fix(deps): update module github.com/projectcapsule/capsule to v0.14.4 - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/projectcapsule/capsule	v0.13.2 → v0.14.4

---

Release Notes

projectcapsule/capsule (github.com/projectcapsule/capsule)

v0.14.4

Compare Source

⚠️ Security

• GHSA-2vqc-26cg-wpxg Moderate: TenantResource template sanitizer misses sprig 'expandenv' (wrong-case deny-list) -> namespaced tenant reads capsule-controller process environment / secrets

Changelog

🐛 Bug fixes

• e50bacf: fix: validate only changed metadata on updates (#​2118) (@​oliverbaehler)

🛡️ Security updates

• e531879: sec: remove expandenv from function map (#​2119) (@​oliverbaehler)

Full Changelog: projectcapsule/capsule@v0.14.3...v0.14.4

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.14.4
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.14.4

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.36	>= 1.36.0

Thanks to all the contributors! 🚀 🦄

v0.14.3

Compare Source

Changelog

🐛 Bug fixes

• da74cfd: fix: allow replications to own replications without blocking controller updates (#​2107) (@​oliverbaehler)

🛠 Dependency updates

• 16eb154: fix(deps): update module github.com/go-sprout/sprout to v1.1.0 (#​2110) (@​renovate[bot])

Full Changelog: projectcapsule/capsule@v0.14.2...v0.14.3

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.14.3
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.14.3

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.36	>= 1.36.0

Thanks to all the contributors! 🚀 🦄

v0.14.2

Compare Source

Changelog

🐛 Bug fixes

• 7ee293a: fix: remove resource rejections checks (#​2105) (@​oliverbaehler)

🛠 Dependency updates

• b0eacb3: fix(deps): update module github.com/google/cel-go to v0.31.0 (#​2098) (@​renovate[bot])
• 776b0bc: fix(deps): update opentelemetry-go monorepo to v1.45.0 (#​2094) (@​renovate[bot])

Full Changelog: projectcapsule/capsule@v0.14.1...v0.14.2

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.14.2
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.14.2

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.36	>= 1.36.0

Thanks to all the contributors! 🚀 🦄

v0.14.1

Compare Source

Changelog

✨ New Features

• 7b14687: feat: add externalip to rules api (#​2099) (@​oliverbaehler)

🐛 Bug fixes

• def254e: fix: migrate to dedicate resourcequota controller (#​2104) (@​oliverbaehler)

Full Changelog: projectcapsule/capsule@v0.14.0...v0.14.1

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.14.1
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.14.1

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.36	>= 1.36.0

Thanks to all the contributors! 🚀 🦄

v0.14.0

Compare Source

Changelog

🚧 Breaking Changes

• 06187e5: sec: use default serviceaccount for tenantresources by default (#​2029) (@​oliverbaehler)

✨ New Features

• 96f0806: feat(chart): bind default owner clusterroles in strict rbac mode (#​2088) (@​Svarrogh1337)
• bdcdcef: feat: add globalresourcequota api (#​2068) (@​oliverbaehler)
• 957288b: feat: bump supported kubernetes version to 1.36 (#​2072) (@​oliverbaehler)
• fed61d2: feat: replicating resources upon namespace creation (#​2080) (@​prometherion)
• 65a4e19: feat: requests and limit policies (#​2095) (@​oliverbaehler)

🐛 Bug fixes

• bddb976: fix(helm): fix manager.rbac.strict being no-op (#​2084) (@​Svarrogh1337)
• 5944210: fix: allowing replication of cluster scoped objects via gtr (#​2090) (@​prometherion)
• 305cabd: fix: consistently reconcile quotas from rules (#​2083) (@​oliverbaehler)
• 93fafdc: fix: do not mutate on update and bound pvcs (#​2073) (@​oliverbaehler)
• fbda18f: fix: missing leader election namespace when running out-of-cluster (#​2079) (@​prometherion)
• 62d8d62: fix: revert pv labeling to dircet api reads (#​2085) (@​oliverbaehler)

🛠 Dependency updates

• 1b633d6: fix(deps): update module github.com/go-logr/logr to v1.4.4 (#​2065) (@​renovate[bot])
• 4f0a4c9: fix(deps): update module github.com/google/cel-go to v0.30.0 (#​2061) (@​renovate[bot])
• 06b2f63: fix(deps): update module github.com/prometheus/client_golang to v1.24.1 (#​2064) (@​renovate[bot])
• a0154a9: fix(deps): update module go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.69.0 (#​2010) (@​renovate[bot])
• 7c9b989: fix(deps): update module google.golang.org/grpc to v1.82.1 (#​2060) (@​renovate[bot])
• bd197b8: fix(deps): update module google.golang.org/grpc to v1.83.0 (#​2078) (@​renovate[bot])
• 8d111c7: fix(deps): update module sigs.k8s.io/cluster-api to v1.13.4 (#​2056) (@​renovate[bot])
• d924534: fix(deps): update module sigs.k8s.io/gateway-api to v1.6.1 (#​2027) (@​renovate[bot])

