chore(deps): bump github.com/cert-manager/cert-manager from 1.14.4 to 1.18.1

[dependabot]

Bumps github.com/cert-manager/cert-manager from 1.14.4 to 1.18.1.

Release notes

Sourced from github.com/cert-manager/cert-manager's releases.

v1.18.0

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

cert-manager 1.18 introduces several new features and breaking changes. Highlights include support for ACME certificate profiles, a new default for Certificate.Spec.PrivateKey.RotationPolicy now set to Always (breaking change), and the default Certificate.Spec.RevisionHistoryLimit now set to 1 (potentially breaking).

ℹ️ Be sure to review all new features and changes below, and read the full release notes carefully before upgrading.

Known Issues

• ACME HTTP01 challenge paths are rejected by the ingress-nginx validating webhook (#7791)

Changes since v1.17.2:

Feature

• Add config to the Vault issuer to allow the server-name to be specified when validating the certificates the Vault server presents. (#7663, @​ThatsMrTalbot)
• Added app.kubernetes.io/managed-by: cert-manager label to the created Let's Encrypt account keys (#7577, @​terinjokes)
• Added certificate issuance and expiration time metrics (certmanager_certificate_not_before_timestamp_seconds, certmanager_certificate_not_after_timestamp_seconds). (#7612, @​solidDoWant)
• Added ingress-shim option: --extra-certificate-annotations, which sets a list of annotation keys to be copied from Ingress-like to resulting Certificate object (#7083, @​k0da)
• Added the iss short name for the cert-manager Issuer resource. (#7373, @​SgtCoDFish)
• Added the ciss short name for the cert-manager ClusterIssuer resource (#7373, @​SgtCoDFish)
• Adds the global.rbac.disableHTTPChallengesRole helm value to disable HTTP-01 ACME challenges. This allows cert-manager to drop its permission to create pods, improving security when HTTP-01 challenges are not required. (#7666, @​ali-hamza-noor)
• Allow customizing signature algorithm (#7591, @​tareksha)
• Cache the full DNS response and handle TTL expiration in FindZoneByFqdn (#7596, @​ThatsIvan)
• Cert-manager now uses a local fork of the golang.org/x/crypto/acme package (#7752, @​wallrj)
• Add support for ACME profiles extension. (#7777, @​wallrj)
• Promote the UseDomainQualifiedFinalizer feature to GA. (#7735, @​jsoref)
• Switched service/servicemon definitions to use port names instead of numbers. (#7727, @​jcpunk)
• The default value of Certificate.Spec.PrivateKey.RotationPolicy changed from Never to Always. (#7723, @​wallrj)
• Potentially breaking: Set the default revisionHistoryLimit to 1 for the CertificateRequest revisions (#7758, @​ali-hamza-noor)

Documentation

• Fix some comments (#7620, @​teslaedison)

Bug or Regression

• Bump go-jose dependency to address CVE-2025-27144. (#7606, @​SgtCoDFish)
• Bump golang.org/x/oauth2 to patch CVE-2025-22868. (#7638, @​NicholasBlaskey)
• Bump golang.org/x/crypto to patch GHSA-hcg3-q754-cr77. (#7638, @​NicholasBlaskey)
• Bump github.com/golang-jwt/jwt to patch GHSA-mh63-6h87-95cp. (#7638, @​NicholasBlaskey)
• Change of the Kubernetes Ingress pathType from ImplementationSpecific to Exact for a reliable handling of ingress controllers and enhanced security. (#7767, @​sspreitzer)
• Fix AWS Route53 error detection for not-found errors during deletion of DNS records. (#7690, @​wallrj)
• Fix behavior when running with --namespace=<namespace>: limit the scope of cert-manager to a single namespace and disable cluster-scoped controllers. (#7678, @​tsaarni)
• Fix handling of certificates with IP addresses in the commonName field; IP addresses are no longer added to the DNS subjectAlternativeName list and are instead added to the ipAddresses field as expected. (#7081, @​johnjcool)
• Fix issuing of certificates via DNS01 challenges on Cloudflare after a breaking change to the Cloudflare API (#7549, @​LukeCarrier)
• Fixed the certmanager_certificate_renewal_timestamp_seconds metric help text indicating that the metric is relative to expiration time, rather than Unix epoch time. (#7609, @​solidDoWant)
• Fixing the service account template to incorporate boolean values for the annotations. (#7698, @​ali-hamza-noor)
• Quote nodeSelector values in Helm Chart (#7579, @​tobiasbp)
• Skip Gateway TLS listeners in Passthrough mode. (#6986, @​vehagn)
• Upgrade golang.org/x/net fixing CVE-2025-22870. (#7619, @​dependabot[bot])

... (truncated)

Commits

• d5382c8 Merge pull request #7814 from cert-manager-bot/cherry-pick-7813-to-release-1.18
• c4e9ecf Change ACMEHTTP01IngressPathTypeExact feature to beta
• 379f43e Merge pull request #7811 from cert-manager-bot/cherry-pick-7809-to-release-1.18
• 9542d75 make generate
• aa0aedf Update feature gate documentation in the Helm chart
• f05762b Explain why we disable strict-validate-path in ingress-nginx
• ee3b742 Fix typo
• 80e4745 Merge pull request #7810 from cert-manager-bot/cherry-pick-7795-to-release-1.18
• d69c1fc feat(acme): Add default feature gate to set Ingress pathType to Exact
• a95f4e1 Merge pull request #7807 from cert-manager-bot/cherry-pick-7792-to-release-1.18
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #1771.