chore(deps): update all github action dependencies (patch)

[renovate]

This PR contains the following updates:

Package	Update	Change
cilium/cilium	patch	v1.18.5 → v1.18.6
helm/helm	patch	v3.19.4 → v3.19.5

---

Release Notes

cilium/cilium (cilium/cilium)

v1.18.6: 1.18.6

Compare Source

Summary of Changes

Major Changes:

• Publish Helm charts to OCI registries (Backport PR #​43689, Upstream PR #​43624, @​aanm)

Minor Changes:

• Cilium Preflight check no longer includes Envoy Configmaps, making it easier to correctly run. (Backport PR #​43290, Upstream PR #​43153, @​youngnick)
• runtime: Add libatomic1 for cilium-envoy dependency (Backport PR #​43642, Upstream PR #​43292, @​sayboras)

Bugfixes:

• bpf:wireguard: delivery host packets to bpf_host for ingress policies (Backport PR #​43690, Upstream PR #​42892, @​smagnani96)
• cgroup: don't start watch if KPRConfig.EnableSocketLB is disabled (Backport PR #​43290, Upstream PR #​43256, @​mhofstetter)
• Fix a bug with local redirect service entries being created when backend pods weren't ready. (Backport PR #​43425, Upstream PR #​43095, @​aditighag)
• Fix an issue in proxy NOTRACK iptables rule for aws-cni chaining mode which causes proxy->upstream(outside cluster) traffic not being SNAT'd. (Backport PR #​43676, Upstream PR #​43566, @​fristonio)
• Fix GC of possible duplicated identities in kvstore mode (Backport PR #​43425, Upstream PR #​43287, @​giorio94)
• Fixes a deadlock that was causing endpoint to be stuck without progressing with any updates. (Backport PR #​43290, Upstream PR #​43242, @​marseel)
• gateway-api: correctly handle CiliumGatewayClassConfig as a namespaced resource. (Backport PR #​43290, Upstream PR #​43254, @​youngnick)
• xds: fix nil-pointer in processRequestStream (Backport PR #​43612, Upstream PR #​43609, @​mhofstetter)

CI Changes:

• bpf: tests: egressgw: enable HostFW (Backport PR #​43337, Upstream PR #​42955, @​julianwiedmann)
• bpf: tests: egressgw: install ipcache_v6_add_world_entry() (Backport PR #​43337, Upstream PR #​42988, @​julianwiedmann)
• chore: comment job to use generated token instead of PAT (Backport PR #​43612, Upstream PR #​43148, @​sekhar-isovalent)
• ci: Use newer lvh image for privileged tests (Backport PR #​43490, Upstream PR #​41082, @​rastislavs)

Misc Changes:

• .github/workflows: remove auto-requested reviewers (Backport PR #​43425, Upstream PR #​42952, @​aanm)
• Add documentation and examples for using the egressDeny field in CiliumNetworkPolicy (Backport PR #​43425, Upstream PR #​40272, @​syedazeez337)
• bpf: clear mark content before storing the cluster ID (Backport PR #​43290, Upstream PR #​43159, @​giorio94)
• bpf: prevent cluster ID from being incorrectly retrieved from mark when aliased (Backport PR #​43290, Upstream PR #​43258, @​giorio94)
• chore(deps): update all github action dependencies (v1.18) (#​43467, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​43665, @​cilium-renovate[bot])
• chore(deps): update anchore/sbom-action action to v0.21.0 (v1.18) (#​43512, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.18) (#​43543, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.18) (#​43664, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/busybox:1.37.0 docker digest to 2383baa (v1.18) (#​43662, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.11 docker digest to 54528d1 (v1.18) (#​43464, @​cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.7 (v1.18) (#​43465, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.34.12-1767177245-7935d4d711cb6f8020385a50c996b90896e16a71 (v1.18) (#​43539, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9 (v1.18) (#​43638, @​cilium-renovate[bot])
• chore(deps): update rhysd/actionlint docker tag to v1.7.10 (v1.18) (#​43541, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​43466, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​43542, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​43571, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​43663, @​cilium-renovate[bot])
• cmapisrv/test: miscellaneous fixes to the ciliumidentities script test (Backport PR #​43425, Upstream PR #​43372, @​giorio94)
• docs: Add missing IPv6 fragmentation BPF map reference (Backport PR #​43290, Upstream PR #​43161, @​doniacld)
• Fix a regression in the new services control plane where loadBalancerSourceRanges was applied by default to all service types. (Backport PR #​43575, Upstream PR #​42351, @​borkmann)
• operator: the K8s Secret synchronization process now resynchronizes after an hour for synced Secrets. (Backport PR #​43425, Upstream PR #​42414, @​youngnick)
• release: change OCI registry (Backport PR #​43689, Upstream PR #​43646, @​aanm)
• route: install ingress proxy routes with WireGuard and L7Proxy (Backport PR #​43434, Upstream PR #​42835, @​smagnani96)

Other Changes:

