced77940 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere.common name: vexxhost/atmosphere.common short_name: atmosphere.common src_dir: src/github.com/vexxhost/atmosphere.common src_dir: src/github.com/vexxhost/atmosphere.common topic: null change: '105' change_message: "chore(deps): update helm release cert-manager to v1.19.4\n\nThis PR contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n| [cert-manager](https://cert-manager.io) ([source](https://redirect.github.com/cert-manager/cert-manager)) | minor | `1.18.2` \u2192 `1.19.4` |\n\n---\n\n### Release Notes\n\n
\ncert-manager/cert-manager (cert-manager)\n\n### [`v1.19.4`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.4)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.3...v1.19.4)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nv1.19.4 is a simple patch release to fix some reported vulnerabilities - notably CVE-2026-24051 and CVE-2025-68121. All users should upgrade.\n\n#### Changes by Kind\n\n##### Bug or Regression\n\n- Bump go to address CVE-2025-68121 ([#​8526](https://redirect.github.com/cert-manager/cert-manager/issues/8526), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Bump otel SDK to address GO-2026-4394 ([#​8531](https://redirect.github.com/cert-manager/cert-manager/issues/8531), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.19.3`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.3)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.2...v1.19.3)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis release contains three bug fixes, including a fix for the MODERATE severity DoS issue in GHSA-gx3x-vq4p-mhhv. All users should upgrade to the latest release.\n\n#### Changes by Kind\n\n##### Bug or Regression\n\n- Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#​8415](https://redirect.github.com/cert-manager/cert-manager/issues/8415), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Fixed an issue where HTTP-01 challenges failed when the Host header contained an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#​8436](https://redirect.github.com/cert-manager/cert-manager/issues/8436), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#​8468](https://redirect.github.com/cert-manager/cert-manager/issues/8468), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n##### Other (Cleanup or Flake)\n\n- Bump go to 1.25.6 ([#​8459](https://redirect.github.com/cert-manager/cert-manager/issues/8459), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.19.2`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.2)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.1...v1.19.2)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe updated Go to fix some vulnerabilities in the standard library.\n\n> \U0001F4D6 Read the [full 1.19 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.19) on the cert-manager.io website before upgrading.\n\n#### Changes since `v1.19.1`\n\n##### Bug or Regression\n\n- Address false positive vulnerabilities `CVE-2025-47914` and `CVE-2025-58181` which were reported by Trivy. ([#​8283](https://redirect.github.com/cert-manager/cert-manager/issues/8283), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#​8294](https://redirect.github.com/cert-manager/cert-manager/issues/8294), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#​8233](https://redirect.github.com/cert-manager/cert-manager/issues/8233), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n##### Other (Cleanup or Flake)\n\n- Update cert-manager's ACME client, forked from `golang/x/crypto` ([#​8270](https://redirect.github.com/cert-manager/cert-manager/issues/8270), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Updated Debian 12 distroless base images ([#​8326](https://redirect.github.com/cert-manager/cert-manager/issues/8326), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n### [`v1.19.1`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.1)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.0...v1.19.1)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe reverted the CRD-based API defaults for `Certificate.Spec.IssuerRef` and `CertificateRequest.Spec.IssuerRef` after they were found to cause unexpected certificate renewals after upgrading to 1.19.0. We will try re-introducing these API defaults in cert-manager `1.20`.\nWe fixed a bug that caused certificates to be re-issued unexpectedly if the `issuerRef` kind or group was changed to one of the \"runtime\" default values.\nWe upgraded Go to `1.25.3` to address the following security vulnerabilities: `CVE-2025-61724`, `CVE-2025-58187`, `CVE-2025-47912`, `CVE-2025-58183`, `CVE-2025-61723`, `CVE-2025-58186`, `CVE-2025-58185`, `CVE-2025-58188`, and `CVE-2025-61725`.\n\n> \U0001F4D6 Read the [full 1.19 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.19) on the cert-manager.io website before upgrading.\n\nChanges since `v1.19.0`:\n\n##### Bug or Regression\n\n- BUGFIX: in case kind or group in the `issuerRef` of a Certificate was omitted, upgrading to `1.19.x` incorrectly caused the certificate to be renewed ([#​8175](https://redirect.github.com/cert-manager/cert-manager/issues/8175), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Bump Go to 1.25.3 to fix a backwards incompatible change to the validation of DNS names in X.509 SAN fields which prevented the use of DNS names with a trailing dot ([#​8177](https://redirect.github.com/cert-manager/cert-manager/issues/8177), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#​8178](https://redirect.github.com/cert-manager/cert-manager/issues/8178), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n### [`v1.19.0`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.0)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.18.5...v1.19.0)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\n> \u26A0\uFE0F **Known issues**: The following known issues are fixed in [v1.19.1](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.1):\n>\n> - [Unexpected certificate renewal after upgrading to 1.19.0](https://redirect.github.com/cert-manager/cert-manager/issues/8158)\n\nThis release focuses on expanding platform compatibility, improving deployment flexibility, enhancing observability, and addressing key reliability issues.\n\n> \U0001F4D6 Read the full release notes at cert-manager.io: \n\nChanges since `v1.18.0`:\n\n##### Feature\n\n- Add IPv6 rules to the default network policy ([#​7726](https://redirect.github.com/cert-manager/cert-manager/issues/7726), [@​jcpunk](https://redirect.github.com/jcpunk))\n- Add `global.nodeSelector` to helm chart to allow for a single `nodeSelector` to be set across all services. ([#​7818](https://redirect.github.com/cert-manager/cert-manager/issues/7818), [@​StingRayZA](https://redirect.github.com/StingRayZA))\n- Add a feature gate to default to Ingress `pathType` `Exact` in ACME HTTP01 Ingress challenge solvers. ([#​7795](https://redirect.github.com/cert-manager/cert-manager/issues/7795), [@​sspreitzer](https://redirect.github.com/sspreitzer))\n- Add generated `applyconfigurations` allowing clients to make type-safe server-side apply requests for cert-manager resources. ([#​7866](https://redirect.github.com/cert-manager/cert-manager/issues/7866), [@​erikgb](https://redirect.github.com/erikgb))\n- Added API defaults to issuer references group (cert-manager.io) and kind (Issuer). ([#​7414](https://redirect.github.com/cert-manager/cert-manager/issues/7414), [@​erikgb](https://redirect.github.com/erikgb))\n- Added `certmanager_certificate_challenge_status` Prometheus metric. ([#​7736](https://redirect.github.com/cert-manager/cert-manager/issues/7736), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added `protocol` field for `rfc2136` DNS01 provider ([#​7881](https://redirect.github.com/cert-manager/cert-manager/issues/7881), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added experimental field `hostUsers` flag to all pods. Not set by