Full Changelog: projectcapsule/capsule@v0.13.11...v0.14.0

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.14.0
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.14.0

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.36	>= 1.36.0

Thanks to all the contributors! 🚀 🦄

v0.13.11

Compare Source

Changelog

✨ New Features

• 2252c53: feat(performance): removed duplicate client calls from all admission paths (#​2054) (@​oliverbaehler)

🐛 Bug fixes

• 613b43a: fix: correct tenant ownerships resolution with deduplicaiton (#​2059) (@​oliverbaehler)

Full Changelog: projectcapsule/capsule@v0.13.10...v0.13.11

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.13.11
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.13.11

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.35	>= 1.35.0

Thanks to all the contributors! 🚀 🦄

v0.13.10

Compare Source

Changelog

✨ New Features

• f1b760a: feat(rules): improve metadata enforcement and add ingress rules (#​2050) (@​oliverbaehler)
• e8ac32d: feat: add administrator capabilities (#​2049) (@​oliverbaehler)
• c17e4fa: feat: add leader-election tuning (#​2008) (@​oliverbaehler)
• 30e4f9d: feat: add managed-by labels to emitted events (#​2028) (@​oliverbaehler)
• 9ee5468: feat: add rolebindings to rules api (#​2032) (@​oliverbaehler)
• 99e0522: feat: implement performance optimizations (#​2045) (@​oliverbaehler)

🐛 Bug fixes

• 388d9f3: fix(webhook): fix hostname validation logic (#​2015) (@​boettluSICKAG)
• abff646: fix: Enforce namespace metadata validation for capsule users only (#​2042) (@​tom-stockwell)
• 15a848d: fix: allow administrator operations on tenant namespaces (#​2037) (@​oliverbaehler)

🛠 Dependency updates

• f5bfb72: fix(deps): update module google.golang.org/grpc to v1.82.0 (#​2033) (@​renovate[bot])
• 509516e: fix(deps): update module k8s.io/klog/v2 to v2.140.0 (#​2016) (@​renovate[bot])
• a14db27: fix(deps): update opentelemetry-go monorepo to v1.44.0 (#​2011) (@​renovate[bot])

🚀 Build process updates

• 1fadf5f: ci: add fossa project.team name (#​2046) (@​Svarrogh1337)
• 16bc219: ci: add fossa project.team name (#​2047) (@​Svarrogh1337)

Full Changelog: projectcapsule/capsule@v0.13.9...v0.13.10

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.13.10
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.13.10

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.35	>= 1.35.0

Thanks to all the contributors! 🚀 🦄

v0.13.9

Compare Source

Changelog

🐛 Bug fixes

• 8d52116: fix: add cache timeout for rbac controller (#​2006) (@​oliverbaehler)

Full Changelog: projectcapsule/capsule@v0.13.8...v0.13.9

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.13.9
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.13.9

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.35	>= 1.35.0

Thanks to all the contributors! 🚀 🦄

v0.13.8

Compare Source

⚠️ Security

• GHSA-jr6p-8pjj-mfx6 Moderate: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) - Without impersonation
• GHSA-68cj-mvg9-rgm2 Moderate: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

Changelog

✨ New Features

• 8e1cc91: feat(globalcustomquota): add support for not-equals field selector (#​1997) (@​sandert-k8s)
• 77d1810: feat(chart): add built-in prometheusrules (#​1990) (@​oliverbaehler)
• 77d1810: feat: add metadata enforcement (#​1990) (@​oliverbaehler) Read More
• 0c22ce8: feat: define interface for event recorder (#​1985) (@​bakito)
• 6a762e7: feat: add improve webhook validation for regex properties (#​1995) (@​oliverbaehler)
• 6a762e7: feat: add metric recorder for all objects with conditions (#​1995) (@​oliverbaehler)

🐛 Bug fixes

• 4b07463: fix: metric recorders for all conditionals (#​1998) (@​oliverbaehler)

🛠 Dependency updates

• 6fbd472: fix(deps): update module sigs.k8s.io/cluster-api to v1.13.3 (#​1988) (@​renovate[bot])

Full Changelog: projectcapsule/capsule@v0.13.7...v0.13.8

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.13.8
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.13.8

