florian/homelab-gitops

Fork 0

chore(deps): update fluxcd minor update #29

Open

renovate-bot wants to merge 3 commits from renovate/fluxcd-minor-update into main

renovate-bot commented

2026-08-02 22:01:04 +00:00

Collaborator

This PR contains the following updates:

Package	Update	Change
fluxcd/flux2	minor	`v2.8.6` → `v2.9.3`
ghcr.io/fluxcd/helm-controller	minor	`v1.5.4` → `v1.6.3`
ghcr.io/fluxcd/kustomize-controller	minor	`v1.8.4` → `v1.9.4`
ghcr.io/fluxcd/notification-controller	minor	`v1.8.4` → `v1.9.2`
ghcr.io/fluxcd/source-controller	minor	`v1.8.3` → `v1.9.3`

Release Notes

fluxcd/flux2 (fluxcd/flux2)

`v2.9.3`

Compare Source

Highlights

Flux v2.9.3 is a patch release. It fixes empty lines vanishing from rendered Helm chart manifests, HelmReleases being marked as tested when their Helm test hooks never ran, and spec.images entries that set only some image fields discarding the remaining fields already declared for the same image in the kustomization.yaml. The latter affects both kustomize-controller and the flux build|diff kustomization commands. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

Fix empty lines vanishing from rendered chart manifests (helm-controller)
Fix HasBeenTested for all corner cases, where a release could be marked as tested although its Helm test hooks never ran (helm-controller)
Fix a spec.images entry setting only some of the image fields discarding the remaining fields already declared for the same image in the kustomization.yaml at spec.path, e.g. overriding only newName produced an untagged image reference (kustomize-controller, flux CLI)

Improvements:

Update fluxcd/pkg dependencies
Include source-watcher in the OCI flux-manifests artifact

Components changelog

kustomize-controller v1.9.4
helm-controller v1.6.3

CLI changelog

[release/v2.9.x] Include source-watcher to oci flux-manifests by @fluxcdbot in #5996
Update fluxcd/pkg dependencies by @fluxcdbot in #6006
Update toolkit components by @fluxcdbot in #6011

Full Changelog: https://github.com/fluxcd/flux2/compare/v2.9.2...v2.9.3

`v2.9.2`

Compare Source

Highlights

Flux v2.9.2 is a patch release. The main fix addresses a regression introduced in
v2.9.1 where a Kustomization with openapi.path pointing to a URL failed to
reconcile with failed to read OpenAPI schema. This release also corrects several
CRD field descriptions that contained inaccurate or leaked content. Users are
encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

Fix a regression where a Kustomization with openapi.path pointing to a URL failed to reconcile with failed to read OpenAPI schema (kustomize-controller)
Fix the HelmChart CRD description for .status.url, which pointed users at BucketStatus.Artifact instead of HelmChartStatus.Artifact (source-controller)
Fix the ImageRepository CRD description for .status.observedExclusionList, which referred to spec.lastScanResult instead of status.lastScanResult (image-reflector-controller)
Fix the ImageUpdateAutomation CRD description for .status.observedSourceRevision, which had a stray Go struct declaration leaking into it (image-automation-controller)

Improvements:

Update fluxcd/pkg dependencies

Components changelog

source-controller v1.9.3
kustomize-controller v1.9.3
helm-controller v1.6.2
notification-controller v1.9.2
image-reflector-controller v1.2.3
image-automation-controller v1.2.3
source-watcher v2.2.2

CLI changelog

Update fluxcd/pkg dependencies by @fluxcdbot in #5984
Update fluxcd/pkg dependencies by @fluxcdbot in #5990
Update toolkit components by @fluxcdbot in #5994

Full Changelog: https://github.com/fluxcd/flux2/compare/v2.9.1...v2.9.2

`v2.9.1`

Compare Source

Highlights

Flux v2.9.1 is a patch release. The main fix, applied across all controllers, disables Flux variable substitution on the Flux CRDs by annotating them with kustomize.toolkit.fluxcd.io/substitute: disabled, so that Kustomizations with post-build substitution enabled no longer corrupt the CRD schemas when they contain ${...} sequences. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

Disable Flux variable substitution on all Flux CRDs, preventing post-build substitution from corrupting CRD schemas that contain ${...} sequences (all controllers)
Update SOPS dependency to fix .ini file decryption (kustomize-controller)
Fix a dry-run error where applying a resource with a strategic merge patch could fail with <resource> is invalid (kustomize-controller)
Fix a breaking change in the in-memory Kustomization build (Flux CLI)

Improvements:

Cache the registry authorization token during Notation verification, so it is fetched once per verification instead of once per request (source-controller)
Update fluxcd/pkg dependencies

Components changelog

source-controller v1.9.2
kustomize-controller v1.9.2
helm-controller v1.6.2
notification-controller v1.9.2
image-reflector-controller v1.2.2
image-automation-controller v1.2.2
source-watcher v2.2.2

CLI changelog

[release/v2.9.x] Fix breaking change in-memory kustomization build by @fluxcdbot in #5971
Update fluxcd/pkg dependencies by @fluxcdbot in #5977
Update toolkit components by @fluxcdbot in #5979

Full Changelog: https://github.com/fluxcd/flux2/compare/v2.9.0...v2.9.1

`v2.9.0`

Compare Source

Highlights

Flux v2.9.0 is a feature release. Users are encouraged to upgrade for the best experience.

For a compressive overview of new features and API changes included in this release, please refer to the Announcing Flux 2.9 GA blog post.

