chore(deps): bump github.com/vmware-tanzu/velero from 1.17.2 to 1.18.0

[dependabot]

Bumps github.com/vmware-tanzu/velero from 1.17.2 to 1.18.0.

Release notes

Sourced from github.com/vmware-tanzu/velero's releases.

v1.18.0

v1.18

Download

https://github.com/vmware-tanzu/velero/releases/tag/v1.18.0

Container Image

velero/velero:v1.18.0

Documentation

https://velero.io/docs/v1.18/

Upgrading

https://velero.io/docs/v1.18/upgrade-to-1.18/

Highlights

Concurrent backup

In v1.18, Velero is capable to process multiple backups concurrently. This is a significant usability improvement, especially for multiple tenants or multiple users case, backups submitted from different users could run their backups simultaneously without interfering with each other.

Check design https://github.com/vmware-tanzu/velero/blob/main/design/Implemented/concurrent-backup-processing.md for more details.

Cache volume for data movers

In v1.18, Velero allows users to configure cache volumes for data mover pods during restore for CSI snapshot data movement and fs-backup. This brings below benefits:

• Solve the problem that data mover pods fail to when pod's ephemeral disk is limited
• Solve the problem that multiple data mover pods fail to run concurrently in one node when the node's ephemeral disk is limited
• Working together with backup repository's cache limit configuration, cache volume with appropriate size helps to improve the restore throughput

Check design https://github.com/vmware-tanzu/velero/blob/main/design/Implemented/backup-repo-cache-volume.md for more details.

Incremental size for data movers

In v1.18, Velero allows users to observe the incremental size of data movers backups for CSI snapshot data movement and fs-backup, so that users could visually see the data reduction due to incremental backup.

Wildcard support for namespaces

In v1.18, Velero allows to use Glob regular expressions for namespace filters during backup and restore, so that users could filter namespaces in a batch manner.

VolumePolicy for PVC phase

In v1.18, Velero VolumePolicy supports actions by PVC phase, which help users to do special operations for PVCs with a specific phase, e.g., skip PVCs in Pending/Lost status from the backup.

Scalability and Resiliency improvements

Prevent Velero server OOM Kill for large backup repositories

In v1.18, some backup repository operations are delay executed out of Velero server, so Velero server won't be OOM Killed.

Performance improvement for VolumePolicy

In v1.18, VolumePolicy is enhanced for large number of pods/PVCs so that the performance is significantly improved.

Events for data mover pod diagnostic

In v1.18, events are recorded into data mover pod diagnostic, which allows user to see more information for troubleshooting when the data mover pod fails.

Runtime and dependencies

Golang runtime: 1.25.7

... (truncated)

Commits

• 6adcf06 Merge pull request #9572 from blackpiglet/xj014661/v1.18/CVE-2026-24051
• ffa6560 Bump go.opentelemetry.io/otel/sdk to 1.40.0 to fix CVE-2026-24051.
• bd8dfe9 Merge branch 'vmware-tanzu:release-1.18' into release-1.18
• 54783fb Merge pull request #9546 from Lyndon-Li/release-1.18
• cb5f562 update base image for 1.18.0
• 0c7b89a Fix VolumePolicy PVC phase condition filter for unbound PVCs
• aa89713 Merge pull request #9537 from kaovilai/1.18-9508
• 5db4c65 Merge branch 'release-1.18' into 1.18-9508
• 87db850 Merge pull request #9539 from Joeavaikath/1.18-9502
• c7631fc Merge branch 'release-1.18' into 1.18-9502
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)