amuraru · Nov 1, 2026 · Oct 31, 2026
diff --git a/.github/workflows/e2e-test.yaml b/.github/workflows/e2e-test.yaml
@@ -34,7 +34,7 @@ jobs:
       - name: Setup Helm
         uses: azure/setup-helm@v5
         with:
-          version: '4.3.0' # renovate: datasource=github-releases depName=helm/helm
+          version: '4.3.1' # renovate: datasource=github-releases depName=helm/helm
 
       - name: Clean Go module cache
         run: |

diff --git a/Dockerfile b/Dockerfile
@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.27@sha256:007a316059246276cb214df93950be77837545dc78007a73e0291a4963d5d3bf AS builder
+FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.27@sha256:2920bb124f1a2e12a1d39f0cab756ae0068441ee1da7655dec7f5e374944095b AS builder
 
 ARG BUILDPLATFORM
 ARG TARGETPLATFORM

diff --git a/Makefile b/Makefile
@@ -18,13 +18,13 @@ RELEASE_MSG ?= "koperator release"
 REL_TAG = $(shell ./scripts/increment_version.sh -${RELEASE_TYPE} ${TAG})
 
 # Version constants
-GOLANGCI_VERSION = 2.14.0 # renovate: datasource=github-releases depName=golangci/golangci-lint
+GOLANGCI_VERSION = 2.15.0 # renovate: datasource=github-releases depName=golangci/golangci-lint
 LICENSEI_VERSION = 0.9.0 # renovate: datasource=github-releases depName=goph/licensei
 CONTROLLER_GEN_VERSION = v0.22.0 # kept in sync with kubernetes-sigs/controller-tools by `make update-go-deps`
 ENVTEST_K8S_VERSION = 1.37.0 # renovate: datasource=github-releases depName=kubernetes-sigs/controller-tools extractVersion=^envtest-v(?<version>.+)$
 SETUP_ENVTEST_VERSION := latest
 ADDLICENSE_VERSION = 1.2.0 # renovate: datasource=github-releases depName=google/addlicense
-GOTEMPLATE_VERSION = 3.12.0 # renovate: datasource=github-releases depName=coveooss/gotemplate
+GOTEMPLATE_VERSION = 3.12.1 # renovate: datasource=github-releases depName=coveooss/gotemplate
 MOCKGEN_VERSION = 0.6.0 # renovate: datasource=github-releases depName=uber-go/mock
 
 GOPROXY=https://proxy.golang.org

diff --git a/api/go.mod b/api/go.mod
@@ -1,6 +1,6 @@
 module github.com/banzaicloud/koperator/api
 
-go 1.27.2
+go 1.27.3
 
 require (
 	dario.cat/mergo v1.0.2

diff --git a/api/v1beta1/kafkacluster_types.go b/api/v1beta1/kafkacluster_types.go
@@ -55,7 +55,7 @@ const (
 	IsControllerNodeKey = "isControllerNode"
 
 	// DefaultCruiseControlImage is the default CC image used when users don't specify it in CruiseControlConfig.Image
-	DefaultCruiseControlImage = "adobe/cruise-control:3.0.3-adbe-20260722" // renovate: datasource=docker depName=adobe/cruise-control
+	DefaultCruiseControlImage = "adobe/cruise-control:3.1.0-adbe-20261029" // renovate: datasource=docker depName=adobe/cruise-control
 
 	// DefaultKafkaImage is the default Kafka image used when users don't specify it in KafkaClusterSpec.ClusterImage
 	DefaultKafkaImage = "ghcr.io/adobe/koperator/kafka:2.13-3.9.2-jdk21.0.12" // renovate: datasource=docker depName=ghcr.io/adobe/koperator/kafka
@@ -64,7 +64,7 @@ const (
 	DefaultMonitorImage = "ghcr.io/adobe/koperator/jmx-javaagent:1.5.0" // renovate: datasource=docker depName=ghcr.io/adobe/koperator/jmx-javaagent
 
 	// DefaultEnvoyImage is the default Envoy proxy image used when users don't specify it in EnvoyConfig.Image
-	DefaultEnvoyImage = "envoyproxy/envoy:v1.39.4" // renovate: datasource=docker depName=envoyproxy/envoy
+	DefaultEnvoyImage = "envoyproxy/envoy:v1.40.2" // renovate: datasource=docker depName=envoyproxy/envoy
 
 	// ControllerNodeProcessRole represents the node is a controller node
 	ControllerNodeProcessRole = "controller"
@@ -115,7 +115,7 @@ const (
 	/* Cruise Control Config */
 
