Repository: kubernetes-sigs/security-profiles-operator
Pull request #1707 (2023-05-25 23:59:35)

build(deps): bump github/codeql-action from 2.3.4 to 2.3.5
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.3.4 to 2.3.5.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>2.3.5 - 25 May 2023</h2>
<ul>
<li>Allow invalid URIs to be used as values to <code>artifactLocation.uri</code> properties. This reverses a change from <a href="https://redirect.github.com/github/codeql-action/pull/1668">#1668</a> that inadvertently led to stricter validation of some URI values. <a href="https://redirect.github.com/github/codeql-action/pull/1705">#1705</a></li>
<li>Gracefully handle invalid URIs when fingerprinting. <a href="https://redirect.github.com/github/codeql-action/pull/1694">#1694</a></li>
</ul>
<h2>2.3.4 - 24 May 2023</h2>
<ul>
<li>Updated the SARIF 2.1.0 JSON schema file to the latest from <a href="https://github.com/oasis-tcs/sarif-spec/blob/123e95847b13fbdd4cbe2120fa5e33355d4a042b/Schemata/sarif-schema-2.1.0.json">oasis-tcs/sarif-spec</a>. <a href="https://redirect.github.com/github/codeql-action/pull/1668">#1668</a></li>
<li>We are rolling out a feature in May 2023 that will disable Python dependency installation for new users of the CodeQL Action. This improves the speed of analysis while having only a very minor impact on results. <a href="https://redirect.github.com/github/codeql-action/pull/1676">#1676</a></li>
<li>We are improving the way that <a href="https://github.com/github/codeql-action/releases">CodeQL bundles</a> are tagged to make it possible to easily identify bundles by their CodeQL semantic version. <a href="https://redirect.github.com/github/codeql-action/pull/1682">#1682</a>
<ul>
<li>As of CodeQL CLI 2.13.4, CodeQL bundles will be tagged using semantic versions, for example <code>codeql-bundle-v2.13.4</code>, instead of timestamps, like <code>codeql-bundle-20230615</code>.</li>
<li>This change does not affect the majority of workflows, and we will not be changing tags for existing bundle releases.</li>
<li>Some workflows with custom logic that depends on the specific format of the CodeQL bundle tag may need to be updated. For example, if your workflow matches CodeQL bundle tag names against a <code>codeql-bundle-yyyymmdd</code> pattern, you should update it to also recognize <code>codeql-bundle-vx.y.z</code> tags.</li>
</ul>
</li>
<li>Remove the requirement for <code>on.push</code> and <code>on.pull_request</code> to trigger on the same branches. <a href="https://redirect.github.com/github/codeql-action/pull/1675">#1675</a></li>
</ul>
<h2>2.3.3 - 04 May 2023</h2>
<ul>
<li>Update default CodeQL bundle version to 2.13.1. <a href="https://redirect.github.com/github/codeql-action/pull/1664">#1664</a></li>
<li>You can now configure CodeQL within your code scanning workflow by passing a <code>config</code> input to the <code>init</code> Action. See <a href="https://aka.ms/code-scanning-docs/config-file">Using a custom configuration file</a> for more information about configuring code scanning. <a href="https://redirect.github.com/github/codeql-action/pull/1590">#1590</a></li>
</ul>
<h2>2.3.2 - 27 Apr 2023</h2>
<p>No user facing changes.</p>
<h2>2.3.1 - 26 Apr 2023</h2>
<p>No user facing changes.</p>
<h2>2.3.0 - 21 Apr 2023</h2>
<ul>
<li>Update default CodeQL bundle version to 2.13.0. <a href="https://redirect.github.com/github/codeql-action/pull/1649">#1649</a></li>
<li>Bump the minimum CodeQL bundle version to 2.8.5. <a href="https://redirect.github.com/github/codeql-action/pull/1618">#1618</a></li>
</ul>
<h2>2.2.12 - 13 Apr 2023</h2>
<ul>
<li>Include the value of the <code>GITHUB_RUN_ATTEMPT</code> environment variable in the telemetry sent to GitHub. <a href="https://redirect.github.com/github/codeql-action/pull/1640">#1640</a></li>
<li>Improve the ease of debugging failed runs configured using <a href="https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning-for-a-repository#configuring-code-scanning-automatically">default setup</a>. The CodeQL Action will now upload diagnostic information to Code Scanning from failed runs configured using default setup. You can view this diagnostic information on the <a href="https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-the-tool-status-page">tool status page</a>. <a href="https://redirect.github.com/github/codeql-action/pull/1619">#1619</a></li>
</ul>
<h2>2.2.11 - 06 Apr 2023</h2>
<p>No user facing changes.</p>
<h2>2.2.10 - 05 Apr 2023</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/github/codeql-action/commit/0225834cc549ee0ca93cb085b92954821a145866"><code>0225834</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/1706">#1706</a> from github/update-v2.3.5-d3314cca2</li>
<li><a href="https://github.com/github/codeql-action/commit/15f9b00614c685f0d7e96e100f4fa9135ef43302"><code>15f9b00</code></a> Apply suggestions from code review</li>
<li><a href="https://github.com/github/codeql-action/commit/ff82fd0736b594c5f435a740e5965a38f65433df"><code>ff82fd0</code></a> Update changelog for v2.3.5</li>
<li><a href="https://github.com/github/codeql-action/commit/d3314cca22966b5032a55d14e1943ad90b6c8acd"><code>d3314cc</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/1705">#1705</a> from github/aeisenberg/location-uri-schema-fix</li>
<li><a href="https://github.com/github/codeql-action/commit/42add7b4d79b67be9a607fa873545ef12d4e3f57"><code>42add7b</code></a> Update changelog</li>
<li><a href="https://github.com/github/codeql-action/commit/9c5706e1a2f4bbb33da84950f8133ee20ff508cc"><code>9c5706e</code></a> Avoid throwing validation error on invalid URIs</li>
<li><a href="https://github.com/github/codeql-action/commit/39129956676df0081154605ecd228b0137c6f7a9"><code>3912995</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/1704">#1704</a> from github/henrymercer/contributions-updates</li>
<li><a href="https://github.com/github/codeql-action/commit/8d7f61b8f2db68aa81e4d7447f523f1d2036d775"><code>8d7f61b</code></a> Update npm version</li>
<li><a href="https://github.com/github/codeql-action/commit/50bc388cfc2e885253ae63be931fb34f978b0c86"><code>50bc388</code></a> Update Node version</li>
<li><a href="https://github.com/github/codeql-action/commit/4a409ace8f67c998c59f3aa2bc9640b6e39c9976"><code>4a409ac</code></a> Link to CONTRIBUTING doc from README</li>
<li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/f0e3dfb30302f8a0881bb509b044e0de4f6ef589...0225834cc549ee0ca93cb085b92954821a145866">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=2.3.4&new-version=2.3.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

