renovate · Sep 29, 2026
diff --git a/Dockerfile b/Dockerfile
@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.27@sha256:f44f6e88636cfb311f9ebace870ded69d943f227bb3cb27d32ffd84ea18c43ea AS builder
+FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.27@sha256:3680233e3204827fbdc66088528ae6d4b3d034f51d03a99d454f6de034888244 AS builder
 
 ARG BUILDPLATFORM
 ARG TARGETPLATFORM

diff --git a/Makefile b/Makefile
@@ -18,7 +18,7 @@ RELEASE_MSG ?= "koperator release"
 REL_TAG = $(shell ./scripts/increment_version.sh -${RELEASE_TYPE} ${TAG})
 
 # Version constants
-GOLANGCI_VERSION = 2.13.2 # renovate: datasource=github-releases depName=golangci/golangci-lint
+GOLANGCI_VERSION = 2.14.0 # renovate: datasource=github-releases depName=golangci/golangci-lint
 LICENSEI_VERSION = 0.9.0 # renovate: datasource=github-releases depName=goph/licensei
 CONTROLLER_GEN_VERSION = v0.22.0 # kept in sync with kubernetes-sigs/controller-tools by `make update-go-deps`
 ENVTEST_K8S_VERSION = 1.37.0 # renovate: datasource=github-releases depName=kubernetes-sigs/controller-tools extractVersion=^envtest-v(?<version>.+)$

diff --git a/charts/kafka-operator/values.yaml b/charts/kafka-operator/values.yaml
@@ -103,7 +103,7 @@ prometheusMetrics:
       # -- Auth proxy container image repository
       repository: quay.io/brancz/kube-rbac-proxy
       # -- Auth proxy container image tag
-      tag: v0.22.1
+      tag: v0.23.0
       # -- Auth proxy container image pull policy
       pullPolicy: IfNotPresent
     serviceAccount:

diff --git a/config/overlays/auth-proxy-enabled/manager_auth_proxy_patch.yaml b/config/overlays/auth-proxy-enabled/manager_auth_proxy_patch.yaml
@@ -10,7 +10,7 @@ spec:
     spec:
       containers:
       - name: kube-rbac-proxy
-        image: quay.io/brancz/kube-rbac-proxy:v0.22.1 # renovate: datasource=docker depName=quay.io/brancz/kube-rbac-proxy
+        image: quay.io/brancz/kube-rbac-proxy:v0.23.0 # renovate: datasource=docker depName=quay.io/brancz/kube-rbac-proxy
         args:
         - "--secure-listen-address=0.0.0.0:8443"
         - "--upstream=http://127.0.0.1:8080/"

diff --git a/config/overlays/certmanager-with-auth-proxy/auth-proxy/manager_auth_proxy_patch.yaml b/config/overlays/certmanager-with-auth-proxy/auth-proxy/manager_auth_proxy_patch.yaml
@@ -10,7 +10,7 @@ spec:
     spec:
       containers:
       - name: kube-rbac-proxy
-        image: quay.io/brancz/kube-rbac-proxy:v0.22.1 # renovate: datasource=docker depName=quay.io/brancz/kube-rbac-proxy
+        image: quay.io/brancz/kube-rbac-proxy:v0.23.0 # renovate: datasource=docker depName=quay.io/brancz/kube-rbac-proxy
         args:
         - "--secure-listen-address=0.0.0.0:8443"
         - "--upstream=http://127.0.0.1:8080/"

diff --git a/docker/jmx_exporter/Dockerfile b/docker/jmx_exporter/Dockerfile
@@ -1,6 +1,6 @@
 ARG JMX_EXPORTER_VERSION=1.6.0 # renovate: datasource=github-releases depName=prometheus/jmx_exporter
 