• [v1.18] bpf:hubble: support policy verdict from L3 devices (#​43381, @​smagnani96)
• [v1.18] deps: bump CNI plugins version to v1.9.0 (#​43593, @​diyi0926)
• install: Update image digests for v1.18.5 (#​43400, @​cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.6@​sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4
quay.io/cilium/cilium:stable@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.6@​sha256:8ee142912a0e261850c0802d9256ddbe3729e1cd35c6bea2d93077f334c3cf3b
quay.io/cilium/clustermesh-apiserver:stable@sha256:8ee142912a0e261850c0802d9256ddbe3729e1cd35c6bea2d93077f334c3cf3b

docker-plugin

quay.io/cilium/docker-plugin:v1.18.6@​sha256:7931555ad713a48a28e4bf097402e0e398461dbf51b81cb8192558c5cb0dc48f
quay.io/cilium/docker-plugin:stable@sha256:7931555ad713a48a28e4bf097402e0e398461dbf51b81cb8192558c5cb0dc48f

hubble-relay

quay.io/cilium/hubble-relay:v1.18.6@​sha256:fb6135e34c31e5f175cb5e75f86cea52ef2ff12b49bcefb7088ed93f5009eb8e
quay.io/cilium/hubble-relay:stable@sha256:fb6135e34c31e5f175cb5e75f86cea52ef2ff12b49bcefb7088ed93f5009eb8e

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.6@​sha256:212c4cbe27da3772bcb952b8f8cbaa0b0eef72488b52edf90ad2b32072a3ca4c
quay.io/cilium/operator-alibabacloud:stable@sha256:212c4cbe27da3772bcb952b8f8cbaa0b0eef72488b52edf90ad2b32072a3ca4c

operator-aws

quay.io/cilium/operator-aws:v1.18.6@​sha256:47dbc1a5bd483fec170dab7fb0bf2cca3585a4893675b0324d41d97bac8be5eb
quay.io/cilium/operator-aws:stable@sha256:47dbc1a5bd483fec170dab7fb0bf2cca3585a4893675b0324d41d97bac8be5eb

operator-azure

quay.io/cilium/operator-azure:v1.18.6@​sha256:a57aff47aeb32eccfedaa2a49d1af984d996d6d6de79609c232e0c4cf9ce97a1
quay.io/cilium/operator-azure:stable@sha256:a57aff47aeb32eccfedaa2a49d1af984d996d6d6de79609c232e0c4cf9ce97a1

operator-generic

quay.io/cilium/operator-generic:v1.18.6@​sha256:34a827ce9ed021c8adf8f0feca131f53b3c54a3ef529053d871d0347ec4d69af
quay.io/cilium/operator-generic:stable@sha256:34a827ce9ed021c8adf8f0feca131f53b3c54a3ef529053d871d0347ec4d69af

operator

quay.io/cilium/operator:v1.18.6@​sha256:0e8903aa092025918761d24ae9a91af35baa5b6910b5d0e3feac91ab8a2bc65b
quay.io/cilium/operator:stable@sha256:0e8903aa092025918761d24ae9a91af35baa5b6910b5d0e3feac91ab8a2bc65b

helm/helm (helm/helm)

v3.19.5: Helm v3.19.5

Compare Source

Helm v3.19.5 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

• Join the discussion in Kubernetes Slack:
  • for questions and just to hang out
  • for discussing PRs, code, and bugs
• Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
• Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

• Fixed bug where removing subchart value via override resulted in warning #​31118
• Fixed bug where helm uninstall with --keep-history did not suspend previous deployed releases #​12556

Installation and Upgrading

Download Helm v3.19.5. The common platform binaries are here:

• MacOS amd64 (checksum / 57f4a847c349382b7cc742a6434ef25f88f0928a113d8cf49084b464878ef0b9)
• MacOS arm64 (checksum / 195e24e587f423f15a78feebab04583ceee68323598575a0e8b3b11b43fd26fe)
• Linux amd64 (checksum / a0a5e8c592ed3f376ac110715eff214730c7422f9a44d96cf98117d2b8b0e6c0)
• Linux arm (checksum / 1367926ea842729b4312fbf800234d15bcaa419c92201727b776da4550078a09)
• Linux arm64 (checksum / ce02147ffee6d993bf8ae97a44a22e9e1daf0b69d2d5b69a0c8cf6706445ccf5)
• Linux i386 (checksum / 54ec170590a6bfb26990c645426f92089d9eb574190c00620ca793d92b5891d5)
• Linux ppc64le (checksum / a51ba349875e2a219c909ae802435db403ea6924ca4725acb73f520da36e5f45)
• Linux s390x (checksum / 071f19deabaf2326a7ca54c3143934e2001c61bd106fa2949bf53d1e7452ecd0)
• Linux riscv64 (checksum / a33b2df76300d33008a2b47107f289a0de31d461e6bfb2354bf1fd747ccecc9b)
• Windows amd64 (checksum / f258b0d17a4c914ad453f9d8cc21643dddd354f4fbad4c7c595cf3480221379e)
• Windows arm64 (checksum / 232bccce9fe4212a22acc210a555edc75e101b26fb9a9eb1442c32bda8d102bf)

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @​scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

• 4.1.0 and 3.20.0 is the next minor releases and will be on January 21, 2026
• 4.1.1 and 3.20.1 are the next patch releases and will be on March 11, 2026

Changelog

• fix(rollback): errors.Is instead of string comp 4a19a5b (Hidde Beydals)
• fix(uninstall): supersede deployed releases 7a00235 (Hidde Beydals)
• fix null merge 578564e (Ben Foster)

---

Configuration

📅 Schedule: Branch creation - "before 6am on tuesday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.