k8s-ci-robot: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our [release note process](https://git.k8s.io/community/contributors/guide/release-notes.md) to remove it.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
k8s-ci-robot: Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a [kubernetes-sigs](https://github.com/orgs/kubernetes-sigs/people) member to verify that this patch is reasonable to test. If it is, they should reply with `/ok-to-test` on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should [join the org](https://git.k8s.io/community/community-membership.md#member) to skip this step.

Once the patch is verified, the new status will be reflected by the `ok-to-test` label.

I understand the commands that are listed [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>

k8s-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1707#" title="Author self-approved">dependabot[bot]</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign pjbgf for approval. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["pjbgf"]} -->
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1707#" title="Author self-approved">dependabot[bot]</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1707#pullrequestreview-1445272084" title="Approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
JAORMX: @dependabot rebase
k8s-ci-robot: New changes are detected. LGTM label has been removed.
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1707#" title="Author self-approved">dependabot[bot]</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1707#pullrequestreview-1445488026" title="Approved">JAORMX</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1707#pullrequestreview-1445272084" title="Approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [JAORMX,saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5b6f0e3ab..9ab97b143 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -8,7 +8,7 @@ on:
   pull_request:
 env:
   GO_VERSION: '1.20'
-  NIX_VERSION: '2.13.3'
+  NIX_VERSION: '2.15.1'
   BOM_VERSION: v0.5.1
 
 permissions: {}
diff --git a/Dockerfile.build-image b/Dockerfile.build-image
index 3d959362e..c6d5b7b55 100644
--- a/Dockerfile.build-image
+++ b/Dockerfile.build-image
@@ -20,7 +20,7 @@ RUN apt-get update && apt-get install -y wget xz-utils libapparmor-dev
 