 	// CruiseControlDeployment.spec.template.spec.container["%s-cruisecontrol"].image
-	defaultCruiseControlImage = "adobe/cruise-control:3.0.3-adbe-20260722" // renovate: datasource=docker depName=adobe/cruise-control
+	defaultCruiseControlImage = "adobe/cruise-control:3.1.0-adbe-20261029" // renovate: datasource=docker depName=adobe/cruise-control
 
 	// CruiseControlDeployment.spec.template.spec.container["%s-cruisecontrol"].resources
 	defaultCruiseControlRequestResourceCpu    = "200m"

diff --git a/charts/kafka-operator/values.yaml b/charts/kafka-operator/values.yaml
@@ -103,7 +103,7 @@ prometheusMetrics:
       # -- Auth proxy container image repository
       repository: quay.io/brancz/kube-rbac-proxy
       # -- Auth proxy container image tag
-      tag: v0.23.0
+      tag: v0.23.1
       # -- Auth proxy container image pull policy
       pullPolicy: IfNotPresent
     serviceAccount:

diff --git a/config/overlays/auth-proxy-enabled/manager_auth_proxy_patch.yaml b/config/overlays/auth-proxy-enabled/manager_auth_proxy_patch.yaml
@@ -10,7 +10,7 @@ spec:
     spec:
       containers:
       - name: kube-rbac-proxy
-        image: quay.io/brancz/kube-rbac-proxy:v0.23.0 # renovate: datasource=docker depName=quay.io/brancz/kube-rbac-proxy
+        image: quay.io/brancz/kube-rbac-proxy:v0.23.1 # renovate: datasource=docker depName=quay.io/brancz/kube-rbac-proxy
         args:
         - "--secure-listen-address=0.0.0.0:8443"
         - "--upstream=http://127.0.0.1:8080/"

diff --git a/config/overlays/certmanager-with-auth-proxy/auth-proxy/manager_auth_proxy_patch.yaml b/config/overlays/certmanager-with-auth-proxy/auth-proxy/manager_auth_proxy_patch.yaml
@@ -10,7 +10,7 @@ spec:
     spec:
       containers:
       - name: kube-rbac-proxy
-        image: quay.io/brancz/kube-rbac-proxy:v0.23.0 # renovate: datasource=docker depName=quay.io/brancz/kube-rbac-proxy
+        image: quay.io/brancz/kube-rbac-proxy:v0.23.1 # renovate: datasource=docker depName=quay.io/brancz/kube-rbac-proxy
         args:
         - "--secure-listen-address=0.0.0.0:8443"
         - "--upstream=http://127.0.0.1:8080/"

diff --git a/config/samples/simplekafkacluster.yaml b/config/samples/simplekafkacluster.yaml
@@ -85,7 +85,7 @@ spec:
 #      limits:
 #        cpu: 500m
 #        memory: 1Gi
-    image: "adobe/cruise-control:3.0.3-adbe-20260722" # renovate: datasource=docker depName=adobe/cruise-control
+    image: "adobe/cruise-control:3.1.0-adbe-20261029" # renovate: datasource=docker depName=adobe/cruise-control
     config: |
       # Copyright 2017 LinkedIn Corp. Licensed under the BSD 2-Clause License (the "License"). See License in the project root for license information.
       #

diff --git a/config/samples/simplekafkacluster_4disk.yaml b/config/samples/simplekafkacluster_4disk.yaml
@@ -105,7 +105,7 @@ spec:
 #      limits:
 #        cpu: 500m
 #        memory: 1Gi
-    image: "adobe/cruise-control:3.0.3-adbe-20260722" # renovate: datasource=docker depName=adobe/cruise-control
+    image: "adobe/cruise-control:3.1.0-adbe-20261029" # renovate: datasource=docker depName=adobe/cruise-control
     config: |
       # Copyright 2017 LinkedIn Corp. Licensed under the BSD 2-Clause License (the "License"). See License in the project root for license information.
       #

diff --git a/config/samples/simplekafkacluster_5broker.yaml b/config/samples/simplekafkacluster_5broker.yaml
@@ -88,7 +88,7 @@ spec:
 #      limits:
 #        cpu: 500m
 #        memory: 1Gi
-    image: "adobe/cruise-control:3.0.3-adbe-20260722" # renovate: datasource=docker depName=adobe/cruise-control
+    image: "adobe/cruise-control:3.1.0-adbe-20261029" # renovate: datasource=docker depName=adobe/cruise-control
     config: |
       # Copyright 2017 LinkedIn Corp. Licensed under the BSD 2-Clause License (the "License"). See License in the project root for license information.
       #

diff --git a/docker/jmx_exporter/Dockerfile b/docker/jmx_exporter/Dockerfile
@@ -1,6 +1,6 @@
 ARG JMX_EXPORTER_VERSION=1.7.0 # renovate: datasource=github-releases depName=prometheus/jmx_exporter
 