default. ([#​7973](https://redirect.github.com/cert-manager/cert-manager/issues/7973), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Support configurable resource requests and limits for ACME HTTP01 solver pods through ClusterIssuer and Issuer specifications, allowing granular resource management that overrides global `--acme-http01-solver-resource-*` settings. ([#​7972](https://redirect.github.com/cert-manager/cert-manager/issues/7972), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- The `CAInjectorMerging` feature has been promoted to BETA and is now enabled by default ([#​8017](https://redirect.github.com/cert-manager/cert-manager/issues/8017), [@​ThatsMrTalbot](https://redirect.github.com/ThatsMrTalbot))\n- The controller, webhook and ca-injector now log their version and git commit on startup for easier debugging and support. ([#​8072](https://redirect.github.com/cert-manager/cert-manager/issues/8072), [@​prasad89](https://redirect.github.com/prasad89))\n- Updated `certificate` metrics to the collector approach. ([#​7856](https://redirect.github.com/cert-manager/cert-manager/issues/7856), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n\n##### Bug or Regression\n\n- ACME: Increased challenge authorization timeout to 2 minutes to fix `error waiting for authorization` ([#​7796](https://redirect.github.com/cert-manager/cert-manager/issues/7796), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- BUGFIX: permitted URI domains were incorrectly used to set the excluded URI domains in the CSR's name constraints ([#​7816](https://redirect.github.com/cert-manager/cert-manager/issues/7816), [@​kinolaev](https://redirect.github.com/kinolaev))\n- Enforced ACME HTTP-01 solver validation to properly reject configurations when multiple ingress options (`class`, `ingressClassName`, `name`) are specified simultaneously ([#​8021](https://redirect.github.com/cert-manager/cert-manager/issues/8021), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Increase maximum sizes of PEM certificates and chains which can be parsed in cert-manager, to handle leaf certificates with large numbers of DNS names or other identities ([#​7961](https://redirect.github.com/cert-manager/cert-manager/issues/7961), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Reverted adding the `global.rbac.disableHTTPChallengesRole` Helm option. ([#​7836](https://redirect.github.com/cert-manager/cert-manager/issues/7836), [@​inteon](https://redirect.github.com/inteon))\n- This change removes the `path` label of core ACME client metrics and will require users to update their monitoring dashboards and alerting rules if using those metrics. ([#​8109](https://redirect.github.com/cert-manager/cert-manager/issues/8109), [@​mladen-rusev-cyberark](https://redirect.github.com/mladen-rusev-cyberark))\n- Use the latest version of `ingress-nginx` in E2E tests to ensure compatibility ([#​7792](https://redirect.github.com/cert-manager/cert-manager/issues/7792), [@​wallrj](https://redirect.github.com/wallrj))\n\n##### Other (Cleanup or Flake)\n\n- Helm: Fix naming template of `tokenrequest` RoleBinding resource to improve consistency ([#​7761](https://redirect.github.com/cert-manager/cert-manager/issues/7761), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Improve error messages when certificates, CRLs or private keys fail admission due to malformed or missing PEM data ([#​7928](https://redirect.github.com/cert-manager/cert-manager/issues/7928), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Major upgrade of Akamai SDK. NOTE: The new version has not been fully tested end-to-end due to the lack of cloud infrastructure. ([#​8003](https://redirect.github.com/cert-manager/cert-manager/issues/8003), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Update kind images to include the Kubernetes 1.33 node image ([#​7786](https://redirect.github.com/cert-manager/cert-manager/issues/7786), [@​wallrj](https://redirect.github.com/wallrj))\n- Use `maps.Copy` for cleaner map handling ([#​8092](https://redirect.github.com/cert-manager/cert-manager/issues/8092), [@​quantpoet](https://redirect.github.com/quantpoet))\n- Vault: Migrate Vault E2E add-on tests from deprecated `vault-client-go` to the new `vault/api` client. ([#​8059](https://redirect.github.com/cert-manager/cert-manager/issues/8059), [@​armagankaratosun](https://redirect.github.com/armagankaratosun))\n\n### [`v1.18.5`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.18.5)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.18.4...v1.18.5)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis release contains three bug fixes, including a fix for the MODERATE severity DoS issue in GHSA-gx3x-vq4p-mhhv. All users should upgrade to the latest release.\n\n##### Changes by Kind\n\n##### Bug or Regression\n\n- Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#​8414](https://redirect.github.com/cert-manager/cert-manager/issues/8414), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#​8437](https://redirect.github.com/cert-manager/cert-manager/issues/8437), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#​8467](https://redirect.github.com/cert-manager/cert-manager/issues/8467), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n##### Other (Cleanup or Flake)\n\n- Bump go to 1.24.12 ([#​8460](https://redirect.github.com/cert-manager/cert-manager/issues/8460), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.18.4`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.18.4)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.18.3...v1.18.4)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe updated Go to fix some vulnerabilities in the standard library.\n\n> \U0001F4D6 Read the [full 1.18 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.18) on the cert-manager.io website before upgrading.\n\n##### Changes since `v1.18.3`\n\n##### Bug or Regression\n\n- Address false positive vulnerabilities `CVE-2025-47914` and `CVE-2025-58181` which were reported by Trivy. ([#​8282](https://redirect.github.com/cert-manager/cert-manager/issues/8282), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Update Go to `v1.24.11` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#​8295](https://redirect.github.com/cert-manager/cert-manager/issues/8295), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n##### Other (Cleanup or Flake)\n\n- Update cert-manager's ACME client, forked from `golang/x/crypto` ([#​8271](https://redirect.github.com/cert-manager/cert-manager/issues/8271), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Updated Debian 12 distroless base images ([#​8328](https://redirect.github.com/cert-manager/cert-manager/issues/8328), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n### [`v1.18.3`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.18.3)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.18.2...v1.18.3)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe fixed a bug which caused certificates to be re-issued unexpectedly, if the issuerRef kind or group was changed to one of the \"runtime\" default values. We increased the size limit when parsing PEM certificate chains to handle leaf certificates with large numbers of DNS named or other identities. We upgraded Go to 1.24.9 to fix various non-critical security vulnerabilities.\n\n> \U0001F4D6 Read the [full 1.18 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.18) on the cert-manager.io website before upgrading.\n\nChanges since `v1.18.2`:\n\n##### Bug or Regression\n\n- BUGFIX: in case kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed ([#​8174](https://redirect.github.com/cert-manager/cert-manager/issues/8174), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Bump Go to 1.24.9. Fixes the following vulnerabilities: CVE-2025-61724, CVE-2025-58187, CVE-2025-47912, CVE-2025-58183, CVE-2025-61723, CVE-2025-58186, CVE-2025-58185, CVE-2025-58188, CVE-2025-61725 ([#​8176](https://redirect.github.com/cert-manager/cert-manager/issues/8176), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Increase maximum sizes of PEM certificates and chains which can be parsed in cert-manager, to handle leaf certificates with large numbers of DNS names or other identities ([#​7966](https://redirect.github.com/cert-manager/cert-manager/issues/7966), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n##### Other (Cleanup or Flake)\n\n- Improve error messages when certificates, CRLs or private keys fail admission due to malformed or missing PEM data ([#​7964](https://redirect.github.com/cert-manager/cert-manager/issues/7964), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Upgrades Go to v1.24.6 ([#​7974](https://redirect.github.com/cert-manager/cert-manager/issues/7974), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n