 ENV USER=root
 
-ARG NIX_VERSION=2.13.3
+ARG NIX_VERSION=2.15.1
 RUN wget https://nixos.org/releases/nix/nix-${NIX_VERSION}/nix-${NIX_VERSION}-x86_64-linux.tar.xz && \
     tar xf nix-${NIX_VERSION}-x86_64-linux.tar.xz && \
     groupadd -r -g 30000 nixbld && \
diff --git a/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml b/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml
index 52ca3208b..8ae089aba 100644
--- a/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml
+++ b/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml
@@ -853,7 +853,7 @@ spec:
                 - manager
                 env:
                 - name: RELATED_IMAGE_RBAC_PROXY
-                  value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.0
+                  value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
                 - name: RELATED_IMAGE_SELINUXD
                   value: quay.io/security-profiles-operator/selinuxd
                 - name: RELATED_IMAGE_SELINUXD_EL8
@@ -977,7 +977,7 @@ spec:
     name: Kubernetes SIGs
     url: https://github.com/kubernetes-sigs
   relatedImages:
-  - image: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.0
+  - image: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
     name: rbac-proxy
   - image: quay.io/security-profiles-operator/selinuxd
     name: selinuxd
diff --git a/cloudbuild.yaml b/cloudbuild.yaml
index 6428b0302..f218a65ba 100644
--- a/cloudbuild.yaml
+++ b/cloudbuild.yaml
@@ -5,7 +5,7 @@ options:
   substitution_option: ALLOW_LOOSE
   machineType: E2_HIGHCPU_8
 steps:
-  - name: gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:v20220617-174ad91c3a
+  - name: gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:v20230522-312425ae46
     entrypoint: bash
     env:
       - TAG=$_GIT_TAG
diff --git a/dependencies.yaml b/dependencies.yaml
index 7668904e8..699241c0a 100644
--- a/dependencies.yaml
+++ b/dependencies.yaml
@@ -50,7 +50,7 @@ dependencies:
       match: OLM_VERSION
 
   - name: cert-manager
-    version: 1.12.0
+    version: 1.12.1
     refPaths:
     - path: test/e2e_test.go
       match: cert-manager/cert-manager
@@ -68,7 +68,7 @@ dependencies:
       match: kindVersion
 
   - name: kind-image
-    version: 1.27.1
+    version: 1.27.2
     refPaths:
     - path: test/suite_test.go
       match: kindImage
@@ -128,7 +128,7 @@ dependencies:
       match: registry.access.redhat.com/ubi8/go-toolset
 
   - name: nix
-    version: 2.13.3
+    version: 2.15.1
     refPaths:
     - path: Dockerfile.build-image
       match: NIX_VERSION
@@ -136,7 +136,7 @@ dependencies:
       match: NIX_VERSION
 
   - name: kube-rbac-proxy
-    version: 0.14.0
+    version: 0.14.1
     refPaths:
     - path: internal/pkg/manager/spod/bindata/spod.go
       match: gcr.io/kubebuilder/kube-rbac-proxy
@@ -158,7 +158,7 @@ dependencies:
       match: gcr.io/kubebuilder/kube-rbac-proxy
 
   - name: gcb-docker-gcloud
-    version: v20220617-174ad91c3a
+    version: v20230522-312425ae46
     refPaths:
     - path: cloudbuild.yaml
       match: gcr.io/k8s-staging-test-infra/gcb-docker-gcloud
@@ -200,7 +200,7 @@ dependencies:
       match: baseProfileName
 
