Update Helm release keda to v2.19.0

[renovate]

This PR contains the following updates:

Package	Update	Change
keda	minor	2.16.1 → 2.19.0

---

Release Notes

kedacore/keda (keda)

v2.19.0

Compare Source

New

• General: Add file-based authentication support for ClusterTriggerAuthentication (#​7083)
• General: Introduce new Kubernetes Resource Scaler (#​7212)

Improvements

• General: Correct error message when awsSecretAccessKey is missing in credential-based authentication (#​7265)
• General: Emit more events about what is happening with ScaledObject/ScaledJob (#​7382)
• General: Raw metrics stream - include trigger activity status in response (#​7369)
• AWS CloudWatch Scaler: Add cross-account observability support (#​7189)
• Dynamodb Scaler: Add FilterExpression support (#​7102)
• Dynatrace Scaler: Support DQL querying (#​7377)
• MongoDB Scaler: Add TLS support (#​6976)

Fixes

• General: Apply fallback in polling loop to enable scaling from zero (#​7239)
• General: Fix accurateScalingStrategy ignoring pendingJobCount in maxReplicaCount check (#​7329)
• General: Replace deprecated azure autorest dependency to azure sdk for go (#​7073)
• Datadog Scaler: Return request in cluster agent proxy without bearer auth (#​7341)
• Datadog Scaler: Use metricUnavailableValue for 422 errors in Datadog Cluster Agent (#​7246)
• IBMMQ Scaler: Create new HTTP request for each queue query in IBMMQ scaler (#​7202)
• Kafka Scaler: Improve check for missing partition information when calculating lag (#​7414)
• Temporal Scaler: Fix TLS RootCAs initialization when using API key authentication with Temporal Cloud (#​7367)

Deprecations

You can find all deprecations in this overview and join the discussion here.

Breaking Changes

• NATS Streaming scaler: Remove NATS Streaming Server (aka Stan) (#​6366)

Other

• CI: Replace stale bot with official GitHub Actions stale action (#​7321)
• CI: Use GitHub-hosted ARM64 runners (#​7293)
• ScaledObject/ScaledJob: Track activity for each trigger in the status (#​7347)

v2.18.3

Compare Source

• General: Fix CVE-2025-68476 (#​7334)

Fixes

v2.18.2

Compare Source

Fixes

• General: Fix HPA behavior not restored when paused-scale-in/out annotation is deleted without corresponding custom behavior (#​7291)
• General: Fix nil reference panic when transfer-hpa-ownership is set but no hpa name is provided (#​7254)
• General: Fix race condition in paused-replicas annotation causing ScaledObject to get stuck (#​7231)
• General: Fix ScaledObject controller error handling for requestScaleLoop (#​7273)
• General: Remove unnecessary scaledObjectMetricSpecs variable in HPA (#​7292)
• General: Use TriggerError when all ScaledJob triggers fail (#​7205)
• ActiveMQ Scaler: Correct parse error ActiveMQ (#​7245)
• Datadog Scaler: Fix metricUnavailableValue parameter not working (#​7238)

v2.18.1

Compare Source

Fixes

• General: Add feature flag KEDA_CHECK_UNEXPECTED_SCALERS_PARAMS for checking unexpected scaler parameters (#​6721)
• General: Fix incorrect 'unmatched input property' notification (#​7174)
• Kafka Scaler: Fix missing error returns in error handling (#​7182)

Other

• General: Raw metrics stream - send also metrics during ScaledObject's interval (#​7197)

v2.18.0

Compare Source

New

• General: Add fallback support for triggers of Value metric type (#​6655)
• General: Add support for Force Activation annotation (#​6903)
• General: Add support for pause scale in annotation (#​6902)
• General: Add support for pause scale out annotation (#​7022)
• General: Enable support on s390x for KEDA (#​6543)
• General: Introduce new Forgejo Scaler (#​6488)
• General: Introduce new Solace Direct Messaging scaler (#​6545)
• General: Introduce new SolarWinds Scaler (#​6576)
• General: Introduce new Splunk Observability Cloud Scaler (#​7152)
• General: Introduce new Sumo Logic Scaler (#​6734)
• General: Support for declarative e2e test setup and filtering (#​6989)
• General: Trigger Schema Generated Tool (#​6345)
• General: Vault authentication via cross-namespace service accounts (#​6153)