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.35	>= 1.35.0

Thanks to all the contributors! 🚀 🦄

v0.13.7

Compare Source

Changelog

⚠️ Security

• GHSA-gxjc-74v5-3vx3 Moderate: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic
• GHSA-gjw4-3v3v-rqxg High: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement because ForbiddenListSpec.ExactMatch runs sort.SearchStrings (byte order) over a slice sorted case-insensitively
• GHSA-f94q-w3w8-cj67 Moderate: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation

✨ New Features

• 755cef5: feat(rules): add service enforcement rules (#​1982) (@​oliverbaehler) - Read More
• 755cef5: feat(chart): add flowschema and apipriority (#​1982) (@​oliverbaehler)
• 0b11582: feat: add scheduler enforcement rule (#​1971) (@​oliverbaehler) - Read More

🐛 Bug fixes

• 8d89d68: fix(sec): corrects validation for regex objects (hostname and forbidden (#​1983) (@​oliverbaehler)
• 4e9e529: fix(webhook): remove dead diff code block that panics on nil namespace metadata (#​1976) (@​jouve)

Full Changelog: projectcapsule/capsule@v0.13.6...v0.13.7

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.13.7
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.13.7

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.35	>= 1.35.0

Thanks to all the contributors! 🚀 🦄

v0.13.6

Compare Source

Changelog

🐛 Bug fixes

• f84f9d6: fix(webhook): Release annotation on bounded ResourcePoolClaim (#​1965) (@​FerroO2000)
• af2f377: fix: add serviceaccount validation for tenantowners and tenants (#​1966) (@​oliverbaehler)
• af2f377: fix: racing condition for terminating namespaces (#​1966) (@​oliverbaehler)
• af2f377: fix: fix typo in namespaces/finalize (#​1966) (@​oliverbaehler)

Full Changelog: projectcapsule/capsule@v0.13.5...v0.13.6

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.13.6
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.13.6

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.35	>= 1.35.0

Thanks to all the contributors! 🚀 🦄

v0.13.5

Compare Source

Changelog

✨ New Features

• e2aa501: feat(chart): allow additional controller rbac (#​1958) (@​oliverbaehler)
• 327296a: feat: add action type for rules and regexp cache (#​1957) (@​oliverbaehler)
• 34262c5: feat: add rule-based QOS enforcement (#​1961) (@​oliverbaehler)

🐛 Bug fixes

• 34262c5: fix: skip terminating namespaces for Tenantresources and GlobalTenantResources (#​1961) (@​oliverbaehler)
• 34262c5: fix: migrate registry rules api (#​1961) (@​oliverbaehler)
• 34262c5: fix: migrate promotions rules api (#​1961) (@​oliverbaehler)
• 6120885: fix: translate serviceaccounts to type serviceaccount not user (#​1956) (@​oliverbaehler)

Full Changelog: projectcapsule/capsule@v0.13.4...v0.13.5

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.13.5
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.13.5

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.35	>= 1.35.0

Thanks to all the contributors! 🚀 🦄

v0.13.4

Compare Source

Changelog

🐛 Bug fixes

• 4c72af7: fix: best effort patch reconciling status (#​1952) (@​oliverbaehler)
• 4c4d927: fix: use different match strategy for truthy and match (#​1953) (@​oliverbaehler)

Full Changelog: projectcapsule/capsule@v0.13.3...v0.13.4

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.13.4
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.13.4

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.35	>= 1.35.0

Thanks to all the contributors! 🚀 🦄

v0.13.3

Compare Source

Changelog

🐛 Bug fixes

• 780be87: fix: preserve ca-bundles injected from external providers (#​1948) (@​oliverbaehler)

🛠 Dependency updates

• 999869d: feat(deps): bump golang 1.26.4 (#​1949) (@​oliverbaehler)
• 3fc945b: fix(deps): update module sigs.k8s.io/cluster-api to v1.13.2 (#​1874) (@​renovate[bot])

Full Changelog: projectcapsule/capsule@v0.13.2...v0.13.3

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.13.3
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.13.3

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.35	>= 1.35.0

Thanks to all the contributors! 🚀 🦄

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 30.41%. Comparing base (2b188c4) to head (c654c6e).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1057   +/-   ##
=======================================
  Coverage   30.41%   30.41%           
=======================================
  Files          73       73           
  Lines        3419     3419           
=======================================
  Hits         1040     1040           
  Misses       2323     2323           
  Partials       56       56           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 4 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=14 days

Details:

Package	Change
github.com/onsi/gomega	v1.41.0 -> v1.42.1
github.com/go-sprout/sprout	v1.0.3 -> v1.1.0
go.opentelemetry.io/otel	v1.44.0 -> v1.45.0
go.opentelemetry.io/otel/trace	v1.44.0 -> v1.45.0