-FROM maven:3-amazoncorretto-21@sha256:9b868ffa88a46d8b4e605fa14db1e0debe2edb798b3b5890156e92d55a17b11b AS build
+FROM maven:3-amazoncorretto-21@sha256:f64fd4f0363c918004816d83d2589495b622a8d2fc5c5602c135cb4124c7ea12 AS build
 ARG JMX_EXPORTER_VERSION
 
 # Install wget to download the release tarball
@@ -19,7 +19,7 @@ RUN mvn -B -Dmaven.javadoc.skip=true -Dskip.javadoc=true \
     clean package -pl jmx_prometheus_javaagent -am && \
     cp "jmx_prometheus_javaagent/target/jmx_prometheus_javaagent-${JMX_EXPORTER_VERSION#v}.jar" /jmx_prometheus_javaagent.jar
 
-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
 COPY --from=build /jmx_prometheus_javaagent.jar /opt/jmx_exporter/jmx_prometheus_javaagent.jar
 RUN ln -s /opt/jmx_exporter/jmx_prometheus_javaagent.jar /jmx_prometheus_javaagent.jar
 CMD ["/bin/sh"]
diff --git a/docker/kafka/Dockerfile b/docker/kafka/Dockerfile
@@ -6,7 +6,7 @@ ARG scala_version=2.13
 ARG KAFKA_VERSION=3.9.2 # renovate: datasource=github-tags depName=apache/kafka
 ARG java_version=21
 
-FROM alpine:latest@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS kafka_dist
+FROM alpine:latest@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a AS kafka_dist
 
 ARG scala_version
 ARG KAFKA_VERSION
@@ -34,7 +34,7 @@ RUN apk add --no-cache gnupg wget && \
 
 
 # backported from https://github.com/docker-library/openjdk/blob/master/18/jdk/slim-bullseye/Dockerfile
-FROM debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f
+FROM debian:trixie-slim@sha256:f6b08b09a05725f9431502d3b5714f5c4576e82c1a84fa1debe0c24a7e0c3ec4
 
 ARG scala_version
 ARG KAFKA_VERSION

diff --git a/docs/benchmarks/loadgens/Dockerfile b/docs/benchmarks/loadgens/Dockerfile
@@ -15,7 +15,7 @@ WORKDIR /build/sangrenel
 
 RUN go mod download && go build -o /sangrenel
 
-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
 
 RUN apk add --update --no-cache ca-certificates tzdata curl bash
 

diff --git a/docs/examples/springboot-kafka-avro/Dockerfile b/docs/examples/springboot-kafka-avro/Dockerfile
@@ -1,4 +1,4 @@
-FROM maven:3.10-eclipse-temurin-21-alpine@sha256:e2359c0c326fc120e375affa68bcab2fc16fca7acf7385a50dd6071da736d281 as build
+FROM maven:3.10-eclipse-temurin-21-alpine@sha256:db7b12415a992fec6d3d2a1f4a32c9225a1d98c71cbfd2379f8c4a12775f6f34 as build
 
 # Set working directory
 WORKDIR /usr/src/myapp
@@ -12,7 +12,7 @@ COPY src ./src
 RUN mvn clean package -DskipTests
 
 # The final image should have minimal layers
-FROM eclipse-temurin:27-jre-alpine@sha256:9d76de111573e77ac415d8344271a2e57dd19bd59c48725fa3bac38c101bd0ba
+FROM eclipse-temurin:27-jre-alpine@sha256:0faf24c1d1e778bbc0700fc71c53b081c9432f1e51e6e41c86c63840e8b89ac1
 RUN apk add --no-cache curl
 COPY --from=build /usr/src/myapp/target/kafka-avro-0.0.1-SNAPSHOT.jar app.jar
 ENTRYPOINT ["java", "-jar", "app.jar"]
diff --git a/docs/examples/springboot-kafka-avro/pom.xml b/docs/examples/springboot-kafka-avro/pom.xml
@@ -5,7 +5,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>4.1.1</version>
+        <version>4.1.2</version>
         <relativePath/> <!-- lookup parent from repository -->
     </parent>
     <groupId>io.banzaicloud.blog</groupId>
@@ -46,7 +46,7 @@
         <dependency>
             <groupId>io.confluent</groupId>
             <artifactId>kafka-schema-registry-client</artifactId>   <!-- <1> -->
-            <version>8.3.2</version>
+            <version>8.4.0</version>
         </dependency>
         <dependency>
             <groupId>org.apache.avro</groupId>
@@ -56,7 +56,7 @@
         <dependency>
             <groupId>io.confluent</groupId>
             <artifactId>kafka-avro-serializer</artifactId>  <!-- <3> -->
-            <version>8.3.2</version>
+            <version>8.4.0</version>
         </dependency>
     </dependencies>
 

diff --git a/go.mod b/go.mod
@@ -1,6 +1,6 @@
 module github.com/banzaicloud/koperator
 