\n\n---\n\n### Configuration\n\n\U0001F4C5 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**: Close this PR and you won't be reminded about this update again.\n\n---\n\n - [ ] If you want to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vexxhost/atmosphere.common).\n\n" change_url: https://github.com/vexxhost/atmosphere.common/pull/105 child_jobs: [] commit_id: 4d08f80a44bc210fc0d7fbef43a9e342ced77940 event_id: d2905f00-11ac-11f1-8ba3-eecce1043af3 executor: hostname: 0a8996d2b663 inventory_file: /var/lib/zuul/builds/9910fef712154efba333571183ffc995/ansible/inventory.yaml log_root: /var/lib/zuul/builds/9910fef712154efba333571183ffc995/work/logs result_data_file: /var/lib/zuul/builds/9910fef712154efba333571183ffc995/work/results.json src_root: /var/lib/zuul/builds/9910fef712154efba333571183ffc995/work/src work_root: /var/lib/zuul/builds/9910fef712154efba333571183ffc995/work include_vars: [] items: - branch: main change: '105' change_message: "chore(deps): update helm release cert-manager to v1.19.4\n\nThis PR contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n| [cert-manager](https://cert-manager.io) ([source](https://redirect.github.com/cert-manager/cert-manager)) | minor | `1.18.2` \u2192 `1.19.4` |\n\n---\n\n### Release Notes\n\n
\ncert-manager/cert-manager (cert-manager)\n\n### [`v1.19.4`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.4)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.3...v1.19.4)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nv1.19.4 is a simple patch release to fix some reported vulnerabilities - notably CVE-2026-24051 and CVE-2025-68121. All users should upgrade.\n\n#### Changes by Kind\n\n##### Bug or Regression\n\n- Bump go to address CVE-2025-68121 ([#​8526](https://redirect.github.com/cert-manager/cert-manager/issues/8526), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Bump otel SDK to address GO-2026-4394 ([#​8531](https://redirect.github.com/cert-manager/cert-manager/issues/8531), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.19.3`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.3)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.2...v1.19.3)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis release contains three bug fixes, including a fix for the MODERATE severity DoS issue in GHSA-gx3x-vq4p-mhhv. All users should upgrade to the latest release.\n\n#### Changes by Kind\n\n##### Bug or Regression\n\n- Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#​8415](https://redirect.github.com/cert-manager/cert-manager/issues/8415), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Fixed an issue where HTTP-01 challenges failed when the Host header contained an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#​8436](https://redirect.github.com/cert-manager/cert-manager/issues/8436), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#​8468](https://redirect.github.com/cert-manager/cert-manager/issues/8468), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n##### Other (Cleanup or Flake)\n\n- Bump go to 1.25.6 ([#​8459](https://redirect.github.com/cert-manager/cert-manager/issues/8459), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.19.2`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.2)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.1...v1.19.2)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe updated Go to fix some vulnerabilities in the standard library.\n\n> \U0001F4D6 Read the [full 1.19 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.19) on the cert-manager.io website before upgrading.\n\n#### Changes since `v1.19.1`\n\n##### Bug or Regression\n\n- Address false positive vulnerabilities `CVE-2025-47914` and `CVE-2025-58181` which were reported by Trivy. ([#​8283](https://redirect.github.com/cert-manager/cert-manager/issues/8283), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#​8294](https://redirect.github.com/cert-manager/cert-manager/issues/8294), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#​8233](https://redirect.github.com/cert-manager/cert-manager/issues/8233), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n##### Other (Cleanup or Flake)\n\n- Update cert-manager's ACME client, forked from `golang/x/crypto` ([#​8270](https://redirect.github.com/cert-manager/cert-manager/issues/8270), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Updated Debian 12 distroless base images ([#​8326](https://redirect.github.com/cert-manager/cert-manager/issues/8326), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n### [`v1.19.1`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.1)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.0...v1.19.1)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe reverted the CRD-based API defaults for `Certificate.Spec.IssuerRef` and `CertificateRequest.Spec.IssuerRef` after they were found to cause unexpected certificate renewals after upgrading to 1.19.0. We will try re-introducing these API defaults in cert-manager `1.20`.\nWe fixed a bug that caused certificates to be re-issued unexpectedly if the `issuerRef` kind or group was changed to one of the \"runtime\" default values.\nWe upgraded Go to `1.25.3` to address the following security vulnerabilities: `CVE-2025-61724`, `CVE-2025-58187`, `CVE-2025-47912`, `CVE-2025-58183`, `CVE-2025-61723`, `CVE-2025-58186`, `CVE-2025-58185`, `CVE-2025-58188`, and `CVE-2025-61725`.\n\n> \U0001F4D6 Read the [full 1.19 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.19) on the cert-manager.io website before upgrading.\n\nChanges since `v1.19.0`:\n\n##### Bug or Regression\n\n- BUGFIX: in case kind or group in the `issuerRef` of a Certificate was omitted, upgrading to `1.19.x` incorrectly caused the certificate to be renewed ([#​8175](https://redirect.github.com/cert-manager/cert-manager/issues/8175), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Bump Go to 1.25.3 to fix a backwards incompatible change to the validation of DNS names in X.509 SAN fields which prevented the use of DNS names with a trailing dot ([#​8177](https://redirect.github.com/cert-manager/cert-manager/issues/8177), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#​8178](https://redirect.github.com/cert-manager/cert-manager/issues/8178), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n### [`v1.19.0`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.0)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.18.5...v1.19.0)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\n> \u26A0\uFE0F **Known issues**: The following known issues are fixed in [v1.19.1](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.1):\n>\n> - [Unexpected certificate renewal after upgrading to 1.19.0](https://redirect.github.com/cert-manager/cert-manager/issues/8158)\n\nThis release focuses on expanding platform compatibility, improving deployment flexibility, enhancing observability, and addressing key reliability issues.