Overview of the new features:

Flux CLI Plugin System with the Mirror and Schema plugins (flux plugin)
Server-Side Apply field ignore rules for fine-grained drift control (Kustomization)
SOPS decryption with the Age post-quantum cipher (Kustomization)
Kubernetes Workload Identity authentication for OpenBao and Vault (Kustomization)
Helm post-render strategies, including chart hooks support (HelmRelease)
Literal mode for Helm values references mirroring helm --set-literal (HelmRelease)
Allow empty kind in CEL health check expressions (Kustomization, HelmRelease)
Git commit signing and verification with SSH keys (GitRepository, ImageUpdateAutomation)
AWS CodeCommit authentication using Workload Identity (GitRepository)
Custom Sigstore trusted root for keyless verification in air-gapped environments (OCIRepository)
Path pattern directory discovery for monorepos (ArtifactGenerator)
Secret-less, OIDC-secured webhook Receivers (Receiver)

❤️ Big thanks to all the Flux contributors that helped us with this release!

Kubernetes compatibility

This release is compatible with the following Kubernetes versions:

Kubernetes version	Minimum required
`v1.34`	`>= 1.34.1`
`v1.35`	`>= 1.35.0`
`v1.36`	`>= 1.36.0`

[!NOTE]
Note that the Flux project offers support only for the latest three minor versions of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors such as
ControlPlane that provide enterprise support for Flux.

OpenShift compatibility

Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using Flux Operator. The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage.

Upgrade procedure

⚠️ The Flux APIs image.toolkit.fluxcd.io/v1beta2 and notification.toolkit.fluxcd.io/v1beta2
have reached end-of-life and have been removed from the CRDs.

Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from older versions of Flux to v2.9.

Components changelog

source-controller v1.9.1
kustomize-controller v1.9.1
notification-controller v1.9.1
helm-controller v1.6.1
image-reflector-controller v1.2.1
image-automation-controller v1.2.1
source-watcher v2.2.1

CLI changelog

Add backport label for Flux 2.8 by @matheuscscp in #5732
Remove no longer needed workaround for Flux 2.8 by @matheuscscp in #5733
Update toolkit components by @fluxcdbot in #5740
Add missing things to release notes template by @matheuscscp in #5743
ci: add top-level permissions to upgrade-fluxcd-pkg workflow by @gaganhr94 in #5763
build(deps): bump the ci group across 1 directory with 11 updates by @dependabot[bot] in #5764
Update fluxcd/pkg dependencies by @fluxcdbot in #5766
Update toolkit components by @fluxcdbot in #5769
Add target branch name to update branch by @matheuscscp in #5773
Fix/resume exit code by @Aman-Cool in #5701
Mark RFC 0010, 0011 and 0012 as implemented by @stefanprodan in #5776
Update toolkit components by @fluxcdbot in #5780
Add --resolve-symlinks flag to build and push artifact commands by @rohansood10 in #5724
fix: validate --source flag in create kustomization command by @gma1k in #5798
Update toolkit components by @fluxcdbot in #5821
Add --show-source to flux get ks and flux get hr by @rafaelperoco in #5828
Add flux create secret receiver command by @stefanprodan in #5835
fix: handle multiple symlinks to same target in build artifact by @Iam-Karan-Suresh in #5833
Add --in-memory-build to flux build ks and flux diff ks by @rycli in #5794
Migrate end-to-end test to latest cloud SDKs by @stefanprodan in #5840
docs: Add AI Coding Assistants Guidance by @stefanprodan in #5841
Add AI Agents guidance by @stefanprodan in #5847
[RFC-0013] Flux CLI Plugin System by @stefanprodan in #5795
Add --ignore-not-found to flux diff ks by @rycli in #5845
[RFC-0013] Implement plugin system by @stefanprodan in #5849
build(deps): bump github.com/go-git/go-git/v5 from 5.17.1 to 5.18.0 by @dependabot[bot] in #5853
Update toolkit components by @fluxcdbot in #5856
Add digest pinning support to flux plugin install by @Iam-Karan-Suresh in #5872
Add --ns-follows-kube-context global flag for using the kubeconfig context namespace by @jtyr in #5831
include source-watcher in install.yaml manifests by @tmmorin in #5881
Update toolkit components by @fluxcdbot in #5890
Update toolkit components by @fluxcdbot in #5903
Update fluxcd/pkg dependencies by @fluxcdbot in #5907
Validate Helm source URL schemes by @immanuwell in #5909
Introduce flux trigger receiver by @matheuscscp in #5908
refactor(api): migrate MakeDependsOn to shared apis/meta func by @vecil in #5912
Update to Kubernetes 1.36 and Go 1.26 by @stefanprodan in #5924
build(deps): bump the ci group across 1 directory with 19 updates by @dependabot[bot] in #5925
Run conformance tests for Kubernetes 1.36 by @stefanprodan in #5926
Add support for AWS CodeCommit to flux bootstrap git by @taraspos in #5868
Validate plugin binary path by @stefanprodan in #5927
Update fluxcd/pkg dependencies by @fluxcdbot in #5928
fix: preserve invalid metadata.labels in flux build ks by @raffis in #5906
build: target host arch for local builds/envtest by @stealthybox in #5932
build(deps): bump the ci group with 6 updates by @dependabot[bot] in #5938
Support specifing sparseCheckout in flux bootstrap by @piny940 in #5918
Update toolkit components by @fluxcdbot in #5944
Honor ks.spec.postBuild.substituteStrategy by @matheuscscp in #5945
Add DriftIgnoreRules support to flux diff kustomization by @dipti-pai in #5923
Allow signing commits using SSH key by @hiddeco in #5920
Update toolkit components by @fluxcdbot in #5950
Update fluxcd/pkg dependencies by @fluxcdbot in #5937
cmd: support type!=status in get --status-selector by @3uzbcqje in #5952
Fix flux get all --status-selector for empty results and notification resources by @matheuscscp in #5954
Upgrade go-git-providers to v0.27.0 by @matheuscscp in #5956
Fix using Receiver adapter for ArtifactGenerator by @matheuscscp in #5957
feat: Install Plugins alongside Flux setup in gh actions by @gat786 in #5955
Update fluxcd/pkg dependencies by @fluxcdbot in #5960
Add CLI support for OCIRepository.spec.layerSelector in flux create source oci by @dme86 in #5892
Update toolkit components by @fluxcdbot in #5963