Improvements

• General: Add error and event for mismatching input property (#​6721)
• General: Allow excluding labels from being propagated from ScaledObject and ScaledJob to generated HPA and Job objects (#​6849)
• General: Improve Events emitted from ScaledObject controller (#​6802)
• General: Only add webhook DNS names when webhook patching is enabled (#​7002)
• Apache Kafka Scaler: Add support for even distribution of partitions to consumers (#​2581)
• Artemis Scaler: Add TLS support with client certificates for secure HTTPS connections (#​6448)
• AWS CloudWatch Scaler: Add support for CloudWatch extended statistics (e.g P99 / TM90 and etc) (#​7109)
• Azure Pipelines Scaler: Ability to enable case-insensitive comparison of pipeline job demands (#​7111)
• Azure Pipelines Scaler: Ability to fetch only unfinished pipeline jobs for a pool (#​6819)
• Datadog Scaler: Add a specific timeout configuration parameter for the Datadog trigger (#​6999)
• Datadog Scaler: Improve Datadog scaler error messages (#​6999)
• Github Scaler: Add support to control unlabeled job/runner matching (#​6900)
• InfluxDB Scaler: Add support for InfluxDB v3 (#​6981)
• Kafka Scaler: Add support for even distribution of partitions to consumers (#​2581)
• Metrics API scaler: Introduce new aggregateFromKubeServiceEndpoints and aggregationType metadata fields to metrics-api so it is able to fetch metrics from all endpoints behind a kubernetes service and aggregate them (#​6565)
• Metrics API Scaler: Support AuthParams for authMode (#​6939)
• Metrics API Scaler: Support multiple auth methods simultaneously (#​6642)
• RabbitMQ Scaler: add DeliverGetRate, PublishedToDeliveredRatio and ExpectedQueueConsumptionTime trigger modes to RabbitMQ scaler (#​7071)
• Solace Scaler: Add hostlist support for Solace brokers (#​7090)
• Temporal Scaler: Always set temporal-namespace header on requests(#​7079)
• Temporal Scaler: Support custom tlsServerName (#​6820)

Fixes

• General: Add missing omitempty json tags in the AuthPodIdentity struct (#​6779)
• General: Correct pending pod condition logic for ScaledJobs (#​6727)
• General: Fix external push scaler deactivation behavior (#​6986)
• General: Fix parse timeout config as milliseconds instead of seconds (#​6997)
• General: Fix prefixes on envFrom elements in a deployment spec aren't being interpreted and Environment variables are not prefixed with the prefix (#​6728)
• General: Fix SIGSEGV when doing fallback of non-static behavior on any ScaleTargetRef that is neither a Deployment nor a StatefulSet (#​6992)
• General: New Scaled{Object,Job} has paused condition in their status as False instead of Unknown (#​7011)
• General: Remove klogr dependency and replace with zap (#​5732)
• General: Resolve race condition when removing paused-replicas annotation from ScaledObject (#​6982)
• General: Sets hpaName in Status when ScaledObject adopts/finds an existing HPA (#​6336)
• Cron Scaler: Fix cron scaler to return zero metric value by default(#​6886)
• Datadog Scaler: Fix bug with datadogNamespace config (#​6828)
• Hashicorp Vault: Fix Vault PKI param using camel case param when making API call to Vault PKI endpoint (#​6864)
• Kafka Scaler: Fix throwing error when using sasl=none (#​7061)
• Pulsar Scaler: Resolve nil pointer dereference in Pulsar scaler redirect handling (#​7024)
• RabbitMQ Scaler: Fix incorrect URL encoding in RabbitMQ vhosts containing %2f (#​6963)
• Temporal Scaler: Allow setting 0 for targetQueueSize (#​7113)

Deprecations

You can find all deprecations in this overview and join the discussion here.

New deprecation(s):

• GCP Pub/Sub Scaler: The subscriptionSize setting is DEPRECATED and will be removed in v2.20 - Use mode and value instead (#​6866)
• Huawei Cloudeye Scaler: The minMetricValue setting is DEPRECATED and will be removed in v2.20 - Use activationTargetMetricValue instead (#​6978)

Breaking Changes

• General: Remove Prometheus webhook prommetrics deprecations (#​6698)
• CPU Memory scaler: The type setting is deprecated and removed, use metricType instead (#​6698)
• IBM MQ scaler: The tls setting is deprecated and removed, use unsafeSsl instead (#​6698)

Other

• General: Add gRPC service that allows subscribing to a raw metric values (#​7094)
• General: Bump Controller Runtime version to v0.20.4 (#​7081)
• General: Fix several typos (#​6909)
• General: Replace deprecated webhook.Validator with webhook.CustomValidator (#​6660)
• MSSQL Scaler: Refactor MS SQL e2e test (#​3401)

v2.17.3

Compare Source

• General: Fix CVE-2025-68476 (#​7333)

v2.17.2

Compare Source

Improvements

• General: Internal gRPC connection's certificates are hot reloaded (#​6756)

Fixes

• Temporal Scaler: Fix Temporal Scaler TLS version (#​6707)

v2.17.1

Compare Source

Improvements

• Selenium Grid: Update metric name generated without part of empty (#​6772)