\n\n> \U0001F4D6 Read the full release notes at cert-manager.io: \n\nChanges since `v1.18.0`:\n\n##### Feature\n\n- Add IPv6 rules to the default network policy ([#​7726](https://redirect.github.com/cert-manager/cert-manager/issues/7726), [@​jcpunk](https://redirect.github.com/jcpunk))\n- Add `global.nodeSelector` to helm chart to allow for a single `nodeSelector` to be set across all services. ([#​7818](https://redirect.github.com/cert-manager/cert-manager/issues/7818), [@​StingRayZA](https://redirect.github.com/StingRayZA))\n- Add a feature gate to default to Ingress `pathType` `Exact` in ACME HTTP01 Ingress challenge solvers. ([#​7795](https://redirect.github.com/cert-manager/cert-manager/issues/7795), [@​sspreitzer](https://redirect.github.com/sspreitzer))\n- Add generated `applyconfigurations` allowing clients to make type-safe server-side apply requests for cert-manager resources. ([#​7866](https://redirect.github.com/cert-manager/cert-manager/issues/7866), [@​erikgb](https://redirect.github.com/erikgb))\n- Added API defaults to issuer references group (cert-manager.io) and kind (Issuer). ([#​7414](https://redirect.github.com/cert-manager/cert-manager/issues/7414), [@​erikgb](https://redirect.github.com/erikgb))\n- Added `certmanager_certificate_challenge_status` Prometheus metric. ([#​7736](https://redirect.github.com/cert-manager/cert-manager/issues/7736), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added `protocol` field for `rfc2136` DNS01 provider ([#​7881](https://redirect.github.com/cert-manager/cert-manager/issues/7881), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added experimental field `hostUsers` flag to all pods. Not set by default. ([#​7973](https://redirect.github.com/cert-manager/cert-manager/issues/7973), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Support configurable resource requests and limits for ACME HTTP01 solver pods through ClusterIssuer and Issuer specifications, allowing granular resource management that overrides global `--acme-http01-solver-resource-*` settings. ([#​7972](https://redirect.github.com/cert-manager/cert-manager/issues/7972), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- The `CAInjectorMerging` feature has been promoted to BETA and is now enabled by default ([#​8017](https://redirect.github.com/cert-manager/cert-manager/issues/8017), [@​ThatsMrTalbot](https://redirect.github.com/ThatsMrTalbot))\n- The controller, webhook and ca-injector now log their version and git commit on startup for easier debugging and support. ([#​8072](https://redirect.github.com/cert-manager/cert-manager/issues/8072), [@​prasad89](https://redirect.github.com/prasad89))\n- Updated `certificate` metrics to the collector approach. ([#​7856](https://redirect.github.com/cert-manager/cert-manager/issues/7856), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n\n##### Bug or Regression\n\n- ACME: Increased challenge authorization timeout to 2 minutes to fix `error waiting for authorization` ([#​7796](https://redirect.github.com/cert-manager/cert-manager/issues/7796), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- BUGFIX: permitted URI domains were incorrectly used to set the excluded URI domains in the CSR's name constraints ([#​7816](https://redirect.github.com/cert-manager/cert-manager/issues/7816), [@​kinolaev](https://redirect.github.com/kinolaev))\n- Enforced ACME HTTP-01 solver validation to properly reject configurations when multiple ingress options (`class`, `ingressClassName`, `name`) are specified simultaneously ([#​8021](https://redirect.github.com/cert-manager/cert-manager/issues/8021), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Increase maximum sizes of PEM certificates and chains which can be parsed in cert-manager, to handle leaf certificates with large numbers of DNS names or other identities ([#​7961](https://redirect.github.com/cert-manager/cert-manager/issues/7961), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Reverted adding the `global.rbac.disableHTTPChallengesRole` Helm option. ([#​7836](https://redirect.github.com/cert-manager/cert-manager/issues/7836), [@​inteon](https://redirect.github.com/inteon))\n- This change removes the `path` label of core ACME client metrics and will require users to update their monitoring dashboards and alerting rules if using those metrics. ([#​8109](https://redirect.github.com/cert-manager/cert-manager/issues/8109), [@​mladen-rusev-cyberark](https://redirect.github.com/mladen-rusev-cyberark))\n- Use the latest version of `ingress-nginx` in E2E tests to ensure compatibility ([#​7792](https://redirect.github.com/cert-manager/cert-manager/issues/7792), [@​wallrj](https://redirect.github.com/wallrj))\n\n##### Other (Cleanup or Flake)\n\n- Helm: Fix naming template of `tokenrequest` RoleBinding resource to improve consistency ([#​7761](https://redirect.github.com/cert-manager/cert-manager/issues/7761), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Improve error messages when certificates, CRLs or private keys fail admission due to malformed or missing PEM data ([#​7928](https://redirect.github.com/cert-manager/cert-manager/issues/7928), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Major upgrade of Akamai SDK. NOTE: The new version has not been fully tested end-to-end due to the lack of cloud infrastructure. ([#​8003](https://redirect.github.com/cert-manager/cert-manager/issues/8003), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Update kind images to include the Kubernetes 1.33 node image ([#​7786](https://redirect.github.com/cert-manager/cert-manager/issues/7786), [@​wallrj](https://redirect.github.com/wallrj))\n- Use `maps.Copy` for cleaner map handling ([#​8092](https://redirect.github.com/cert-manager/cert-manager/issues/8092), [@​quantpoet](https://redirect.github.com/quantpoet))\n- Vault: Migrate Vault E2E add-on tests from deprecated `vault-client-go` to the new `vault/api` client. ([#​8059](https://redirect.github.com/cert-manager/cert-manager/issues/8059), [@​armagankaratosun](https://redirect.github.com/armagankaratosun))\n\n### [`v1.18.5`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.18.5)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.18.4...v1.18.5)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis release contains three bug fixes, including a fix for the MODERATE severity DoS issue in GHSA-gx3x-vq4p-mhhv. All users should upgrade to the latest release.\n\n##### Changes by Kind\n\n##### Bug or Regression\n\n- Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#​8414](https://redirect.github.com/cert-manager/cert-manager/issues/8414), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#​8437](https://redirect.github.com/cert-manager/cert-manager/issues/8437), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#​8467](https://redirect.github.com/cert-manager/cert-manager/issues/8467), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n##### Other (Cleanup or Flake)\n\n- Bump go to 1.24.12 ([#​8460](https://redirect.github.com/cert-manager/cert-manager/issues/8460), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.18.4`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.18.4)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.18.3...v1.18.4)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe updated Go to fix some vulnerabilities in the standard library.\n\n> \U0001F4D6 Read the [full 1.18 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.18) on the cert-manager.io website before upgrading.