-FROM maven:3-amazoncorretto-21@sha256:e98293b3e59b4d77d8a5986883128c0242eb5cfc8dad13c8b1f0460653eaae96 AS build
+FROM maven:3-amazoncorretto-21@sha256:efdf660ec74911594e2a7f642e177ffba21b741c8e848223bf41a6d0fc367692 AS build
 ARG JMX_EXPORTER_VERSION
 
 # Install wget to download the release tarball
@@ -18,7 +18,7 @@ RUN mvn -B -Dmaven.javadoc.skip=true -Dskip.javadoc=true \
     -Dmaven.compiler.source=21 -Dmaven.compiler.target=21 -Dmaven.compiler.release=21 \
     clean package -pl jmx_prometheus_javaagent -am
 
-FROM alpine:latest@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
+FROM alpine:latest@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
 ARG JMX_EXPORTER_VERSION
 COPY --from=build /src/jmx_prometheus_javaagent/target/jmx_prometheus_javaagent-${JMX_EXPORTER_VERSION}.jar /opt/jmx_exporter/
 RUN ln -s /opt/jmx_exporter/jmx_prometheus_javaagent-${JMX_EXPORTER_VERSION}.jar /jmx_prometheus_javaagent.jar

diff --git a/docker/kafka/Dockerfile b/docker/kafka/Dockerfile
@@ -6,7 +6,7 @@ ARG scala_version=2.13
 ARG KAFKA_VERSION=3.9.2 # renovate: datasource=github-tags depName=apache/kafka
 ARG java_version=21
 
-FROM alpine:latest@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS kafka_dist
+FROM alpine:latest@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS kafka_dist
 
 ARG scala_version
 ARG KAFKA_VERSION
@@ -34,7 +34,7 @@ RUN apk add --no-cache gnupg wget && \
 
 
 # backported from https://github.com/docker-library/openjdk/blob/master/18/jdk/slim-bullseye/Dockerfile
-FROM debian:trixie-slim@sha256:d7e12182ce18b85b93007c1dedf31f2d29e01ccf3182cc4017c709b6259bc132
+FROM debian:trixie-slim@sha256:a99cfc517144bc59b1978475ec53b46ecabec7e43635402ee5b77cc54cd1b20a
 
 ARG scala_version
 ARG KAFKA_VERSION

diff --git a/docs/benchmarks/loadgens/Dockerfile b/docs/benchmarks/loadgens/Dockerfile
@@ -15,7 +15,7 @@ WORKDIR /build/sangrenel
 
 RUN go mod download && go build -o /sangrenel
 
-FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
+FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
 
 RUN apk add --update --no-cache ca-certificates tzdata curl bash
 

diff --git a/docs/examples/springboot-kafka-avro/Dockerfile b/docs/examples/springboot-kafka-avro/Dockerfile
@@ -1,4 +1,4 @@
-FROM maven:3.9-eclipse-temurin-21-alpine@sha256:529278c758cac25258da21a71de9eecc553e2fc66304676bc8004260e8fc15bf as build
+FROM maven:3.9-eclipse-temurin-21-alpine@sha256:308cba8b638ed7e4658cea3f8399066219466211c805f6d5728c3c9c7614661b as build
 
 # Set working directory
 WORKDIR /usr/src/myapp
@@ -12,7 +12,7 @@ COPY src ./src
 RUN mvn clean package -DskipTests
 
 # The final image should have minimal layers
-FROM eclipse-temurin:26-jre-alpine@sha256:2c984601c59ac93f97947ce66d03df25c2e16bed97a28289fbc0ab157087f1b5
+FROM eclipse-temurin:26-jre-alpine@sha256:9eedff2367194d11eddd6f14101b444945a708c986270cd5716b934596ba3a31
 RUN apk add --no-cache curl
 COPY --from=build /usr/src/myapp/target/kafka-avro-0.0.1-SNAPSHOT.jar app.jar
 ENTRYPOINT ["java", "-jar", "app.jar"]
diff --git a/docs/examples/springboot-kafka-avro/pom.xml b/docs/examples/springboot-kafka-avro/pom.xml
@@ -46,7 +46,7 @@
         <dependency>
             <groupId>io.confluent</groupId>
             <artifactId>kafka-schema-registry-client</artifactId>   <!-- <1> -->
-            <version>8.3.1</version>
+            <version>8.3.2</version>
         </dependency>
         <dependency>
             <groupId>org.apache.avro</groupId>
@@ -56,7 +56,7 @@
         <dependency>
             <groupId>io.confluent</groupId>
             <artifactId>kafka-avro-serializer</artifactId>  <!-- <3> -->
-            <version>8.3.1</version>
+            <version>8.3.2</version>
         </dependency>
     </dependencies>
 