   - name: audit2rbac
-    version: v0.9.0
+    version: v0.10.0
     refPaths:
     - path: hack/ci/install-audit2rbac.sh
       match: VERSION
diff --git a/deploy/helm/templates/deployment.yaml b/deploy/helm/templates/deployment.yaml
index 925df0f03..77d3d04dc 100644
--- a/deploy/helm/templates/deployment.yaml
+++ b/deploy/helm/templates/deployment.yaml
@@ -25,7 +25,7 @@ spec:
         - manager
         env:
         - name: RELATED_IMAGE_RBAC_PROXY
-          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.0
+          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
         - name: RELATED_IMAGE_SELINUXD
           value: quay.io/security-profiles-operator/selinuxd
         - name: RELATED_IMAGE_SELINUXD_EL8
diff --git a/deploy/kustomize-deployment/manager_deployment.yaml b/deploy/kustomize-deployment/manager_deployment.yaml
index 62a7d3387..0945c3719 100644
--- a/deploy/kustomize-deployment/manager_deployment.yaml
+++ b/deploy/kustomize-deployment/manager_deployment.yaml
@@ -36,7 +36,7 @@ spec:
               cpu: 500m
           env:
             - name: RELATED_IMAGE_RBAC_PROXY
-              value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.0
+              value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
             - name: RELATED_IMAGE_SELINUXD
               value: quay.io/security-profiles-operator/selinuxd
             - name: RELATED_IMAGE_SELINUXD_EL8
diff --git a/deploy/namespace-operator.yaml b/deploy/namespace-operator.yaml
index 207d4510b..e901c6ac7 100644
--- a/deploy/namespace-operator.yaml
+++ b/deploy/namespace-operator.yaml
@@ -3155,7 +3155,7 @@ spec:
         - name: RESTRICT_TO_NAMESPACE
           value: NS_REPLACE
         - name: RELATED_IMAGE_RBAC_PROXY
-          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.0
+          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
         - name: RELATED_IMAGE_SELINUXD
           value: quay.io/security-profiles-operator/selinuxd
         - name: RELATED_IMAGE_SELINUXD_EL8
diff --git a/deploy/openshift-dev.yaml b/deploy/openshift-dev.yaml
index 3d2485cca..ac9297ef6 100644
--- a/deploy/openshift-dev.yaml
+++ b/deploy/openshift-dev.yaml
@@ -3146,7 +3146,7 @@ spec:
         - manager
         env:
         - name: RELATED_IMAGE_RBAC_PROXY
-          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.0
+          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
         - name: RELATED_IMAGE_SELINUXD
           value: quay.io/security-profiles-operator/selinuxd
         - name: RELATED_IMAGE_SELINUXD_EL8
diff --git a/deploy/openshift-downstream.yaml b/deploy/openshift-downstream.yaml
index ede0050ce..d5bbec491 100644
--- a/deploy/openshift-downstream.yaml
+++ b/deploy/openshift-downstream.yaml
@@ -3166,7 +3166,7 @@ spec:
         - manager
         env:
         - name: RELATED_IMAGE_RBAC_PROXY
-          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.0
+          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
         - name: RELATED_IMAGE_SELINUXD
           value: quay.io/security-profiles-operator/selinuxd
         - name: RELATED_IMAGE_SELINUXD_EL8
diff --git a/deploy/operator.yaml b/deploy/operator.yaml
index 2f59563a2..dd26788ae 100644
--- a/deploy/operator.yaml
+++ b/deploy/operator.yaml
@@ -3153,7 +3153,7 @@ spec:
         - manager
         env:
         - name: RELATED_IMAGE_RBAC_PROXY
-          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.0
+          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
         - name: RELATED_IMAGE_SELINUXD
           value: quay.io/security-profiles-operator/selinuxd
         - name: RELATED_IMAGE_SELINUXD_EL8
diff --git a/deploy/webhook-operator.yaml b/deploy/webhook-operator.yaml
index 8a860a82c..8a7808ec1 100644
--- a/deploy/webhook-operator.yaml
+++ b/deploy/webhook-operator.yaml
@@ -3153,7 +3153,7 @@ spec:
         - --webhook=false
         env:
         - name: RELATED_IMAGE_RBAC_PROXY
-          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.0
+          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
         - name: RELATED_IMAGE_SELINUXD
           value: quay.io/security-profiles-operator/selinuxd
         - name: RELATED_IMAGE_SELINUXD_EL8
diff --git a/hack/ci/baseprofiles.sh b/hack/ci/baseprofiles.sh
index 004278de1..0a82e3027 100755
--- a/hack/ci/baseprofiles.sh
+++ b/hack/ci/baseprofiles.sh
@@ -69,7 +69,7 @@ wait_for() {
 }
 