Fixes

• General: Admission Webhook blocks ScaledObject without metricType with fallback (#​6696)
• General: ScalerCache gets the lock before operate the scalers to prevent panics (#​6739)
• AWS SQS Queue Scaler: Fix AWS SQS Queue queueURLFromEnv not working (#​6712)
• Azure Service Bus scaler: Fix Azure Service Bus scaler add default Operation (#​6730)
• Temporal Scaler: Fix Temporal Scaler does not work properly with API Key authentication against Temporal Cloud as TLS is not enabled on the client (#​6703)

v2.17.0

Compare Source

New

• General: Add support for time-bound Kubernetes ServiceAccount tokens as a source for TriggerAuthentication (#​6136)
• General: Introduce new NSQ scaler (#​3281)
• General: Introduce new Temporal scaler (#​4724)

Improvements

• General: Add Fallback option behavior for dynamic fallback calculation (#​6450)
• General: Add SecretKey to AWS SecretsManager TriggerAuthentication to allow parsing JSON / Key/Value Pairs in secrets (#​5940)
• General: Enable OpenSSF Scorecard to enhance security practices across the project (#​5913)
• General: Operator flag to control patching of webhook resources certificates (#​6184)
• Azure Log Analytics Scaler: Add custom HTTP client timeout (#​6607)
• Azure Pipelines Scaler: Introduce requireAllDemandsAndIgnoreOthers to match job demands while ignoring extras (#​5579)
• Elasticsearch Scaler: Support IgnoreNullValues at Elasticsearch scaler (#​6599)
• GitHub Scaler: Add support to use ETag for conditional requests against the Github API (#​6503)
• GitHub Scaler: Filter workflows via query parameter for improved queue count accuracy (#​6519)
• IBMMQ Scaler: Handling StatusNotFound in IBMMQ scaler (#​6472)
• MongoDB Scaler: Support float queryValue for MongoDB scaler (#​6574)
• Prometheus Scaler: Add custom HTTP client timeout (#​6607)
• RabbitMQ Scaler: Support use of the ‘vhostName’ parameter in the ‘TriggerAuthentication’ resource (#​6369)
• Selenium Grid: Add trigger param for Node enables managed downloads capability (#​6570)
• Selenium Grid: Add trigger param to set custom capabilities for matching specific Nodes (#​6536)
• Selenium Grid: Selenium Grid: Trigger param enableManagedDownloads set as true by default (#​6684)

Fixes

• General: Centralize and improve automaxprocs configuration with proper structured logging (#​5970)
• General: Fix CVE-2025-27144 and CVE-2025-22868 (#​6613)
• General: Fix CVE-2025-29786 (#​6637)
• General: Fix CVE-2025-30204 (#​6641)
• General: Fix event text when deactivation fails (#​6469)
• General: Fix fallback validation check bug (#​6407)
• General: Fix the check whether Fallback is enabled when using ScalingModifiers (#​6521)
• General: Fix waiting to reach failureThreshold before fallback (#​6520)
• General: Make sure the exposed metrics (from KEDA operator) are updated when there is a change to triggers (#​6618)
• General: Paused ScaledObject count is reported correctly after operator restart (#​6321)
• General: Reiterate fix (after #​6407) for fallback validation in admission webhook. (#​6538)
• General: ScaledJobs ready status set to true when recovered problem (#​6329)
• AWS Scalers: Add AWS region to the AWS Config Cache key (#​6128)
• External Scaler: Support server TLS without custom CA (#​6606)
• GCP Storage: GCP Storage scaler ignores folders (#​6531)
• Metrics API: Fix text format parsing error resulting in unexpected end of input stream (#​6559)
• NATS JetStream: Support for looking up account using an ID (#​6611)
• Redis Streams: Allow default value of 0 for activationLagCount (#​6478)
• Selenium Grid: Scaler logic on platformName is set empty or any (#​6477)

Deprecations

You can find all deprecations in this overview and join the discussion here.

New deprecation(s):

• NATS Streaming scaler: Deprecate NATS Streaming Server (aka Stan) (#​6362)

Breaking Changes

• General: Change InitialCooldownPeriod from int32 to *int32 (#​6423)
• General: Remove Prometheus metric deprecations (#​6339)
• External Scaler: Remove deprecated tlsCertFile from External scaler (#​4549)

Other

• General: Add debug logs tracking validation of ScaledObjects on webhook (#​6498)
• General: Add time.Duration in TypedConfig (#​6650)
• General: New eventreason KEDAScalersInfo to display important information (#​6328)
• Apache Kafka Scaler: Remove unused awsEndpoint in Apache Kafka scaler (#​6627)
• External Scalers: Allow float64 values in externalmetrics' MetricValue & TargetSize. The old fields are still there because of backward compatibility. (#​5159)

---

Configuration

📅 Schedule: Branch creation - "before 6am on Monday" in timezone America/Los_Angeles, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.