New Contributors

@gaganhr94 made their first contribution in #5763
@rohansood10 made their first contribution in #5724
@gma1k made their first contribution in #5798
@rafaelperoco made their first contribution in #5828
@Iam-Karan-Suresh made their first contribution in #5833
@rycli made their first contribution in #5794
@jtyr made their first contribution in #5831
@tmmorin made their first contribution in #5881
@immanuwell made their first contribution in #5909
@vecil made their first contribution in #5912
@taraspos made their first contribution in #5868
@piny940 made their first contribution in #5918
@3uzbcqje made their first contribution in #5952
@gat786 made their first contribution in #5955
@dme86 made their first contribution in #5892

Full Changelog: https://github.com/fluxcd/flux2/compare/v2.8.0...v2.9.0

`v2.8.8`

Compare Source

Highlights

Flux v2.8.8 is a patch release that includes CVE fixes via go-git v5.19.1 (source-controller, image-automation-controller), reliability fixes in helm-controller and source-controller, the move of Helm back to upstream v4.2.0, support for GCP sovereign cloud artifact registries, and dependency updates. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

Add a configurable HTTP timeout for artifact fetching, preventing fetches that could block indefinitely and stall reconciliations (helm-controller)
Fix unbounded memory growth caused by a Kubernetes client transport retry wrapper accumulating on every reconcile (helm-controller)
Stop force-applying non-CRD objects placed under a chart's crds/ directory (helm-controller)
Fix the Helm test action failing to find releases with names longer than 53 characters (helm-controller)
Improve path handling in the source reconcilers (source-controller)
Support Helm semver build-metadata encoding in OCIRepository tags (source-controller)

Improvements:

Update go-git to v5.19.1 which fixes CVE-2026-45571 and CVE-2026-45570 (source-controller, image-automation-controller)
Move Helm back to upstream v4.2.0 (source-controller, helm-controller)
Add support for GCP sovereign cloud artifact registries (source-controller, image-reflector-controller)
Upgrade Kubernetes to 1.36.1 (source-controller, helm-controller)
Update fluxcd/pkg dependencies

Components changelog

helm-controller v1.5.5
image-automation-controller v1.1.4
image-reflector-controller v1.1.2
source-controller v1.8.5

CLI changelog

Update toolkit components by @fluxcdbot in #5904

Full Changelog: https://github.com/fluxcd/flux2/compare/v2.8.7...v2.8.8

`v2.8.7`

Compare Source

Highlights

Flux v2.8.7 is a patch release that includes a bug fix in kustomize-controller, a CVE fix in source-controller and image-automation-controller via go-git v5.19.0, and dependency updates. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

Fix management of objects annotated with kustomize.toolkit.fluxcd.io/ssa: IfNotPresent where non-namespaced resources were being deleted and recreated on each reconciliation (kustomize-controller)

Improvements:

Update go-git to v5.19.0 which fixes CVE-2026-45022 (source-controller, image-automation-controller)
Update fluxcd/pkg dependencies (source-controller, kustomize-controller, image-automation-controller)

Components changelog

helm-controller v1.5.4
image-automation-controller v1.1.3
kustomize-controller v1.8.5
notification-controller v1.8.4
source-controller v1.8.4

CLI changelog

Update toolkit components by @fluxcdbot in #5891

Full Changelog: https://github.com/fluxcd/flux2/compare/v2.8.6...v2.8.7

fluxcd/helm-controller (ghcr.io/fluxcd/helm-controller)

`v1.6.3`

Compare Source

Changelog

v1.6.3 changelog

Container images

docker.io/fluxcd/helm-controller:v1.6.3
ghcr.io/fluxcd/helm-controller:v1.6.3

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

`v1.6.2`

Compare Source

Changelog

v1.6.2 changelog

Container images

docker.io/fluxcd/helm-controller:v1.6.2
ghcr.io/fluxcd/helm-controller:v1.6.2

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

`v1.6.1`

Compare Source

Changelog

v1.6.1 changelog

Container images

docker.io/fluxcd/helm-controller:v1.6.1
ghcr.io/fluxcd/helm-controller:v1.6.1

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

`v1.6.0`

Compare Source

Changelog

v1.6.0 changelog

Container images

docker.io/fluxcd/helm-controller:v1.6.0
ghcr.io/fluxcd/helm-controller:v1.6.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

`v1.5.5`

Compare Source

Changelog

v1.5.5 changelog

Container images

docker.io/fluxcd/helm-controller:v1.5.5
ghcr.io/fluxcd/helm-controller:v1.5.5

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

fluxcd/kustomize-controller (ghcr.io/fluxcd/kustomize-controller)

`v1.9.4`

Compare Source

Changelog

v1.9.4 changelog

Container images

docker.io/fluxcd/kustomize-controller:v1.9.4
ghcr.io/fluxcd/kustomize-controller:v1.9.4

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

`v1.9.3`

Compare Source

Changelog

v1.9.3 changelog

Container images

docker.io/fluxcd/kustomize-controller:v1.9.3
ghcr.io/fluxcd/kustomize-controller:v1.9.3

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

`v1.9.2`

Compare Source

Changelog

v1.9.2 changelog

Container images

docker.io/fluxcd/kustomize-controller:v1.9.2
ghcr.io/fluxcd/kustomize-controller:v1.9.2

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

`v1.9.1`

Compare Source

Changelog

v1.9.1 changelog

Container images

docker.io/fluxcd/kustomize-controller:v1.9.1
ghcr.io/fluxcd/kustomize-controller:v1.9.1