 install_operator() {
-    kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.0/cert-manager.yaml
+    kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.1/cert-manager.yaml
     k_wait -n cert-manager pod -l app.kubernetes.io/instance=cert-manager
 
     git apply hack/deploy-localhost.patch
diff --git a/hack/ci/install-audit2rbac.sh b/hack/ci/install-audit2rbac.sh
index ad03d3271..81e5e29f3 100755
--- a/hack/ci/install-audit2rbac.sh
+++ b/hack/ci/install-audit2rbac.sh
@@ -15,7 +15,7 @@
 
 set -euo pipefail
 
-VERSION=v0.9.0
+VERSION=v0.10.0
 curl -sSfL --retry 5 --retry-delay 3 \
     "https://github.com/liggitt/audit2rbac/releases/download/$VERSION/audit2rbac-linux-amd64.tar.gz" -o- |
     tar xfz -
diff --git a/installation-usage.md b/installation-usage.md
index 94dfba67a..6440043ef 100644
--- a/installation-usage.md
+++ b/installation-usage.md
@@ -101,7 +101,7 @@ cert-manager via `kubectl`, if you're **not** running on
 [OpenShift](https://www.redhat.com/en/technologies/cloud-computing/openshift):
 
 ```sh
-$ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.0/cert-manager.yaml
+$ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.1/cert-manager.yaml
 $ kubectl --namespace cert-manager wait --for condition=ready pod -l app.kubernetes.io/instance=cert-manager
 ```
 
diff --git a/internal/pkg/manager/spod/bindata/spod.go b/internal/pkg/manager/spod/bindata/spod.go
index 81bc00933..917e251bd 100644
--- a/internal/pkg/manager/spod/bindata/spod.go
+++ b/internal/pkg/manager/spod/bindata/spod.go
@@ -55,7 +55,7 @@ const (
 	SelinuxdPrivateDir                         = "/var/run/selinuxd"
 	SelinuxdSocketPath                         = SelinuxdPrivateDir + "/selinuxd.sock"
 	SelinuxdDBPath                             = SelinuxdPrivateDir + "/selinuxd.db"
-	MetricsImage                               = "gcr.io/kubebuilder/kube-rbac-proxy:v0.14.0"
+	MetricsImage                               = "gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1"
 	sysKernelDebugPath                         = "/sys/kernel/debug"
 	InitContainerIDNonRootenabler              = 0
 	InitContainerIDSelinuxSharedPoliciesCopier = 1
diff --git a/nix/nixpkgs.json b/nix/nixpkgs.json
index 6d2c5680a..3300b08f2 100644
--- a/nix/nixpkgs.json
+++ b/nix/nixpkgs.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/nixos/nixpkgs",
-  "rev": "101bc33b43fc36ca5fc831f09b74270a8f0ad63a",
-  "date": "2023-04-06T08:50:54-03:00",
-  "path": "/nix/store/4jd2p4zm620xr42r8wwbxld99lazn534-nixpkgs",
-  "sha256": "1g3s4qkw6jlfq136v2ihdj5z7alnz9hnj12arhqy697hpy9az49n",
+  "rev": "7b5ce85d8fc3c3bfe0b5c472be23b742cb1ad2aa",
+  "date": "2023-05-26T00:51:46-06:00",
+  "path": "/nix/store/xvnw4nzq5r4qghfjwnqj7nvv81pd9qfm-nixpkgs",
+  "sha256": "1ssvnf0573jpvji1ihrnv2hdl4qsdbm3hx699izrsvi0sb6m2dsk",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,


