Update Helm release velero to v12.2.0

[renovate]

This PR contains the following updates:

Package	Update	Change
velero (source)	minor	12.1.0 → 12.2.0

---

Release Notes

vmware-tanzu/helm-charts (velero)

v12.2.0

Compare Source

A Helm chart for velero

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 12:00 AM and 03:59 AM, on day 1 through 7 and 15 through 21 of the month, and on Monday (* 0-3 1-7,15-21 * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

velero (Helm chart) (helm) 12.1.0 -> 12.2.0, velero/velero (docker) v1.18.1 -> v1.18.2

Risk: 🟢 Safe

The Deep Dive

Update Scope

The chart moves from 12.1.0 to 12.2.0. The chart diff changes only appVersion, the default image.tag, and the README. In the rendered manifests, the only change is that the server Deployment and node-agent DaemonSet images move from velero/velero:v1.18.1 to v1.18.2, along with the app.kubernetes.io/version labels. kubernetes/velero/kustomization.yaml has no images: override, so the deployed Velero version does change.

Unchanged: CRDs (no helm/crds/ files in the PR), RBAC, values.yaml, the velero-plugin-for-aws init container (v1.14.2, pinned separately in kubernetes/velero/values.yaml), the kopia library (v0.16.0 with the same project-velero/kopia replace), and the rclone/BSL configuration.

Performance & Stability

Faster backups for the includedNamespaces: ['*'] schedule

• #9870 restores cross-namespace listing for *. This fixes a regression from #9587 that shipped in v1.18.1, the version currently deployed. The regression made Velero issue one LIST call per namespace for every resource type. The upstream report (#9869) measured about 35,000 API calls instead of about 200.
• Deployment relevance: kubernetes/velero/schedule-daily.yaml sets includedNamespaces: ['*'] with a label selector, so the daily daily-iscsi-backups run uses this code path. The fix takes effect automatically. How much faster the run gets depends on the live namespace count, which can't be seen from CI.
• The same PR includes a follow-up commit, "Fix excluded namespace objects leaking into backup with cross-namespace listing". The schedule sets no excludedNamespaces, so that edge case does not apply here.

Security

Per the OSV lookups of every changed module, this update resolves the advisories below and introduces none. OSV lists no CVSS scores for these Go advisories, so none are given.

Go toolchain 1.25.10 → 1.25.11 (#9919)

• GO-2026-5037 / CVE-2026-27145: inefficient candidate hostname parsing in crypto/x509 (DoS).
• GO-2026-5038 / CVE-2026-42504: quadratic complexity in mime WordDecoder.DecodeHeader.
• GO-2026-5039 / CVE-2026-42507: unescaped input in net/textproto errors.
• Nine other stdlib advisories affect both 1.25.10 and 1.25.11, so they are unchanged by this PR.

Library bumps

• golang.org/x/crypto 0.50.0 → 0.53.0 resolves 13 advisories, mostly in x/crypto/ssh and ssh/agent: GO-2026-5005, GO-2026-5006, GO-2026-5013, GO-2026-5014, GO-2026-5015, GO-2026-5016, GO-2026-5017, GO-2026-5018, GO-2026-5019, GO-2026-5020, GO-2026-5021, GO-2026-5023, GO-2026-5033. Examples: GO-2026-5014 (CVE-2026-39828, SSH certificate restriction bypass) and GO-2026-5021 (CVE-2026-42508, knownhosts @revoked not enforced). Velero talks to object storage over HTTPS and does not use SSH, so these are low reachability here. #9940 also bumps x/crypto in the bundled restic.
• golang.org/x/net 0.53.0 → 0.55.0 resolves six advisories (GO-2026-5025, GO-2026-5026, GO-2026-5027, GO-2026-5028, GO-2026-5029, GO-2026-5030), including GO-2026-5028 (CVE-2026-25680, HTML parse DoS). Most are in x/net/html. One, GO-2026-5026 / CVE-2026-39821, is shared with stdlib and remains open there.
• golang.org/x/sys 0.43.0 → 0.46.0 resolves GO-2026-5024 (Windows-only, not applicable).
• grpc (1.80.0 → 1.81.1), x/text, and x/mod carry the same open advisories before and after. The AWS SDK, k8s.io, hashicorp, and logrus bumps have no OSV advisories on either side.
• The base image moves from paketobuildpacks/run-jammy-tiny 0.2.129 to 0.2.139. Paketo does not publish an advisory feed for that image, so I couldn't list the specific OS-package CVEs it fixes.