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

`v1.9.0`

Compare Source

Changelog

v1.9.0 changelog

Container images

docker.io/fluxcd/kustomize-controller:v1.9.0
ghcr.io/fluxcd/kustomize-controller:v1.9.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

`v1.8.5`

Compare Source

Changelog

v1.8.5 changelog

Container images

docker.io/fluxcd/kustomize-controller:v1.8.5
ghcr.io/fluxcd/kustomize-controller:v1.8.5

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

fluxcd/notification-controller (ghcr.io/fluxcd/notification-controller)

`v1.9.2`

Compare Source

Changelog

v1.9.2 changelog

Container images

docker.io/fluxcd/notification-controller:v1.9.2
ghcr.io/fluxcd/notification-controller:v1.9.2

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

`v1.9.1`

Compare Source

Changelog

v1.9.1 changelog

Container images

docker.io/fluxcd/notification-controller:v1.9.1
ghcr.io/fluxcd/notification-controller:v1.9.1

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

`v1.9.0`

Compare Source

Changelog

v1.9.0 changelog

Container images

docker.io/fluxcd/notification-controller:v1.9.0
ghcr.io/fluxcd/notification-controller:v1.9.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

fluxcd/source-controller (ghcr.io/fluxcd/source-controller)

`v1.9.3`

Compare Source

Changelog

v1.9.3 changelog

Container images

docker.io/fluxcd/source-controller:v1.9.3
ghcr.io/fluxcd/source-controller:v1.9.3

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

`v1.9.2`

Compare Source

Changelog

v1.9.2 changelog

Container images

docker.io/fluxcd/source-controller:v1.9.2
ghcr.io/fluxcd/source-controller:v1.9.2

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

`v1.9.1`

Compare Source

Changelog

v1.9.1 changelog

Container images

docker.io/fluxcd/source-controller:v1.9.1
ghcr.io/fluxcd/source-controller:v1.9.1

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

`v1.9.0`

Compare Source

Changelog

v1.9.0 changelog

Container images

docker.io/fluxcd/source-controller:v1.9.0
ghcr.io/fluxcd/source-controller:v1.9.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

`v1.8.5`

Compare Source

Changelog

v1.8.5 changelog

Container images

docker.io/fluxcd/source-controller:v1.8.5
ghcr.io/fluxcd/source-controller:v1.8.5

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

`v1.8.4`

Compare Source

Changelog

v1.8.4 changelog

Container images

docker.io/fluxcd/source-controller:v1.8.4
ghcr.io/fluxcd/source-controller:v1.8.4