diff --git a/hack/kafka-test-pod/Dockerfile b/hack/kafka-test-pod/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.27@sha256:f44f6e88636cfb311f9ebace870ded69d943f227bb3cb27d32ffd84ea18c43ea as builder
+FROM golang:1.27@sha256:3680233e3204827fbdc66088528ae6d4b3d034f51d03a99d454f6de034888244 as builder
 
 WORKDIR /workspace
 

diff --git a/tests/e2e/templates/zookeeper_cluster.yaml.tmpl b/tests/e2e/templates/zookeeper_cluster.yaml.tmpl
@@ -7,6 +7,6 @@ spec:
     replicas: {{ or .Replicas 1 }}
     image:
         repository: ghcr.io/adobe/zookeeper-operator/zookeeper
-        tag: 3.8.4-0.2.15-adobe-20260818 # renovate: datasource=docker depName=ghcr.io/adobe/zookeeper-operator/zookeeper
+        tag: 3.9.6-0.2.15-adobe-20260924 # renovate: datasource=docker depName=ghcr.io/adobe/zookeeper-operator/zookeeper
     persistence:
         reclaimPolicy: Delete
diff --git a/tests/e2e/versions.go b/tests/e2e/versions.go
@@ -25,10 +25,10 @@ const (
 	ContourVersion = "0.8.0" // renovate: datasource=helm depName=contour registryUrl=https://projectcontour.github.io/helm-charts
 
 	// PrometheusOperatorVersion is the version of kube-prometheus-stack Helm chart
-	PrometheusOperatorVersion = "91.4.1" // renovate: datasource=helm depName=kube-prometheus-stack registryUrl=https://prometheus-community.github.io/helm-charts
+	PrometheusOperatorVersion = "91.8.1" // renovate: datasource=helm depName=kube-prometheus-stack registryUrl=https://prometheus-community.github.io/helm-charts
 
 	// ZookeeperOperatorVersion is the version of zookeeper-operator
-	ZookeeperOperatorVersion = "0.2.15-adobe-20260818" // renovate: datasource=docker depName=ghcr.io/adobe/helm-charts/zookeeper-operator
+	ZookeeperOperatorVersion = "0.2.15-adobe-20260924" // renovate: datasource=docker depName=ghcr.io/adobe/helm-charts/zookeeper-operator
 
 	// KclVersion is the version of the kcl Kafka CLI image used by the internal produce/consume helpers
 	KclVersion = "v0.20.0" // renovate: datasource=docker depName=ghcr.io/twmb/kcl

diff --git a/third_party/github.com/banzaicloud/go-cruise-control/deploy/docker-compose.yml b/third_party/github.com/banzaicloud/go-cruise-control/deploy/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   zookeeper:
-    image: ghcr.io/adobe/zookeeper-operator/zookeeper:3.8.4-0.2.15-adobe-20260818@sha256:ee0fe4635019797be3f55b3efd806dac307b2a95a4041735128c4fbef7494bbb
+    image: ghcr.io/adobe/zookeeper-operator/zookeeper:3.9.6-0.2.15-adobe-20260924@sha256:4904581857a1c1aea7397942b1cca66deeebb818f1817de4805eef9fe2bc4ff0
     restart: unless-stopped
     hostname: zookeeper
     container_name: zookeeper