Velero advisories open in both versions

• GHSA-vrfp-2x59-hcfm (medium): cross-BSL credential/data leakage. It affects all versions before v1.18.3. kubernetes/velero/values.yaml defines a single BSL (default), so exposure is limited.
• GHSA-8gv3-c356-fw76 (medium): the backup sync controller re-executes exec hooks taken from the object store. It affects all versions before v1.18.3.
• Both advisories are present before and after this PR, so they do not affect the verdict.
• GHSA-j2g6-362q-6qc6 (tar path traversal) was already fixed in v1.18.1.

Net effect: this PR only lowers security risk.

Key Fixes

Mislabeled snapshot-info ConfigMaps on backup deletion (Kopia snapshot leak)

• #9842 changes DataUploadDeleteAction. When it finds a DataUpload in a backup tarball that belongs to a different backup, it now logs a warning and skips creating the snapshot-info ConfigMap. Before, it created that ConfigMap labeled with the wrong backup name, and when the real owning backup was later garbage-collected, its Kopia snapshot was leaked.
• Upstream says the trigger is a schedule that captures the velero namespace's own DataUpload CRs.
• Deployment relevance: values.yaml sets defaultSnapshotMoveData: true, so this deletion action runs on every backup expiry. The leak's trigger condition, however, does not occur with this schedule's label selector:
  • Velero v1.18.2 source creates DataUploads with only the labels velero.io/backup-name, velero.io/backup-uid, velero.io/pvc-uid, and velero.io/async-operation-id. It never adds velero.io/backup.
  • The item collector passes the backup's label selector to every LIST call. schedule-daily.yaml selects velero.io/backup: 'true', so other backups' DataUploads are never listed, even though includedNamespaces: ['*'] covers the velero namespace.
  • A backup's own DataUpload enters its tarball through the PVC action's itemToUpdate. That DataUpload is not foreign, so the mislabeling path does not run for it.
  • CI cannot inspect the live cluster, so there's no direct check for existing mislabeled *-info ConfigMaps. Under this schedule's configuration, though, the trigger cannot occur. For this deployment the fix is defensive only.

Volume group snapshot cleanup is skipped when unused

• #9900 skips VGS cleanup for backups that did not use VolumeGroupSnapshots. values.yaml and schedule-daily.yaml contain no VGS configuration, so this only removes unneeded work here.

Newer Versions

• Velero v1.18.3 (2026-09-21) and v1.18.4 (2026-09-28) exist. However, velero-12.2.0 is still the latest chart, so no chart ships them yet.
• v1.18.3 fixes the two pre-existing Velero advisories covered in the Security section.
• v1.18.3 also fixes PodVolumeBackup metadata loss on fs-backup timeout (#9999). This fix is not relevant here because the deployment sets defaultVolumesToFsBackup: false and uses CSI with data movement.
• v1.18.4 fixes a backup queue that could get permanently stuck (#10539). The release notes don't say this regression was introduced in v1.18.2.
• None of these newer releases fix a regression that v1.18.2 introduced.

Hazards & Risks

None identified.

• The chart diff contains only version metadata and the README; templates, values, and CRDs are unchanged (compare).
• v1.18.2 is a same-minor patch release. The 1.18 upgrade guide covers only upgrades from v1.17.x. The v1.18.2 release notes list no upgrade steps.
• I checked the AWS SDK v2 bump in Velero core (#9919) and found no hazard. Velero core uses the SDK only to load Kopia repository credentials (here a static [default] profile from externalsecret.yaml) and to look up the bucket region. The region lookup is skipped because values.yaml sets both s3Url and region. BSL object-store calls go through the separately pinned velero-plugin-for-aws v1.14.2, which this PR does not change.

Sources

• Velero v1.18.2 release
• Velero v1.18.1...v1.18.2 compare
• helm-charts velero-12.1.0...velero-12.2.0 compare
• helm-charts PR #747 (bump to 1.18.2)
• velero#9870 wildcard namespace perf regression fix
• velero#9842 DataUploadDeleteAction fix
• velero#9919 dependency CVE bumps
• Go release history
• Velero security advisories
• Velero v1.18.3 release
• Velero v1.18.4 release
• OSV vulnerability database
• Velero issue #9869

---

🟢 Verdict: Safe

A chart bump that only moves Velero to the v1.18.2 patch release. It fixes a backup-listing performance regression that hits this deployment's includedNamespaces: ['*'] schedule and resolves several Go stdlib and x/crypto/x/net advisories without introducing any, with no template, CRD, or config changes. Normal ArgoCD rollout; no extra steps.