\n\n##### Changes since `v1.18.3`\n\n##### Bug or Regression\n\n- Address false positive vulnerabilities `CVE-2025-47914` and `CVE-2025-58181` which were reported by Trivy. ([#​8282](https://redirect.github.com/cert-manager/cert-manager/issues/8282), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Update Go to `v1.24.11` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#​8295](https://redirect.github.com/cert-manager/cert-manager/issues/8295), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n##### Other (Cleanup or Flake)\n\n- Update cert-manager's ACME client, forked from `golang/x/crypto` ([#​8271](https://redirect.github.com/cert-manager/cert-manager/issues/8271), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Updated Debian 12 distroless base images ([#​8328](https://redirect.github.com/cert-manager/cert-manager/issues/8328), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n### [`v1.18.3`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.18.3)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.18.2...v1.18.3)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe fixed a bug which caused certificates to be re-issued unexpectedly, if the issuerRef kind or group was changed to one of the \"runtime\" default values. We increased the size limit when parsing PEM certificate chains to handle leaf certificates with large numbers of DNS named or other identities. We upgraded Go to 1.24.9 to fix various non-critical security vulnerabilities.\n\n> \U0001F4D6 Read the [full 1.18 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.18) on the cert-manager.io website before upgrading.\n\nChanges since `v1.18.2`:\n\n##### Bug or Regression\n\n- BUGFIX: in case kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed ([#​8174](https://redirect.github.com/cert-manager/cert-manager/issues/8174), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Bump Go to 1.24.9. Fixes the following vulnerabilities: CVE-2025-61724, CVE-2025-58187, CVE-2025-47912, CVE-2025-58183, CVE-2025-61723, CVE-2025-58186, CVE-2025-58185, CVE-2025-58188, CVE-2025-61725 ([#​8176](https://redirect.github.com/cert-manager/cert-manager/issues/8176), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Increase maximum sizes of PEM certificates and chains which can be parsed in cert-manager, to handle leaf certificates with large numbers of DNS names or other identities ([#​7966](https://redirect.github.com/cert-manager/cert-manager/issues/7966), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n##### Other (Cleanup or Flake)\n\n- Improve error messages when certificates, CRLs or private keys fail admission due to malformed or missing PEM data ([#​7964](https://redirect.github.com/cert-manager/cert-manager/issues/7964), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Upgrades Go to v1.24.6 ([#​7974](https://redirect.github.com/cert-manager/cert-manager/issues/7974), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n
\n\n---\n\n### Configuration\n\n\U0001F4C5 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**: Close this PR and you won't be reminded about this update again.\n\n---\n\n - [ ] If you want to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vexxhost/atmosphere.common).\n\n" change_url: https://github.com/vexxhost/atmosphere.common/pull/105 commit_id: 4d08f80a44bc210fc0d7fbef43a9e342ced77940 patchset: 4d08f80a44bc210fc0d7fbef43a9e342ced77940 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere.common name: vexxhost/atmosphere.common short_name: atmosphere.common src_dir: src/github.com/vexxhost/atmosphere.common topic: null job: atmosphere-common-molecule-secretgen-controller jobtags: [] max_attempts: 3 message: Y2hvcmUoZGVwcyk6IHVwZGF0ZSBoZWxtIHJlbGVhc2UgY2VydC1tYW5hZ2VyIHRvIHYxLjE5LjQKClRoaXMgUFIgY29udGFpbnMgdGhlIGZvbGxvd2luZyB1cGRhdGVzOgoKfCBQYWNrYWdlIHwgVXBkYXRlIHwgQ2hhbmdlIHwKfC0tLXwtLS18LS0tfAp8IFtjZXJ0LW1hbmFnZXJdKGh0dHBzOi8vY2VydC1tYW5hZ2VyLmlvKSAoW3NvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIpKSB8IG1pbm9yIHwgYDEuMTguMmAg4oaSIGAxLjE5LjRgIHwKCi0tLQoKIyMjIFJlbGVhc2UgTm90ZXMKCjxkZXRhaWxzPgo8c3VtbWFyeT5jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyIChjZXJ0LW1hbmFnZXIpPC9zdW1tYXJ5PgoKIyMjIFtgdjEuMTkuNGBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL3JlbGVhc2VzL3RhZy92MS4xOS40KQoKW0NvbXBhcmUgU291cmNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9jb21wYXJlL3YxLjE5LjMuLi52MS4xOS40KQoKY2VydC1tYW5hZ2VyIGlzIHRoZSBlYXNpZXN0IHdheSB0byBhdXRvbWF0aWNhbGx5IG1hbmFnZSBjZXJ0aWZpY2F0ZXMgaW4gS3ViZXJuZXRlcyBhbmQgT3BlblNoaWZ0IGNsdXN0ZXJzLgoKdjEuMTkuNCBpcyBhIHNpbXBsZSBwYXRjaCByZWxlYXNlIHRvIGZpeCBzb21lIHJlcG9ydGVkIHZ1bG5lcmFiaWxpdGllcyAtIG5vdGFibHkgQ1ZFLTIwMjYtMjQwNTEgYW5kIENWRS0yMDI1LTY4MTIxLiBBbGwgdXNlcnMgc2hvdWxkIHVwZ3JhZGUuCgojIyMjIENoYW5nZXMgYnkgS2luZAoKIyMjIyMgQnVnIG9yIFJlZ3Jlc3Npb24KCi0gQnVtcCBnbyB0byBhZGRyZXNzIENWRS0yMDI1LTY4MTIxIChbIyYjODIwMzs4NTI2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODUyNiksIFtAJiM4MjAzO1NndENvREZpc2hdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9TZ3RDb0RGaXNoKSkKLSBCdW1wIG90ZWwgU0RLIHRvIGFkZHJlc3MgR08tMjAyNi00Mzk0IChbIyYjODIwMzs4NTMxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODUzMSksIFtAJiM4MjAzO1NndENvREZpc2hdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9TZ3RDb0RGaXNoKSkKCiMjIyBbYHYxLjE5LjNgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9yZWxlYXNlcy90YWcvdjEuMTkuMykKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvY29tcGFyZS92MS4xOS4yLi4udjEuMTkuMykKCmNlcnQtbWFuYWdlciBpcyB0aGUgZWFzaWVzdCB3YXkgdG8gYXV0b21hdGljYWxseSBtYW5hZ2UgY2VydGlmaWNhdGVzIGluIEt1YmVybmV0ZXMgYW5kIE9wZW5TaGlmdCBjbHVzdGVycy4KClRoaXMgcmVsZWFzZSBjb250YWlucyB0aHJlZSBidWcgZml4ZXMsIGluY2x1ZGluZyBhIGZpeCBmb3IgdGhlIE1PREVSQVRFIHNldmVyaXR5IERvUyBpc3N1ZSBpbiBHSFNBLWd4M3gtdnE0cC1taGh2LiBBbGwgdXNlcnMgc2hvdWxkIHVwZ3JhZGUgdG8gdGhlIGxhdGVzdCByZWxlYXNlLgoKIyMjIyBDaGFuZ2VzIGJ5IEtpbmQKCiMjIyMjIEJ1ZyBvciBSZWdyZXNzaW9uCgotIEZpeGVkIGFuIGluZmluaXRlIHJlLWlzc3VhbmNlIGxvb3AgdGhhdCBjb3VsZCBvY2N1ciB3aGVuIGFuIGlzc3VlciByZXR1cm5zIGEgY2VydGlmaWNhdGUgd2l0aCBhIHB1YmxpYyBrZXkgdGhhdCBkb2Vzbid0IG1hdGNoIHRoZSBDU1IuIFRoZSBpc3N1aW5nIGNvbnRyb2xsZXIgbm93IHZhbGlkYXRlcyB0aGUgY2VydGlmaWNhdGUgYmVmb3JlIHN0b3JpbmcgaXQgYW5kIGZhaWxzIHdpdGggYmFja29mZiBvbiBtaXNtYXRjaC4gKFsjJiM4MjAzOzg0MTVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NDE1KSwgW0AmIzgyMDM7Y2VydC1tYW5hZ2VyLWJvdF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci1ib3QpKQotIEZpeGVkIGFuIGlzc3VlIHdoZXJlIEhUVFAtMDEgY2hhbGxlbmdlcyBmYWlsZWQgd2hlbiB0aGUgSG9zdCBoZWFkZXIgY29udGFpbmVkIGFuIElQdjYgYWRkcmVzcy4gVGhpcyBtZWFucyB0aGF0IHVzZXJzIGNhbiBub3cgaXNzdWUgSVAgYWRkcmVzcyBjZXJ0aWZpY2F0ZXMgZm9yIElQdjYgYWRkcmVzcyBzdWJqZWN0cy4gKFsjJiM4MjAzOzg0MzZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NDM2KSwgW0AmIzgyMDM7Y2VydC1tYW5hZ2VyLWJvdF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci1ib3QpKQotIFNlY3VyaXR5IChNT0RFUkFURSk6IEZpeCBhIHBvdGVudGlhbCBwYW5pYyBpbiB0aGUgY2VydC1tYW5hZ2VyIGNvbnRyb2xsZXIgd2hlbiBhIEROUyByZXNwb25zZSBpbiBhbiB1bmV4cGVjdGVkIG9yZGVyIHdhcyBjYWNoZWQuIElmIGFuIGF0dGFja2VyIHdhcyBhYmxlIHRvIG1vZGlmeSBETlMgcmVzcG9uc2VzIChvciBpZiB0aGV5IGNvbnRyb2xsZWQgdGhlIEROUyBzZXJ2ZXIpIGl0IHdhcyBwb3NzaWJsZSB0byBjYXVzZSBkZW5pYWwgb2Ygc2VydmljZSBmb3IgdGhlIGNlcnQtbWFuYWdlciBjb250cm9sbGVyLiAoWyMmIzgyMDM7ODQ2OF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg0NjgpLCBbQCYjODIwMztTZ3RDb0RGaXNoXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vU2d0Q29ERmlzaCkpCgojIyMjIyBPdGhlciAoQ2xlYW51cCBvciBGbGFrZSkKCi0gQnVtcCBnbyB0byAxLjI1LjYgKFsjJiM4MjAzOzg0NTldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NDU5KSwgW0AmIzgyMDM7U2d0Q29ERmlzaF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL1NndENvREZpc2gpKQoKIyMjIFtgdjEuMTkuMmBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL3JlbGVhc2VzL3RhZy92MS4xOS4yKQoKW0NvbXBhcmUgU291cmNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9jb21wYXJlL3YxLjE5LjEuLi52MS4xOS4yKQoKY2VydC1tYW5hZ2VyIGlzIHRoZSBlYXNpZXN0IHdheSB0byBhdXRvbWF0aWNhbGx5IG1hbmFnZSBjZXJ0aWZpY2F0ZXMgaW4gS3ViZXJuZXRlcyBhbmQgT3BlblNoaWZ0IGNsdXN0ZXJzLgoKV2UgdXBkYXRlZCBHbyB0byBmaXggc29tZSB2dWxuZXJhYmlsaXRpZXMgaW4gdGhlIHN0YW5kYXJkIGxpYnJhcnkuCgo+IPCfk5YgUmVhZCB0aGUgW2Z1bGwgMS4xOSByZWxlYXNlIG5vdGVzXShodHRwczovL2NlcnQtbWFuYWdlci5pby9kb2NzL3JlbGVhc2VzL3JlbGVhc2Utbm90ZXMvcmVsZWFzZS1ub3Rlcy0xLjE5KSBvbiB0aGUgY2VydC1tYW5hZ2VyLmlvIHdlYnNpdGUgYmVmb3JlIHVwZ3JhZGluZy4KCiMjIyMgQ2hhbmdlcyBzaW5jZSBgdjEuMTkuMWAKCiMjIyMjIEJ1ZyBvciBSZWdyZXNzaW9uCgotIEFkZHJlc3MgZmFsc2UgcG9zaXRpdmUgdnVsbmVyYWJpbGl0aWVzIGBDVkUtMjAyNS00NzkxNGAgYW5kIGBDVkUtMjAyNS01ODE4MWAgd2hpY2ggd2VyZSByZXBvcnRlZCBieSBUcml2eS4gKFsjJiM4MjAzOzgyODNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84MjgzKSwgW0AmIzgyMDM7U2d0Q29ERmlzaF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL1NndENvREZpc2gpKQotIFVwZGF0ZSBHbyB0byBgdjEuMjUuNWAgdG8gZml4IGBDVkUtMjAyNS02MTcyN2AgYW5kIGBDVkUtMjAyNS02MTcyOWAgKFsjJiM4MjAzOzgyOTRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84Mjk0KSwgW0AmIzgyMDM7d2FsbHJqLWN5YmVyYXJrXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vd2FsbHJqLWN5YmVyYXJrKSkKLSBVcGRhdGUgYGdsb2JhbC5ub2RlU2VsZWN0b3JgIHRvIGhlbG0gY2hhcnQgdG8gcGVyZm9ybSBhIGBtZXJnZWAgYW5kIGFsbG93IGZvciBhIHNpbmdsZSBgbm9kZVNlbGVjdG9yYCB0byBiZSBzZXQgYWNyb3NzIGFsbCBzZXJ2aWNlcy4gKFsjJiM4MjAzOzgyMzNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84MjMzKSwgW0AmIzgyMDM7Y2VydC1tYW5hZ2VyLWJvdF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci1ib3QpKQoKIyMjIyMgT3RoZXIgKENsZWFudXAgb3IgRmxha2UpCgotIFVwZGF0ZSBjZXJ0LW1hbmFnZXIncyBBQ01FIGNsaWVudCwgZm9ya2VkIGZyb20gYGdvbGFuZy94L2NyeXB0b2AgKFsjJiM4MjAzOzgyNzBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84MjcwKSwgW0AmIzgyMDM7U2d0Q29ERmlzaF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL1NndENvREZpc2gpKQotIFVwZGF0ZWQgRGViaWFuIDEyIGRpc3Ryb2xlc3MgYmFzZSBpbWFnZXMgKFsjJiM4MjAzOzgzMjZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84MzI2KSwgW0AmIzgyMDM7d2FsbHJqLWN5YmVyYXJrXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vd2FsbHJqLWN5YmVyYXJrKSkKCiMjIyBbYHYxLjE5LjFgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9yZWxlYXNlcy90YWcvdjEuMTkuMSkKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvY29tcGFyZS92MS4xOS4wLi4udjEuMTkuMSkKCmNlcnQtbWFuYWdlciBpcyB0aGUgZWFzaWVzdCB3YXkgdG8gYXV0b21hdGljYWxseSBtYW5hZ2UgY2VydGlmaWNhdGVzIGluIEt1YmVybmV0ZXMgYW5kIE9wZW5TaGlmdCBjbHVzdGVycy4KCldlIHJldmVydGVkIHRoZSBDUkQtYmFzZWQgQVBJIGRlZmF1bHRzIGZvciBgQ2VydGlmaWNhdGUuU3BlYy5Jc3N1ZXJSZWZgIGFuZCBgQ2VydGlmaWNhdGVSZXF1ZXN0LlNwZWMuSXNzdWVyUmVmYCBhZnRlciB0aGV5IHdlcmUgZm91bmQgdG8gY2F1c2UgdW5leHBlY3RlZCBjZXJ0aWZpY2F0ZSByZW5ld2FscyBhZnRlciB1cGdyYWRpbmcgdG8gMS4xOS4wLiBXZSB3aWxsIHRyeSByZS1pbnRyb2R1Y2luZyB0aGVzZSBBUEkgZGVmYXVsdHMgaW4gY2VydC1tYW5hZ2VyIGAxLjIwYC4KV2UgZml4ZWQgYSBidWcgdGhhdCBjYXVzZWQgY2VydGlmaWNhdGVzIHRvIGJlIHJlLWlzc3VlZCB1bmV4cGVjdGVkbHkgaWYgdGhlIGBpc3N1ZXJSZWZgIGtpbmQgb3IgZ3JvdXAgd2FzIGNoYW5nZWQgdG8gb25lIG9mIHRoZSAicnVudGltZSIgZGVmYXVsdCB2YWx1ZXMuCldlIHVwZ3JhZGVkIEdvIHRvIGAxLjI1LjNgIHRvIGFkZHJlc3MgdGhlIGZvbGxvd2luZyBzZWN1cml0eSB2dWxuZXJhYmlsaXRpZXM6IGBDVkUtMjAyNS02MTcyNGAsIGBDVkUtMjAyNS01ODE4N2AsIGBDVkUtMjAyNS00NzkxMmAsIGBDVkUtMjAyNS01ODE4M2AsIGBDVkUtMjAyNS02MTcyM2AsIGBDVkUtMjAyNS01ODE4NmAsIGBDVkUtMjAyNS01ODE4NWAsIGBDVkUtMjAyNS01ODE4OGAsIGFuZCBgQ1ZFLTIwMjUtNjE3MjVgLgoKPiDwn5OWIFJlYWQgdGhlIFtmdWxsIDEuMTkgcmVsZWFzZSBub3Rlc10oaHR0cHM6Ly9jZXJ0LW1hbmFnZXIuaW8vZG9jcy9yZWxlYXNlcy9yZWxlYXNlLW5vdGVzL3JlbGVhc2Utbm90ZXMtMS4xOSkgb24gdGhlIGNlcnQtbWFuYWdlci5pbyB3ZWJzaXRlIGJlZm9yZSB1cGdyYWRpbmcuCgpDaGFuZ2VzIHNpbmNlIGB2MS4xOS4wYDoKCiMjIyMjIEJ1ZyBvciBSZWdyZXNzaW9uCgotIEJVR0ZJWDogaW4gY2FzZSBraW5kIG9yIGdyb3VwIGluIHRoZSBgaXNzdWVyUmVmYCBvZiBhIENlcnRpZmljYXRlIHdhcyBvbWl0dGVkLCB1cGdyYWRpbmcgdG8gYDEuMTkueGAgaW5jb3JyZWN0bHkgY2F1c2VkIHRoZSBjZXJ0aWZpY2F0ZSB0byBiZSByZW5ld2VkIChbIyYjODIwMzs4MTc1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODE3NSksIFtAJiM4MjAzO2NlcnQtbWFuYWdlci1ib3RdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXItYm90KSkKLSBCdW1wIEdvIHRvIDEuMjUuMyB0byBmaXggYSBiYWNrd2FyZHMgaW5jb21wYXRpYmxlIGNoYW5nZSB0byB0aGUgdmFsaWRhdGlvbiBvZiBETlMgbmFtZXMgaW4gWC41MDkgU0FOIGZpZWxkcyB3aGljaCBwcmV2ZW50ZWQgdGhlIHVzZSBvZiBETlMgbmFtZXMgd2l0aCBhIHRyYWlsaW5nIGRvdCAoWyMmIzgyMDM7ODE3N10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzgxNzcpLCBbQCYjODIwMzt3YWxscmotY3liZXJhcmtdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS93YWxscmotY3liZXJhcmspKQotIFJldmVydCBBUEkgZGVmYXVsdHMgZm9yIGlzc3VlciByZWZlcmVuY2Uga2luZCBhbmQgZ3JvdXAgaW50cm9kdWNlZCBpbiAwLjE5LjAgKFsjJiM4MjAzOzgxNzhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84MTc4KSwgW0AmIzgyMDM7Y2VydC1tYW5hZ2VyLWJvdF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci1ib3QpKQoKIyMjIFtgdjEuMTkuMGBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL3JlbGVhc2VzL3RhZy92MS4xOS4wKQoKW0NvbXBhcmUgU291cmNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9jb21wYXJlL3YxLjE4LjUuLi52MS4xOS4wKQoKY2VydC1tYW5hZ2VyIGlzIHRoZSBlYXNpZXN0IHdheSB0byBhdXRvbWF0aWNhbGx5IG1hbmFnZSBjZXJ0aWZpY2F0ZXMgaW4gS3ViZXJuZXRlcyBhbmQgT3BlblNoaWZ0IGNsdXN0ZXJzLgoKPiDimqDvuI8gKipLbm93biBpc3N1ZXMqKjogVGhlIGZvbGxvd2luZyBrbm93biBpc3N1ZXMgYXJlIGZpeGVkIGluIFt2MS4xOS4xXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9yZWxlYXNlcy90YWcvdjEuMTkuMSk6Cj4KPiAtIFtVbmV4cGVjdGVkIGNlcnRpZmljYXRlIHJlbmV3YWwgYWZ0ZXIgdXBncmFkaW5nIHRvIDEuMTkuMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzgxNTgpCgpUaGlzIHJlbGVhc2UgZm9jdXNlcyBvbiBleHBhbmRpbmcgcGxhdGZvcm0gY29tcGF0aWJpbGl0eSwgaW1wcm92aW5nIGRlcGxveW1lbnQgZmxleGliaWxpdHksIGVuaGFuY2luZyBvYnNlcnZhYmlsaXR5LCBhbmQgYWRkcmVzc2luZyBrZXkgcmVsaWFiaWxpdHkgaXNzdWVzLgoKPiDwn5OWICBSZWFkIHRoZSBmdWxsIHJlbGVhc2Ugbm90ZXMgYXQgY2VydC1tYW5hZ2VyLmlvOiA8aHR0cHM6Ly9jZXJ0LW1hbmFnZXIuaW8vZG9jcy9yZWxlYXNlcy9yZWxlYXNlLW5vdGVzL3JlbGVhc2Utbm90ZXMtMS4xOT4KCkNoYW5nZXMgc2luY2UgYHYxLjE4LjBgOgoKIyMjIyMgRmVhdHVyZQoKLSBBZGQgSVB2NiBydWxlcyB0byB0aGUgZGVmYXVsdCBuZXR3b3JrIHBvbGljeSAoWyMmIzgyMDM7NzcyNl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzc3MjYpLCBbQCYjODIwMztqY3B1bmtdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9qY3B1bmspKQotIEFkZCBgZ2xvYmFsLm5vZGVTZWxlY3RvcmAgdG8gaGVsbSBjaGFydCB0byBhbGxvdyBmb3IgYSBzaW5nbGUgYG5vZGVTZWxlY3RvcmAgdG8gYmUgc2V0IGFjcm9zcyBhbGwgc2VydmljZXMuIChbIyYjODIwMzs3ODE4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvNzgxOCksIFtAJiM4MjAzO1N0aW5nUmF5WkFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9TdGluZ1JheVpBKSkKLSBBZGQgYSBmZWF0dXJlIGdhdGUgdG8gZGVmYXVsdCB0byBJbmdyZXNzIGBwYXRoVHlwZWAgYEV4YWN0YCBpbiBBQ01FIEhUVFAwMSBJbmdyZXNzIGNoYWxsZW5nZSBzb2x2ZXJzLiAoWyMmIzgyMDM7Nzc5NV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzc3OTUpLCBbQCYjODIwMztzc3ByZWl0emVyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vc3NwcmVpdHplcikpCi0gQWRkIGdlbmVyYXRlZCBgYXBwbHljb25maWd1cmF0aW9uc2AgYWxsb3dpbmcgY2xpZW50cyB0byBtYWtlIHR5cGUtc2FmZSBzZXJ2ZXItc2lkZSBhcHBseSByZXF1ZXN0cyBmb3IgY2VydC1tYW5hZ2VyIHJlc291cmNlcy4gKFsjJiM4MjAzOzc4NjZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy83ODY2KSwgW0AmIzgyMDM7ZXJpa2diXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZXJpa2diKSkKLSBBZGRlZCBBUEkgZGVmYXVsdHMgdG8gaXNzdWVyIHJlZmVyZW5jZXMgZ3JvdXAgKGNlcnQtbWFuYWdlci5pbykgYW5kIGtpbmQgKElzc3VlcikuIChbIyYjODIwMzs3NDE0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvNzQxNCksIFtAJiM4MjAzO2VyaWtnYl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2VyaWtnYikpCi0gQWRkZWQgYGNlcnRtYW5hZ2VyX2NlcnRpZmljYXRlX2NoYWxsZW5nZV9zdGF0dXNgIFByb21ldGhldXMgbWV0cmljLiAoWyMmIzgyMDM7NzczNl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzc3MzYpLCBbQCYjODIwMztoam9zaGkxMjNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9oam9zaGkxMjMpKQotIEFkZGVkIGBwcm90b2NvbGAgZmllbGQgZm9yIGByZmMyMTM2YCBETlMwMSBwcm92aWRlciAoWyMmIzgyMDM7Nzg4MV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzc4ODEpLCBbQCYjODIwMztoam9zaGkxMjNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9oam9zaGkxMjMpKQotIEFkZGVkIGV4cGVyaW1lbnRhbCBmaWVsZCBgaG9zdFVzZXJzYCBmbGFnIHRvIGFsbCBwb2RzLiBOb3Qgc2V0IGJ5IGRlZmF1bHQuIChbIyYjODIwMzs3OTczXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvNzk3MyksIFtAJiM4MjAzO2hqb3NoaTEyM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2hqb3NoaTEyMykpCi0gU3VwcG9ydCBjb25maWd1cmFibGUgcmVzb3VyY2UgcmVxdWVzdHMgYW5kIGxpbWl0cyBmb3IgQUNNRSBIVFRQMDEgc29sdmVyIHBvZHMgdGhyb3VnaCBDbHVzdGVySXNzdWVyIGFuZCBJc3N1ZXIgc3BlY2lmaWNhdGlvbnMsIGFsbG93aW5nIGdyYW51bGFyIHJlc291cmNlIG1hbmFnZW1lbnQgdGhhdCBvdmVycmlkZXMgZ2xvYmFsIGAtLWFjbWUtaHR0cDAxLXNvbHZlci1yZXNvdXJjZS0qYCBzZXR0aW5ncy4gKFsjJiM4MjAzOzc5NzJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy83OTcyKSwgW0AmIzgyMDM7bHVuYXJ3aGl0ZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2x1bmFyd2hpdGUpKQotIFRoZSBgQ0FJbmplY3Rvck1lcmdpbmdgIGZlYXR1cmUgaGFzIGJlZW4gcHJvbW90ZWQgdG8gQkVUQSBhbmQgaXMgbm93IGVuYWJsZWQgYnkgZGVmYXVsdCAoWyMmIzgyMDM7ODAxN10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzgwMTcpLCBbQCYjODIwMztUaGF0c01yVGFsYm90XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vVGhhdHNNclRhbGJvdCkpCi0gVGhlIGNvbnRyb2xsZXIsIHdlYmhvb2sgYW5kIGNhLWluamVjdG9yIG5vdyBsb2cgdGhlaXIgdmVyc2lvbiBhbmQgZ2l0IGNvbW1pdCBvbiBzdGFydHVwIGZvciBlYXNpZXIgZGVidWdnaW5nIGFuZCBzdXBwb3J0LiAoWyMmIzgyMDM7ODA3Ml0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzgwNzIpLCBbQCYjODIwMztwcmFzYWQ4OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3ByYXNhZDg5KSkKLSBVcGRhdGVkIGBjZXJ0aWZpY2F0ZWAgbWV0cmljcyB0byB0aGUgY29sbGVjdG9yIGFwcHJvYWNoLiAoWyMmIzgyMDM7Nzg1Nl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzc4NTYpLCBbQCYjODIwMztoam9zaGkxMjNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9oam9zaGkxMjMpKQoKIyMjIyMgQnVnIG9yIFJlZ3Jlc3Npb24KCi0gQUNNRTogSW5jcmVhc2VkIGNoYWxsZW5nZSBhdXRob3JpemF0aW9uIHRpbWVvdXQgdG8gMiBtaW51dGVzIHRvIGZpeCBgZXJyb3Igd2FpdGluZyBmb3IgYXV0aG9yaXphdGlvbmAgKFsjJiM4MjAzOzc3OTZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy83Nzk2KSwgW0AmIzgyMDM7aGpvc2hpMTIzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vaGpvc2hpMTIzKSkKLSBCVUdGSVg6IHBlcm1pdHRlZCBVUkkgZG9tYWlucyB3ZXJlIGluY29ycmVjdGx5IHVzZWQgdG8gc2V0IHRoZSBleGNsdWRlZCBVUkkgZG9tYWlucyBpbiB0aGUgQ1NSJ3MgbmFtZSBjb25zdHJhaW50cyAoWyMmIzgyMDM7NzgxNl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzc4MTYpLCBbQCYjODIwMztraW5vbGFldl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tpbm9sYWV2KSkKLSBFbmZvcmNlZCBBQ01FIEhUVFAtMDEgc29sdmVyIHZhbGlkYXRpb24gdG8gcHJvcGVybHkgcmVqZWN0IGNvbmZpZ3VyYXRpb25zIHdoZW4gbXVsdGlwbGUgaW5ncmVzcyBvcHRpb25zIChgY2xhc3NgLCBgaW5ncmVzc0NsYXNzTmFtZWAsIGBuYW1lYCkgYXJlIHNwZWNpZmllZCBzaW11bHRhbmVvdXNseSAoWyMmIzgyMDM7ODAyMV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzgwMjEpLCBbQCYjODIwMztsdW5hcndoaXRlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbHVuYXJ3aGl0ZSkpCi0gSW5jcmVhc2UgbWF4aW11bSBzaXplcyBvZiBQRU0gY2VydGlmaWNhdGVzIGFuZCBjaGFpbnMgd2hpY2ggY2FuIGJlIHBhcnNlZCBpbiBjZXJ0LW1hbmFnZXIsIHRvIGhhbmRsZSBsZWFmIGNlcnRpZmljYXRlcyB3aXRoIGxhcmdlIG51bWJlcnMgb2YgRE5TIG5hbWVzIG9yIG90aGVyIGlkZW50aXRpZXMgKFsjJiM4MjAzOzc5NjFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy83OTYxKSwgW0AmIzgyMDM7U2d0Q29ERmlzaF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL1NndENvREZpc2gpKQotIFJldmVydGVkIGFkZGluZyB0aGUgYGdsb2JhbC5yYmFjLmRpc2FibGVIVFRQQ2hhbGxlbmdlc1JvbGVgIEhlbG0gb3B0aW9uLiAoWyMmIzgyMDM7NzgzNl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzc4MzYpLCBbQCYjODIwMztpbnRlb25dKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9pbnRlb24pKQotIFRoaXMgY2hhbmdlIHJlbW92ZXMgdGhlIGBwYXRoYCBsYWJlbCBvZiBjb3JlIEFDTUUgY2xpZW50IG1ldHJpY3MgYW5kIHdpbGwgcmVxdWlyZSB1c2VycyB0byB1cGRhdGUgdGhlaXIgbW9uaXRvcmluZyBkYXNoYm9hcmRzIGFuZCBhbGVydGluZyBydWxlcyBpZiB1c2luZyB0aG9zZSBtZXRyaWNzLiAoWyMmIzgyMDM7ODEwOV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzgxMDkpLCBbQCYjODIwMzttbGFkZW4tcnVzZXYtY3liZXJhcmtdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tbGFkZW4tcnVzZXYtY3liZXJhcmspKQotIFVzZSB0aGUgbGF0ZXN0IHZlcnNpb24gb2YgYGluZ3Jlc3MtbmdpbnhgIGluIEUyRSB0ZXN0cyB0byBlbnN1cmUgY29tcGF0aWJpbGl0eSAoWyMmIzgyMDM7Nzc5Ml0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzc3OTIpLCBbQCYjODIwMzt3YWxscmpdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS93YWxscmopKQoKIyMjIyMgT3RoZXIgKENsZWFudXAgb3IgRmxha2UpCgotIEhlbG06IEZpeCBuYW1pbmcgdGVtcGxhdGUgb2YgYHRva2VucmVxdWVzdGAgUm9sZUJpbmRpbmcgcmVzb3VyY2UgdG8gaW1wcm92ZSBjb25zaXN0ZW5jeSAoWyMmIzgyMDM7Nzc2MV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzc3NjEpLCBbQCYjODIwMztsdW5hcndoaXRlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbHVuYXJ3aGl0ZSkpCi0gSW1wcm92ZSBlcnJvciBtZXNzYWdlcyB3aGVuIGNlcnRpZmljYXRlcywgQ1JMcyBvciBwcml2YXRlIGtleXMgZmFpbCBhZG1pc3Npb24gZHVlIHRvIG1hbGZvcm1lZCBvciBtaXNzaW5nIFBFTSBkYXRhIChbIyYjODIwMzs3OTI4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvNzkyOCksIFtAJiM4MjAzO1NndENvREZpc2hdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9TZ3RDb0RGaXNoKSkKLSBNYWpvciB1cGdyYWRlIG9mIEFrYW1haSBTREsuIE5PVEU6IFRoZSBuZXcgdmVyc2lvbiBoYXMgbm90IGJlZW4gZnVsbHkgdGVzdGVkIGVuZC10by1lbmQgZHVlIHRvIHRoZSBsYWNrIG9mIGNsb3VkIGluZnJhc3RydWN0dXJlLiAoWyMmIzgyMDM7ODAwM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzgwMDMpLCBbQCYjODIwMztoam9zaGkxMjNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9oam9zaGkxMjMpKQotIFVwZGF0ZSBraW5kIGltYWdlcyB0byBpbmNsdWRlIHRoZSBLdWJlcm5ldGVzIDEuMzMgbm9kZSBpbWFnZSAoWyMmIzgyMDM7Nzc4Nl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzc3ODYpLCBbQCYjODIwMzt3YWxscmpdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS93YWxscmopKQotIFVzZSBgbWFwcy5Db3B5YCBmb3IgY2xlYW5lciBtYXAgaGFuZGxpbmcgKFsjJiM4MjAzOzgwOTJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84MDkyKSwgW0AmIzgyMDM7cXVhbnRwb2V0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vcXVhbnRwb2V0KSkKLSBWYXVsdDogTWlncmF0ZSBWYXVsdCBFMkUgYWRkLW9uIHRlc3RzIGZyb20gZGVwcmVjYXRlZCBgdmF1bHQtY2xpZW50LWdvYCB0byB0aGUgbmV3IGB2YXVsdC9hcGlgIGNsaWVudC4gKFsjJiM4MjAzOzgwNTldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84MDU5KSwgW0AmIzgyMDM7YXJtYWdhbmthcmF0b3N1bl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2FybWFnYW5rYXJhdG9zdW4pKQoKIyMjIFtgdjEuMTguNWBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL3JlbGVhc2VzL3RhZy92MS4xOC41KQoKW0NvbXBhcmUgU291cmNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9jb21wYXJlL3YxLjE4LjQuLi52MS4xOC41KQoKY2VydC1tYW5hZ2VyIGlzIHRoZSBlYXNpZXN0IHdheSB0byBhdXRvbWF0aWNhbGx5IG1hbmFnZSBjZXJ0aWZpY2F0ZXMgaW4gS3ViZXJuZXRlcyBhbmQgT3BlblNoaWZ0IGNsdXN0ZXJzLgoKVGhpcyByZWxlYXNlIGNvbnRhaW5zIHRocmVlIGJ1ZyBmaXhlcywgaW5jbHVkaW5nIGEgZml4IGZvciB0aGUgTU9ERVJBVEUgc2V2ZXJpdHkgRG9TIGlzc3VlIGluIEdIU0EtZ3gzeC12cTRwLW1oaHYuIEFsbCB1c2VycyBzaG91bGQgdXBncmFkZSB0byB0aGUgbGF0ZXN0IHJlbGVhc2UuCgojIyMjIyBDaGFuZ2VzIGJ5IEtpbmQKCiMjIyMjIEJ1ZyBvciBSZWdyZXNzaW9uCgotIEZpeGVkIGFuIGluZmluaXRlIHJlLWlzc3VhbmNlIGxvb3AgdGhhdCBjb3VsZCBvY2N1ciB3aGVuIGFuIGlzc3VlciByZXR1cm5zIGEgY2VydGlmaWNhdGUgd2l0aCBhIHB1YmxpYyBrZXkgdGhhdCBkb2Vzbid0IG1hdGNoIHRoZSBDU1IuIFRoZSBpc3N1aW5nIGNvbnRyb2xsZXIgbm93IHZhbGlkYXRlcyB0aGUgY2VydGlmaWNhdGUgYmVmb3JlIHN0b3JpbmcgaXQgYW5kIGZhaWxzIHdpdGggYmFja29mZiBvbiBtaXNtYXRjaC4gKFsjJiM4MjAzOzg0MTRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NDE0KSwgW0AmIzgyMDM7Y2VydC1tYW5hZ2VyLWJvdF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci1ib3QpKQotIEZpeGVkIGFuIGlzc3VlIHdoZXJlIEhUVFAtMDEgY2hhbGxlbmdlcyBmYWlsZWQgd2hlbiB0aGUgSG9zdCBoZWFkZXIgY29udGFpbnMgYW4gSVB2NiBhZGRyZXNzLiBUaGlzIG1lYW5zIHRoYXQgdXNlcnMgY2FuIG5vdyBpc3N1ZSBJUCBhZGRyZXNzIGNlcnRpZmljYXRlcyBmb3IgSVB2NiBhZGRyZXNzIHN1YmplY3RzLiAoWyMmIzgyMDM7ODQzN10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg0MzcpLCBbQCYjODIwMztjZXJ0LW1hbmFnZXItYm90XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyLWJvdCkpCi0gU2VjdXJpdHkgKE1PREVSQVRFKTogRml4IGEgcG90ZW50aWFsIHBhbmljIGluIHRoZSBjZXJ0LW1hbmFnZXIgY29udHJvbGxlciB3aGVuIGEgRE5TIHJlc3BvbnNlIGluIGFuIHVuZXhwZWN0ZWQgb3JkZXIgd2FzIGNhY2hlZC4gSWYgYW4gYXR0YWNrZXIgd2FzIGFibGUgdG8gbW9kaWZ5IEROUyByZXNwb25zZXMgKG9yIGlmIHRoZXkgY29udHJvbGxlZCB0aGUgRE5TIHNlcnZlcikgaXQgd2FzIHBvc3NpYmxlIHRvIGNhdXNlIGRlbmlhbCBvZiBzZXJ2aWNlIGZvciB0aGUgY2VydC1tYW5hZ2VyIGNvbnRyb2xsZXIuIChbIyYjODIwMzs4NDY3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODQ2NyksIFtAJiM4MjAzO1NndENvREZpc2hdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9TZ3RDb0RGaXNoKSkKCiMjIyMjIE90aGVyIChDbGVhbnVwIG9yIEZsYWtlKQoKLSBCdW1wIGdvIHRvIDEuMjQuMTIgKFsjJiM4MjAzOzg0NjBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NDYwKSwgW0AmIzgyMDM7U2d0Q29ERmlzaF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL1NndENvREZpc2gpKQoKIyMjIFtgdjEuMTguNGBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL3JlbGVhc2VzL3RhZy92MS4xOC40KQoKW0NvbXBhcmUgU291cmNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9jb21wYXJlL3YxLjE4LjMuLi52MS4xOC40KQoKY2VydC1tYW5hZ2VyIGlzIHRoZSBlYXNpZXN0IHdheSB0byBhdXRvbWF0aWNhbGx5IG1hbmFnZSBjZXJ0aWZpY2F0ZXMgaW4gS3ViZXJuZXRlcyBhbmQgT3BlblNoaWZ0IGNsdXN0ZXJzLgoKV2UgdXBkYXRlZCBHbyB0byBmaXggc29tZSB2dWxuZXJhYmlsaXRpZXMgaW4gdGhlIHN0YW5kYXJkIGxpYnJhcnkuCgo+IPCfk5YgUmVhZCB0aGUgW2Z1bGwgMS4xOCByZWxlYXNlIG5vdGVzXShodHRwczovL2NlcnQtbWFuYWdlci5pby9kb2NzL3JlbGVhc2VzL3JlbGVhc2Utbm90ZXMvcmVsZWFzZS1ub3Rlcy0xLjE4KSBvbiB