Test patch:
diff --git a/.github/workflows/olm_tests.yaml b/.github/workflows/olm_tests.yaml
index 97e2d4fdb..129300e4e 100644
--- a/.github/workflows/olm_tests.yaml
+++ b/.github/workflows/olm_tests.yaml
@@ -6,7 +6,7 @@ on:
   pull_request:
 env:
   GO_VERSION: '1.20'
-  KIND_IMG_TAG: v1.27.1
+  KIND_IMG_TAG: v1.27.2
 
 permissions: {}
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 911e0a92b..b76449842 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -19,11 +19,11 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
-      - uses: github/codeql-action/init@f0e3dfb30302f8a0881bb509b044e0de4f6ef589
+      - uses: github/codeql-action/init@0225834cc549ee0ca93cb085b92954821a145866
         with:
           languages: go
-      - uses: github/codeql-action/autobuild@f0e3dfb30302f8a0881bb509b044e0de4f6ef589
-      - uses: github/codeql-action/analyze@f0e3dfb30302f8a0881bb509b044e0de4f6ef589
+      - uses: github/codeql-action/autobuild@0225834cc549ee0ca93cb085b92954821a145866
+      - uses: github/codeql-action/analyze@0225834cc549ee0ca93cb085b92954821a145866
 
   coverage:
     runs-on: ubuntu-22.04
diff --git a/hack/ci/e2e-olm.sh b/hack/ci/e2e-olm.sh
index 722958fbd..bffa5bddf 100755
--- a/hack/ci/e2e-olm.sh
+++ b/hack/ci/e2e-olm.sh
@@ -69,7 +69,7 @@ function deploy_deps() {
 
     # cert-manager first. This should be done using dependencies in the
     # future
-    kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.0/cert-manager.yaml
+    kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.1/cert-manager.yaml
     kubectl -ncert-manager wait --for condition=ready pod -l app.kubernetes.io/instance=cert-manager
 
     # All installation methods run off the same catalog
diff --git a/test/e2e_test.go b/test/e2e_test.go
index 8f133e2b8..8d2c26c09 100644
--- a/test/e2e_test.go
+++ b/test/e2e_test.go
@@ -32,7 +32,7 @@ import (
 )
 
 const (
-	certmanager       = "https://github.com/cert-manager/cert-manager/releases/download/v1.12.0/cert-manager.yaml"
+	certmanager       = "https://github.com/cert-manager/cert-manager/releases/download/v1.12.1/cert-manager.yaml"
 	namespaceManifest = "deploy/namespace-operator.yaml"
 	testNamespace     = "test-ns"
 	defaultNamespace  = "default"
diff --git a/test/suite_test.go b/test/suite_test.go
index f4c3df64a..48ea38e57 100644
--- a/test/suite_test.go
+++ b/test/suite_test.go
@@ -40,7 +40,7 @@ import (
 
 const (
 	kindVersion      = "v0.19.0"
-	kindImage        = "kindest/node:v1.27.1@sha256:b7d12ed662b873bd8510879c1846e87c7e676a79fefc93e17b2a52989d3ff42b"
+	kindImage        = "kindest/node:v1.27.2@sha256:ee77a85d1146ba4f1df9f836c828845a7dbe1f1a094ee670879d7c14f41e31f2"
 	kindDarwinSHA512 = "c24b71f9c3599c38d58110bb2fe938c23b713a139a4f7e3429118b04d2b3bfb6784fba292987cad6d5818527a56affd7264a8e33cc2f958f13ae2ca03764b54c" //nolint:lll // full length SHA
 	kindLinuxSHA512  = "c4242fe35f00ee0dc99eafb512689db26a29cbad0375f343244db3a2805f064bbae607d6db59fec84ae143706231e82d416d82dd26d2848610cb447ff39ded78" //nolint:lll // full length SHA
 )