-go 1.27.2
+go 1.27.3
 
 require (
 	dario.cat/mergo v1.0.2

diff --git a/hack/kafka-test-pod/Dockerfile b/hack/kafka-test-pod/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.27@sha256:007a316059246276cb214df93950be77837545dc78007a73e0291a4963d5d3bf as builder
+FROM golang:1.27@sha256:2920bb124f1a2e12a1d39f0cab756ae0068441ee1da7655dec7f5e374944095b as builder
 
 WORKDIR /workspace
 

diff --git a/properties/go.mod b/properties/go.mod
@@ -1,6 +1,6 @@
 module github.com/banzaicloud/koperator/properties
 
-go 1.27.2
+go 1.27.3
 
 require (
 	emperror.dev/errors v0.8.1

diff --git a/tests/e2e/go.mod b/tests/e2e/go.mod
@@ -1,6 +1,6 @@
 module github.com/banzaicloud/koperator/tests/e2e
 
-go 1.27.2
+go 1.27.3
 
 require (
 	emperror.dev/errors v0.8.1

diff --git a/tests/e2e/versions.go b/tests/e2e/versions.go
@@ -19,13 +19,13 @@ package e2e
 // These versions are monitored by Renovate for automatic updates
 const (
 	// CertManagerVersion is the version of cert-manager Helm chart
-	CertManagerVersion = "v1.21.2" // renovate: datasource=helm depName=cert-manager registryUrl=https://charts.jetstack.io
+	CertManagerVersion = "v1.21.3" // renovate: datasource=helm depName=cert-manager registryUrl=https://charts.jetstack.io
 
 	// ContourVersion is the version of Contour ingress controller Helm chart
-	ContourVersion = "0.8.0" // renovate: datasource=helm depName=contour registryUrl=https://projectcontour.github.io/helm-charts
+	ContourVersion = "0.9.0" // renovate: datasource=helm depName=contour registryUrl=https://projectcontour.github.io/helm-charts
 
 	// PrometheusOperatorVersion is the version of kube-prometheus-stack Helm chart
-	PrometheusOperatorVersion = "92.3.1" // renovate: datasource=helm depName=kube-prometheus-stack registryUrl=https://prometheus-community.github.io/helm-charts
+	PrometheusOperatorVersion = "92.17.0" // renovate: datasource=helm depName=kube-prometheus-stack registryUrl=https://prometheus-community.github.io/helm-charts
 
 	// ZookeeperOperatorVersion is the version of zookeeper-operator
 	ZookeeperOperatorVersion = "0.2.15-adobe-20260924" // renovate: datasource=docker depName=ghcr.io/adobe/helm-charts/zookeeper-operator

diff --git a/third_party/github.com/banzaicloud/go-cruise-control/go.mod b/third_party/github.com/banzaicloud/go-cruise-control/go.mod
@@ -1,6 +1,6 @@
 module github.com/banzaicloud/go-cruise-control
 
-go 1.27.2
+go 1.27.3
 
 require (
 	github.com/go-logr/logr v1.4.4

diff --git a/third_party/github.com/banzaicloud/go-cruise-control/integration_test/go.mod b/third_party/github.com/banzaicloud/go-cruise-control/integration_test/go.mod
@@ -1,6 +1,6 @@
 module github.com/banzaicloud/go-cruise-control/integration_test
 
-go 1.27.2
+go 1.27.3
 
 require (
 	github.com/banzaicloud/go-cruise-control v0.6.0

diff --git a/third_party/github.com/banzaicloud/k8s-objectmatcher/go.mod b/third_party/github.com/banzaicloud/k8s-objectmatcher/go.mod
@@ -1,6 +1,6 @@
 module github.com/banzaicloud/k8s-objectmatcher
 
-go 1.27.2
+go 1.27.3
 
 require (
 	emperror.dev/errors v0.8.1

diff --git a/third_party/github.com/banzaicloud/k8s-objectmatcher/tests/go.mod b/third_party/github.com/banzaicloud/k8s-objectmatcher/tests/go.mod
@@ -1,6 +1,6 @@
 module github.com/banzaicloud/k8s-objectmatcher/tests
 
-go 1.27.2
+go 1.27.3
 
 require (
 	emperror.dev/errors v0.8.1

diff --git a/third_party/github.com/banzaicloud/operator-tools/go.mod b/third_party/github.com/banzaicloud/operator-tools/go.mod
@@ -1,6 +1,6 @@
 module github.com/banzaicloud/operator-tools
 
-go 1.27.2
+go 1.27.3
 
 require (
 	emperror.dev/errors v0.8.1