0aGUgY2VydC1tYW5hZ2VyLmlvIHdlYnNpdGUgYmVmb3JlIHVwZ3JhZGluZy4KCiMjIyMjIENoYW5nZXMgc2luY2UgYHYxLjE4LjNgCgojIyMjIyBCdWcgb3IgUmVncmVzc2lvbgoKLSBBZGRyZXNzIGZhbHNlIHBvc2l0aXZlIHZ1bG5lcmFiaWxpdGllcyBgQ1ZFLTIwMjUtNDc5MTRgIGFuZCBgQ1ZFLTIwMjUtNTgxODFgIHdoaWNoIHdlcmUgcmVwb3J0ZWQgYnkgVHJpdnkuIChbIyYjODIwMzs4MjgyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODI4MiksIFtAJiM4MjAzO1NndENvREZpc2hdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9TZ3RDb0RGaXNoKSkKLSBVcGRhdGUgR28gdG8gYHYxLjI0LjExYCB0byBmaXggYENWRS0yMDI1LTYxNzI3YCBhbmQgYENWRS0yMDI1LTYxNzI5YCAoWyMmIzgyMDM7ODI5NV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzgyOTUpLCBbQCYjODIwMzt3YWxscmotY3liZXJhcmtdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS93YWxscmotY3liZXJhcmspKQoKIyMjIyMgT3RoZXIgKENsZWFudXAgb3IgRmxha2UpCgotIFVwZGF0ZSBjZXJ0LW1hbmFnZXIncyBBQ01FIGNsaWVudCwgZm9ya2VkIGZyb20gYGdvbGFuZy94L2NyeXB0b2AgKFsjJiM4MjAzOzgyNzFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84MjcxKSwgW0AmIzgyMDM7U2d0Q29ERmlzaF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL1NndENvREZpc2gpKQotIFVwZGF0ZWQgRGViaWFuIDEyIGRpc3Ryb2xlc3MgYmFzZSBpbWFnZXMgKFsjJiM4MjAzOzgzMjhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84MzI4KSwgW0AmIzgyMDM7d2FsbHJqLWN5YmVyYXJrXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vd2FsbHJqLWN5YmVyYXJrKSkKCiMjIyBbYHYxLjE4LjNgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9yZWxlYXNlcy90YWcvdjEuMTguMykKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvY29tcGFyZS92MS4xOC4yLi4udjEuMTguMykKCmNlcnQtbWFuYWdlciBpcyB0aGUgZWFzaWVzdCB3YXkgdG8gYXV0b21hdGljYWxseSBtYW5hZ2UgY2VydGlmaWNhdGVzIGluIEt1YmVybmV0ZXMgYW5kIE9wZW5TaGlmdCBjbHVzdGVycy4KCldlIGZpeGVkIGEgYnVnIHdoaWNoIGNhdXNlZCBjZXJ0aWZpY2F0ZXMgdG8gYmUgcmUtaXNzdWVkIHVuZXhwZWN0ZWRseSwgaWYgdGhlIGlzc3VlclJlZiBraW5kIG9yIGdyb3VwIHdhcyBjaGFuZ2VkIHRvIG9uZSBvZiB0aGUgInJ1bnRpbWUiIGRlZmF1bHQgdmFsdWVzLiBXZSBpbmNyZWFzZWQgdGhlIHNpemUgbGltaXQgd2hlbiBwYXJzaW5nIFBFTSBjZXJ0aWZpY2F0ZSBjaGFpbnMgdG8gaGFuZGxlIGxlYWYgY2VydGlmaWNhdGVzIHdpdGggbGFyZ2UgbnVtYmVycyBvZiBETlMgbmFtZWQgb3Igb3RoZXIgaWRlbnRpdGllcy4gV2UgdXBncmFkZWQgR28gdG8gMS4yNC45IHRvIGZpeCB2YXJpb3VzIG5vbi1jcml0aWNhbCBzZWN1cml0eSB2dWxuZXJhYmlsaXRpZXMuCgo+IPCfk5YgUmVhZCB0aGUgW2Z1bGwgMS4xOCByZWxlYXNlIG5vdGVzXShodHRwczovL2NlcnQtbWFuYWdlci5pby9kb2NzL3JlbGVhc2VzL3JlbGVhc2Utbm90ZXMvcmVsZWFzZS1ub3Rlcy0xLjE4KSBvbiB0aGUgY2VydC1tYW5hZ2VyLmlvIHdlYnNpdGUgYmVmb3JlIHVwZ3JhZGluZy4KCkNoYW5nZXMgc2luY2UgYHYxLjE4LjJgOgoKIyMjIyMgQnVnIG9yIFJlZ3Jlc3Npb24KCi0gQlVHRklYOiBpbiBjYXNlIGtpbmQgb3IgZ3JvdXAgaW4gdGhlIGlzc3VlclJlZiBvZiBhIENlcnRpZmljYXRlIHdhcyBvbWl0dGVkLCB1cGdyYWRpbmcgdG8gMS4xOS54IGluY29ycmVjdGx5IGNhdXNlZCB0aGUgY2VydGlmaWNhdGUgdG8gYmUgcmVuZXdlZCAoWyMmIzgyMDM7ODE3NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzgxNzQpLCBbQCYjODIwMztjZXJ0LW1hbmFnZXItYm90XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyLWJvdCkpCi0gQnVtcCBHbyB0byAxLjI0LjkuIEZpeGVzIHRoZSBmb2xsb3dpbmcgdnVsbmVyYWJpbGl0aWVzOiBDVkUtMjAyNS02MTcyNCwgQ1ZFLTIwMjUtNTgxODcsIENWRS0yMDI1LTQ3OTEyLCBDVkUtMjAyNS01ODE4MywgQ1ZFLTIwMjUtNjE3MjMsIENWRS0yMDI1LTU4MTg2LCBDVkUtMjAyNS01ODE4NSwgQ1ZFLTIwMjUtNTgxODgsIENWRS0yMDI1LTYxNzI1IChbIyYjODIwMzs4MTc2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODE3NiksIFtAJiM4MjAzO3dhbGxyai1jeWJlcmFya10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3dhbGxyai1jeWJlcmFyaykpCi0gSW5jcmVhc2UgbWF4aW11bSBzaXplcyBvZiBQRU0gY2VydGlmaWNhdGVzIGFuZCBjaGFpbnMgd2hpY2ggY2FuIGJlIHBhcnNlZCBpbiBjZXJ0LW1hbmFnZXIsIHRvIGhhbmRsZSBsZWFmIGNlcnRpZmljYXRlcyB3aXRoIGxhcmdlIG51bWJlcnMgb2YgRE5TIG5hbWVzIG9yIG90aGVyIGlkZW50aXRpZXMgKFsjJiM4MjAzOzc5NjZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy83OTY2KSwgW0AmIzgyMDM7Y2VydC1tYW5hZ2VyLWJvdF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci1ib3QpKQoKIyMjIyMgT3RoZXIgKENsZWFudXAgb3IgRmxha2UpCgotIEltcHJvdmUgZXJyb3IgbWVzc2FnZXMgd2hlbiBjZXJ0aWZpY2F0ZXMsIENSTHMgb3IgcHJpdmF0ZSBrZXlzIGZhaWwgYWRtaXNzaW9uIGR1ZSB0byBtYWxmb3JtZWQgb3IgbWlzc2luZyBQRU0gZGF0YSAoWyMmIzgyMDM7Nzk2NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzc5NjQpLCBbQCYjODIwMztjZXJ0LW1hbmFnZXItYm90XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyLWJvdCkpCi0gVXBncmFkZXMgR28gdG8gdjEuMjQuNiAoWyMmIzgyMDM7Nzk3NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzc5NzQpLCBbQCYjODIwMztTZ3RDb0RGaXNoXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vU2d0Q29ERmlzaCkpCgo8L2RldGFpbHM+CgotLS0KCiMjIyBDb25maWd1cmF0aW9uCgrwn5OFICoqU2NoZWR1bGUqKjogQnJhbmNoIGNyZWF0aW9uIC0gQXQgYW55IHRpbWUgKG5vIHNjaGVkdWxlIGRlZmluZWQpLCBBdXRvbWVyZ2UgLSBBdCBhbnkgdGltZSAobm8gc2NoZWR1bGUgZGVmaW5lZCkuCgrwn5qmICoqQXV0b21lcmdlKio6IERpc2FibGVkIGJ5IGNvbmZpZy4gUGxlYXNlIG1lcmdlIHRoaXMgbWFudWFsbHkgb25jZSB5b3UgYXJlIHNhdGlzZmllZC4KCuKZuyAqKlJlYmFzaW5nKio6IFdoZW5ldmVyIFBSIGJlY29tZXMgY29uZmxpY3RlZCwgb3IgeW91IHRpY2sgdGhlIHJlYmFzZS9yZXRyeSBjaGVja2JveC4KCvCflJUgKipJZ25vcmUqKjogQ2xvc2UgdGhpcyBQUiBhbmQgeW91IHdvbid0IGJlIHJlbWluZGVkIGFib3V0IHRoaXMgdXBkYXRlIGFnYWluLgoKLS0tCgogLSBbIF0gPCEtLSByZWJhc2UtY2hlY2sgLS0+SWYgeW91IHdhbnQgdG8gcmViYXNlL3JldHJ5IHRoaXMgUFIsIGNoZWNrIHRoaXMgYm94CgotLS0KClRoaXMgUFIgd2FzIGdlbmVyYXRlZCBieSBbTWVuZCBSZW5vdmF0ZV0oaHR0cHM6Ly9tZW5kLmlvL3Jlbm92YXRlLykuIFZpZXcgdGhlIFtyZXBvc2l0b3J5IGpvYiBsb2ddKGh0dHBzOi8vZGV2ZWxvcGVyLm1lbmQuaW8vZ2l0aHViL3ZleHhob3N0L2F0bW9zcGhlcmUuY29tbW9uKS4KPCEtLXJlbm92YXRlLWRlYnVnOmV5SmpjbVZoZEdWa1NXNVdaWElpT2lJME1TNHhNekV1T1NJc0luVndaR0YwWldSSmJsWmxjaUk2SWpRekxqTXlMakFpTENKMFlYSm5aWFJDY21GdVkyZ2lPaUp0WVdsdUlpd2liR0ZpWld4eklqcGJYWDA9LS0+Cg== patchset: 4d08f80a44bc210fc0d7fbef43a9e342ced77940 pipeline: check playbook_context: playbook_projects: trusted/project_0/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 9052b5a7781b3346e4cffd452a54448cbff54d8b trusted/project_1/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: 571c0efa3491d12ecb8fc1169c510716d55c0fc2 trusted/project_2/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: a6e68243e02ef030ce5e75f8b67630880c475f33 untrusted/project_0/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: a6e68243e02ef030ce5e75f8b67630880c475f33 untrusted/project_1/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 9052b5a7781b3346e4cffd452a54448cbff54d8b untrusted/project_2/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: 571c0efa3491d12ecb8fc1169c510716d55c0fc2 playbooks: - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/run.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/playbook_0/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/playbook_0/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/playbook_0/role_2/zuul-jobs/roles post_playbooks: - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_0/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_0/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_0/role_2/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post-logs.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_1/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_1/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_1/role_2/zuul-jobs/roles pre_playbooks: - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_0/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_0/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_0/role_2/zuul-jobs/roles - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_1/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/pre_playbook_1/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_1/role_2/zuul-jobs/roles post_review: false post_timeout: null pre_timeout: null project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere.common name: vexxhost/atmosphere.common short_name: atmosphere.common src_dir: src/github.com/vexxhost/atmosphere.common projects: github.com/vexxhost/atmosphere.common: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere.common checkout: main checkout_description: zuul branch commit: d8cbc40bce3a6c0eb5569aa158fc0834d0572178 name: vexxhost/atmosphere.common required: false short_name: atmosphere.common src_dir: src/github.com/vexxhost/atmosphere.common ref: refs/pull/105/head resources: {} tenant: oss timeout: 1800 topic: null voting: true