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

Branch creation
- "before 6am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [fluxcd/flux2](https://github.com/fluxcd/flux2) | minor | `v2.8.6` → `v2.9.3` | | [ghcr.io/fluxcd/helm-controller](https://github.com/fluxcd/helm-controller) | minor | `v1.5.4` → `v1.6.3` | | [ghcr.io/fluxcd/kustomize-controller](https://github.com/fluxcd/kustomize-controller) | minor | `v1.8.4` → `v1.9.4` | | [ghcr.io/fluxcd/notification-controller](https://github.com/fluxcd/notification-controller) | minor | `v1.8.4` → `v1.9.2` | | [ghcr.io/fluxcd/source-controller](https://github.com/fluxcd/source-controller) | minor | `v1.8.3` → `v1.9.3` | --- ### Release Notes <details> <summary>fluxcd/flux2 (fluxcd/flux2)</summary> ### [`v2.9.3`](https://github.com/fluxcd/flux2/releases/tag/v2.9.3) [Compare Source](https://github.com/fluxcd/flux2/compare/v2.9.2...v2.9.3) ##### Highlights Flux v2.9.3 is a patch release. It fixes empty lines vanishing from rendered Helm chart manifests, HelmReleases being marked as tested when their Helm test hooks never ran, and `spec.images` entries that set only some image fields discarding the remaining fields already declared for the same image in the `kustomization.yaml`. The latter affects both kustomize-controller and the `flux build|diff kustomization` commands. Users are encouraged to upgrade for the best experience. ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version. Fixes: - Fix empty lines vanishing from rendered chart manifests (helm-controller) - Fix `HasBeenTested` for all corner cases, where a release could be marked as tested although its Helm test hooks never ran (helm-controller) - Fix a `spec.images` entry setting only some of the image fields discarding the remaining fields already declared for the same image in the `kustomization.yaml` at `spec.path`, e.g. overriding only `newName` produced an untagged image reference (kustomize-controller, flux CLI) Improvements: - Update fluxcd/pkg dependencies - Include source-watcher in the OCI flux-manifests artifact ##### Components changelog - kustomize-controller [v1.9.4](https://github.com/fluxcd/kustomize-controller/blob/v1.9.4/CHANGELOG.md) - helm-controller [v1.6.3](https://github.com/fluxcd/helm-controller/blob/v1.6.3/CHANGELOG.md) ##### CLI changelog - \[release/v2.9.x] Include source-watcher to oci flux-manifests by [@fluxcdbot](https://github.com/fluxcdbot) in [#5996](https://github.com/fluxcd/flux2/pull/5996) - Update fluxcd/pkg dependencies by [@fluxcdbot](https://github.com/fluxcdbot) in [#6006](https://github.com/fluxcd/flux2/pull/6006) - Update toolkit components by [@fluxcdbot](https://github.com/fluxcdbot) in [#6011](https://github.com/fluxcd/flux2/pull/6011) **Full Changelog**: <https://github.com/fluxcd/flux2/compare/v2.9.2...v2.9.3> ### [`v2.9.2`](https://github.com/fluxcd/flux2/releases/tag/v2.9.2) [Compare Source](https://github.com/fluxcd/flux2/compare/v2.9.1...v2.9.2) ##### Highlights Flux v2.9.2 is a patch release. The main fix addresses a regression introduced in v2.9.1 where a Kustomization with `openapi.path` pointing to a URL failed to reconcile with `failed to read OpenAPI schema`. This release also corrects several CRD field descriptions that contained inaccurate or leaked content. Users are encouraged to upgrade for the best experience. ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version. Fixes: - Fix a regression where a Kustomization with `openapi.path` pointing to a URL failed to reconcile with `failed to read OpenAPI schema` (kustomize-controller) - Fix the `HelmChart` CRD description for `.status.url`, which pointed users at `BucketStatus.Artifact` instead of `HelmChartStatus.Artifact` (source-controller) - Fix the `ImageRepository` CRD description for `.status.observedExclusionList`, which referred to `spec.lastScanResult` instead of `status.lastScanResult` (image-reflector-controller) - Fix the `ImageUpdateAutomation` CRD description for `.status.observedSourceRevision`, which had a stray Go struct declaration leaking into it (image-automation-controller) Improvements: - Update fluxcd/pkg dependencies ##### Components changelog - source-controller [v1.9.3](https://github.com/fluxcd/source-controller/blob/v1.9.3/CHANGELOG.md) - kustomize-controller [v1.9.3](https://github.com/fluxcd/kustomize-controller/blob/v1.9.3/CHANGELOG.md) - helm-controller [v1.6.2](https://github.com/fluxcd/helm-controller/blob/v1.6.2/CHANGELOG.md) - notification-controller [v1.9.2](https://github.com/fluxcd/notification-controller/blob/v1.9.2/CHANGELOG.md) - image-reflector-controller [v1.2.3](https://github.com/fluxcd/image-reflector-controller/blob/v1.2.3/CHANGELOG.md) - image-automation-controller [v1.2.3](https://github.com/fluxcd/image-automation-controller/blob/v1.2.3/CHANGELOG.md) - source-watcher [v2.2.2](https://github.com/fluxcd/source-watcher/blob/v2.2.2/CHANGELOG.md) ##### CLI changelog - Update fluxcd/pkg dependencies by [@fluxcdbot](https://github.com/fluxcdbot) in [#5984](https://github.com/fluxcd/flux2/pull/5984) - Update fluxcd/pkg dependencies by [@fluxcdbot](https://github.com/fluxcdbot) in [#5990](https://github.com/fluxcd/flux2/pull/5990) - Update toolkit components by [@fluxcdbot](https://github.com/fluxcdbot) in [#5994](https://github.com/fluxcd/flux2/pull/5994) **Full Changelog**: <https://github.com/fluxcd/flux2/compare/v2.9.1...v2.9.2> ### [`v2.9.1`](https://github.com/fluxcd/flux2/releases/tag/v2.9.1) [Compare Source](https://github.com/fluxcd/flux2/compare/v2.9.0...v2.9.1) ##### Highlights Flux v2.9.1 is a patch release. The main fix, applied across all controllers, disables Flux variable substitution on the Flux CRDs by annotating them with `kustomize.toolkit.fluxcd.io/substitute: disabled`, so that Kustomizations with post-build substitution enabled no longer corrupt the CRD schemas when they contain `${...}` sequences. Users are encouraged to upgrade for the best experience. ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version. Fixes: - Disable Flux variable substitution on all Flux CRDs, preventing post-build substitution from corrupting CRD schemas that contain `${...}` sequences (all controllers) - Update SOPS dependency to fix `.ini` file decryption (kustomize-controller) - Fix a dry-run error where applying a resource with a strategic merge patch could fail with `<resource> is invalid` (kustomize-controller) - Fix a breaking change in the in-memory Kustomization build (Flux CLI) Improvements: - Cache the registry authorization token during Notation verification, so it is fetched once per verification instead of once per request (source-controller) - Update fluxcd/pkg dependencies ##### Components changelog - source-controller [v1.9.2](https://github.com/fluxcd/source-controller/blob/v1.9.2/CHANGELOG.md) - kustomize-controller [v1.9.2](https://github.com/fluxcd/kustomize-controller/blob/v1.9.2/CHANGELOG.md) - helm-controller [v1.6.2](https://github.com/fluxcd/helm-controller/blob/v1.6.2/CHANGELOG.md) - notification-controller [v1.9.2](https://github.com/fluxcd/notification-controller/blob/v1.9.2/CHANGELOG.md) - image-reflector-controller [v1.2.2](https://github.com/fluxcd/image-reflector-controller/blob/v1.2.2/CHANGELOG.md) - image-automation-controller [v1.2.2](https://github.com/fluxcd/image-automation-controller/blob/v1.2.2/CHANGELOG.md) - source-watcher [v2.2.2](https://github.com/fluxcd/source-watcher/blob/v2.2.2/CHANGELOG.md) ##### CLI changelog - \[release/v2.9.x] Fix breaking change in-memory kustomization build by [@fluxcdbot](https://github.com/fluxcdbot) in [#5971](https://github.com/fluxcd/flux2/pull/5971) - Update fluxcd/pkg dependencies by [@fluxcdbot](https://github.com/fluxcdbot) in [#5977](https://github.com/fluxcd/flux2/pull/5977) - Update toolkit components by [@fluxcdbot](https://github.com/fluxcdbot) in [#5979](https://github.com/fluxcd/flux2/pull/5979) **Full Changelog**: <https://github.com/fluxcd/flux2/compare/v2.9.0...v2.9.1> ### [`v2.9.0`](https://github.com/fluxcd/flux2/releases/tag/v2.9.0) [Compare Source](https://github.com/fluxcd/flux2/compare/v2.8.8...v2.9.0) ##### Highlights Flux v2.9.0 is a feature release. Users are encouraged to upgrade for the best experience. For a compressive overview of new features and API changes included in this release, please refer to the [Announcing Flux 2.9 GA blog post](https://fluxcd.io/blog/2026/06/flux-v2.9.0/). Overview of the new features: - Flux CLI Plugin System with the Mirror and Schema plugins (`flux plugin`) - Server-Side Apply field ignore rules for fine-grained drift control (`Kustomization`) - SOPS decryption with the Age post-quantum cipher (`Kustomization`) - Kubernetes Workload Identity authentication for OpenBao and Vault (`Kustomization`) - Helm post-render strategies, including chart hooks support (`HelmRelease`) - Literal mode for Helm values references mirroring `helm --set-literal` (`HelmRelease`) - Allow empty kind in CEL health check expressions (`Kustomization`, `HelmRelease`) - Git commit signing and verification with SSH keys (`GitRepository`, `ImageUpdateAutomation`) - AWS CodeCommit authentication using Workload Identity (`GitRepository`) - Custom Sigstore trusted root for keyless verification in air-gapped environments (`OCIRepository`) - Path pattern directory discovery for monorepos (`ArtifactGenerator`) - Secret-less, OIDC-secured webhook Receivers (`Receiver`) ❤️ Big thanks to all the Flux contributors that helped us with this release! ##### Kubernetes compatibility This release is compatible with the following Kubernetes versions: | Kubernetes version | Minimum required | | ------------------ | ---------------- | | `v1.34` | `>= 1.34.1` | | `v1.35` | `>= 1.35.0` | | `v1.36` | `>= 1.36.0` | > \[!NOTE] > Note that the Flux project offers support only for the latest three minor versions of Kubernetes. > Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors such as > [ControlPlane](https://control-plane.io/enterprise-for-flux-cd/) that provide enterprise support for Flux. ##### OpenShift compatibility Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using [Flux Operator](https://operatorhub.io/operator/flux-operator). The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage. ##### Upgrade procedure :warning: The Flux APIs `image.toolkit.fluxcd.io/v1beta2` and `notification.toolkit.fluxcd.io/v1beta2` have reached end-of-life and have been removed from the CRDs. Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from older versions of Flux to v2.9. ##### Components changelog - source-controller [v1.9.1](https://github.com/fluxcd/source-controller/blob/v1.9.1/CHANGELOG.md) - kustomize-controller [v1.9.1](https://github.com/fluxcd/kustomize-controller/blob/v1.9.1/CHANGELOG.md) - notification-controller [v1.9.1](https://github.com/fluxcd/notification-controller/blob/v1.9.1/CHANGELOG.md) - helm-controller [v1.6.1](https://github.com/fluxcd/helm-controller/blob/v1.6.1/CHANGELOG.md) - image-reflector-controller [v1.2.1](https://github.com/fluxcd/image-reflector-controller/blob/v1.2.1/CHANGELOG.md) - image-automation-controller [v1.2.1](https://github.com/fluxcd/image-automation-controller/blob/v1.2.1/CHANGELOG.md) - source-watcher [v2.2.1](https://github.com/fluxcd/source-watcher/blob/v2.2.1/CHANGELOG.md) ##### CLI changelog - Add backport label for Flux 2.8 by [@matheuscscp](https://github.com/matheuscscp) in [#5732](https://github.com/fluxcd/flux2/pull/5732) - Remove no longer needed workaround for Flux 2.8 by [@matheuscscp](https://github.com/matheuscscp) in [#5733](https://github.com/fluxcd/flux2/pull/5733) - Update toolkit components by [@fluxcdbot](https://github.com/fluxcdbot) in [#5740](https://github.com/fluxcd/flux2/pull/5740) - Add missing things to release notes template by [@matheuscscp](https://github.com/matheuscscp) in [#5743](https://github.com/fluxcd/flux2/pull/5743) - ci: add top-level permissions to upgrade-fluxcd-pkg workflow by [@gaganhr94](https://github.com/gaganhr94) in [#5763](https://github.com/fluxcd/flux2/pull/5763) - build(deps): bump the ci group across 1 directory with 11 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#5764](https://github.com/fluxcd/flux2/pull/5764) - Update fluxcd/pkg dependencies by [@fluxcdbot](https://github.com/fluxcdbot) in [#5766](https://github.com/fluxcd/flux2/pull/5766) - Update toolkit components by [@fluxcdbot](https://github.com/fluxcdbot) in [#5769](https://github.com/fluxcd/flux2/pull/5769) - Add target branch name to update branch by [@matheuscscp](https://github.com/matheuscscp) in [#5773](https://github.com/fluxcd/flux2/pull/5773) - Fix/resume exit code by [@Aman-Cool](https://github.com/Aman-Cool) in [#5701](https://github.com/fluxcd/flux2/pull/5701) - Mark RFC 0010, 0011 and 0012 as implemented by [@stefanprodan](https://github.com/stefanprodan) in [#5776](https://github.com/fluxcd/flux2/pull/5776) - Update toolkit components by [@fluxcdbot](https://github.com/fluxcdbot) in [#5780](https://github.com/fluxcd/flux2/pull/5780) - Add --resolve-symlinks flag to build and push artifact commands by [@rohansood10](https://github.com/rohansood10) in [#5724](https://github.com/fluxcd/flux2/pull/5724) - fix: validate --source flag in create kustomization command by [@gma1k](https://github.com/gma1k) in [#5798](https://github.com/fluxcd/flux2/pull/5798) - Update toolkit components by [@fluxcdbot](https://github.com/fluxcdbot) in [#5821](https://github.com/fluxcd/flux2/pull/5821) - Add `--show-source` to `flux get ks` and `flux get hr` by [@rafaelperoco](https://github.com/rafaelperoco) in [#5828](https://github.com/fluxcd/flux2/pull/5828) - Add `flux create secret receiver` command by [@stefanprodan](https://github.com/stefanprodan) in [#5835](https://github.com/fluxcd/flux2/pull/5835) - fix: handle multiple symlinks to same target in build artifact by [@Iam-Karan-Suresh](https://github.com/Iam-Karan-Suresh) in [#5833](https://github.com/fluxcd/flux2/pull/5833) - Add `--in-memory-build` to `flux build ks` and `flux diff ks` by [@rycli](https://github.com/rycli) in [#5794](https://github.com/fluxcd/flux2/pull/5794) - Migrate end-to-end test to latest cloud SDKs by [@stefanprodan](https://github.com/stefanprodan) in [#5840](https://github.com/fluxcd/flux2/pull/5840) - docs: Add AI Coding Assistants Guidance by [@stefanprodan](https://github.com/stefanprodan) in [#5841](https://github.com/fluxcd/flux2/pull/5841) - Add AI Agents guidance by [@stefanprodan](https://github.com/stefanprodan) in [#5847](https://github.com/fluxcd/flux2/pull/5847) - \[RFC-0013] Flux CLI Plugin System by [@stefanprodan](https://github.com/stefanprodan) in [#5795](https://github.com/fluxcd/flux2/pull/5795) - Add `--ignore-not-found` to `flux diff ks` by [@rycli](https://github.com/rycli) in [#5845](https://github.com/fluxcd/flux2/pull/5845) - \[RFC-0013] Implement plugin system by [@stefanprodan](https://github.com/stefanprodan) in [#5849](https://github.com/fluxcd/flux2/pull/5849) - build(deps): bump github.com/go-git/go-git/v5 from 5.17.1 to 5.18.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5853](https://github.com/fluxcd/flux2/pull/5853) - Update toolkit components by [@fluxcdbot](https://github.com/fluxcdbot) in [#5856](https://github.com/fluxcd/flux2/pull/5856) - Add digest pinning support to `flux plugin install` by [@Iam-Karan-Suresh](https://github.com/Iam-Karan-Suresh) in [#5872](https://github.com/fluxcd/flux2/pull/5872) - Add `--ns-follows-kube-context` global flag for using the kubeconfig context namespace by [@jtyr](https://github.com/jtyr) in [#5831](https://github.com/fluxcd/flux2/pull/5831) - include source-watcher in install.yaml manifests by [@tmmorin](https://github.com/tmmorin) in [#5881](https://github.com/fluxcd/flux2/pull/5881) - Update toolkit components by [@fluxcdbot](https://github.com/fluxcdbot) in [#5890](https://github.com/fluxcd/flux2/pull/5890) - Update toolkit components by [@fluxcdbot](https://github.com/fluxcdbot) in [#5903](https://github.com/fluxcd/flux2/pull/5903) - Update fluxcd/pkg dependencies by [@fluxcdbot](https://github.com/fluxcdbot) in [#5907](https://github.com/fluxcd/flux2/pull/5907) - Validate Helm source URL schemes by [@immanuwell](https://github.com/immanuwell) in [#5909](https://github.com/fluxcd/flux2/pull/5909) - Introduce `flux trigger receiver` by [@matheuscscp](https://github.com/matheuscscp) in [#5908](https://github.com/fluxcd/flux2/pull/5908) - refactor(api): migrate MakeDependsOn to shared apis/meta func by [@vecil](https://github.com/vecil) in [#5912](https://github.com/fluxcd/flux2/pull/5912) - Update to Kubernetes 1.36 and Go 1.26 by [@stefanprodan](https://github.com/stefanprodan) in [#5924](https://github.com/fluxcd/flux2/pull/5924) - build(deps): bump the ci group across 1 directory with 19 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#5925](https://github.com/fluxcd/flux2/pull/5925) - Run conformance tests for Kubernetes 1.36 by [@stefanprodan](https://github.com/stefanprodan) in [#5926](https://github.com/fluxcd/flux2/pull/5926) - Add support for AWS CodeCommit to `flux bootstrap git` by [@taraspos](https://github.com/taraspos) in [#5868](https://github.com/fluxcd/flux2/pull/5868) - Validate plugin binary path by [@stefanprodan](https://github.com/stefanprodan) in [#5927](https://github.com/fluxcd/flux2/pull/5927) - Update fluxcd/pkg dependencies by [@fluxcdbot](https://github.com/fluxcdbot) in [#5928](https://github.com/fluxcd/flux2/pull/5928) - fix: preserve invalid metadata.labels in `flux build ks` by [@raffis](https://github.com/raffis) in [#5906](https://github.com/fluxcd/flux2/pull/5906) - build: target host arch for local builds/envtest by [@stealthybox](https://github.com/stealthybox) in [#5932](https://github.com/fluxcd/flux2/pull/5932) - build(deps): bump the ci group with 6 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#5938](https://github.com/fluxcd/flux2/pull/5938) - Support specifing sparseCheckout in flux bootstrap by [@piny940](https://github.com/piny940) in [#5918](https://github.com/fluxcd/flux2/pull/5918) - Update toolkit components by [@fluxcdbot](https://github.com/fluxcdbot) in [#5944](https://github.com/fluxcd/flux2/pull/5944) - Honor `ks.spec.postBuild.substituteStrategy` by [@matheuscscp](https://github.com/matheuscscp) in [#5945](https://github.com/fluxcd/flux2/pull/5945) - Add DriftIgnoreRules support to flux diff kustomization by [@dipti-pai](https://github.com/dipti-pai) in [#5923](https://github.com/fluxcd/flux2/pull/5923) - Allow signing commits using SSH key by [@hiddeco](https://github.com/hiddeco) in [#5920](https://github.com/fluxcd/flux2/pull/5920) - Update toolkit components by [@fluxcdbot](https://github.com/fluxcdbot) in [#5950](https://github.com/fluxcd/flux2/pull/5950) - Update fluxcd/pkg dependencies by [@fluxcdbot](https://github.com/fluxcdbot) in [#5937](https://github.com/fluxcd/flux2/pull/5937) - cmd: support `type!=status` in get --status-selector by [@3uzbcqje](https://github.com/3uzbcqje) in [#5952](https://github.com/fluxcd/flux2/pull/5952) - Fix `flux get all --status-selector` for empty results and notification resources by [@matheuscscp](https://github.com/matheuscscp) in [#5954](https://github.com/fluxcd/flux2/pull/5954) - Upgrade go-git-providers to v0.27.0 by [@matheuscscp](https://github.com/matheuscscp) in [#5956](https://github.com/fluxcd/flux2/pull/5956) - Fix using Receiver adapter for ArtifactGenerator by [@matheuscscp](https://github.com/matheuscscp) in [#5957](https://github.com/fluxcd/flux2/pull/5957) - feat: Install Plugins alongside Flux setup in gh actions by [@gat786](https://github.com/gat786) in [#5955](https://github.com/fluxcd/flux2/pull/5955) - Update fluxcd/pkg dependencies by [@fluxcdbot](https://github.com/fluxcdbot) in [#5960](https://github.com/fluxcd/flux2/pull/5960) - Add CLI support for OCIRepository.spec.layerSelector in flux create source oci by [@dme86](https://github.com/dme86) in [#5892](https://github.com/fluxcd/flux2/pull/5892) - Update toolkit components by [@fluxcdbot](https://github.com/fluxcdbot) in [#5963](https://github.com/fluxcd/flux2/pull/5963) ##### New Contributors - [@gaganhr94](https://github.com/gaganhr94) made their first contribution in [#5763](https://github.com/fluxcd/flux2/pull/5763) - [@rohansood10](https://github.com/rohansood10) made their first contribution in [#5724](https://github.com/fluxcd/flux2/pull/5724) - [@gma1k](https://github.com/gma1k) made their first contribution in [#5798](https://github.com/fluxcd/flux2/pull/5798) - [@rafaelperoco](https://github.com/rafaelperoco) made their first contribution in [#5828](https://github.com/fluxcd/flux2/pull/5828) - [@Iam-Karan-Suresh](https://github.com/Iam-Karan-Suresh) made their first contribution in [#5833](https://github.com/fluxcd/flux2/pull/5833) - [@rycli](https://github.com/rycli) made their first contribution in [#5794](https://github.com/fluxcd/flux2/pull/5794) - [@jtyr](https://github.com/jtyr) made their first contribution in [#5831](https://github.com/fluxcd/flux2/pull/5831) - [@tmmorin](https://github.com/tmmorin) made their first contribution in [#5881](https://github.com/fluxcd/flux2/pull/5881) - [@immanuwell](https://github.com/immanuwell) made their first contribution in [#5909](https://github.com/fluxcd/flux2/pull/5909) - [@vecil](https://github.com/vecil) made their first contribution in [#5912](https://github.com/fluxcd/flux2/pull/5912) - [@taraspos](https://github.com/taraspos) made their first contribution in [#5868](https://github.com/fluxcd/flux2/pull/5868) - [@piny940](https://github.com/piny940) made their first contribution in [#5918](https://github.com/fluxcd/flux2/pull/5918) - [@3uzbcqje](https://github.com/3uzbcqje) made their first contribution in [#5952](https://github.com/fluxcd/flux2/pull/5952) - [@gat786](https://github.com/gat786) made their first contribution in [#5955](https://github.com/fluxcd/flux2/pull/5955) - [@dme86](https://github.com/dme86) made their first contribution in [#5892](https://github.com/fluxcd/flux2/pull/5892) **Full Changelog**: <https://github.com/fluxcd/flux2/compare/v2.8.0...v2.9.0> ### [`v2.8.8`](https://github.com/fluxcd/flux2/releases/tag/v2.8.8) [Compare Source](https://github.com/fluxcd/flux2/compare/v2.8.7...v2.8.8) ##### Highlights Flux v2.8.8 is a patch release that includes CVE fixes via go-git v5.19.1 (source-controller, image-automation-controller), reliability fixes in helm-controller and source-controller, the move of Helm back to upstream v4.2.0, support for GCP sovereign cloud artifact registries, and dependency updates. Users are encouraged to upgrade for the best experience. ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version. Fixes: - Add a configurable HTTP timeout for artifact fetching, preventing fetches that could block indefinitely and stall reconciliations (helm-controller) - Fix unbounded memory growth caused by a Kubernetes client transport retry wrapper accumulating on every reconcile (helm-controller) - Stop force-applying non-CRD objects placed under a chart's `crds/` directory (helm-controller) - Fix the Helm test action failing to find releases with names longer than 53 characters (helm-controller) - Improve path handling in the source reconcilers (source-controller) - Support Helm semver build-metadata encoding in OCIRepository tags (source-controller) Improvements: - Update go-git to v5.19.1 which fixes [CVE-2026-45571](https://github.com/advisories/GHSA-crhj-59gh-8x96) and [CVE-2026-45570](https://github.com/advisories/GHSA-m7cr-m3pv-hgrp) (source-controller, image-automation-controller) - Move Helm back to upstream v4.2.0 (source-controller, helm-controller) - Add support for GCP sovereign cloud artifact registries (source-controller, image-reflector-controller) - Upgrade Kubernetes to 1.36.1 (source-controller, helm-controller) - Update fluxcd/pkg dependencies ##### Components changelog - helm-controller [v1.5.5](https://github.com/fluxcd/helm-controller/blob/v1.5.5/CHANGELOG.md) - image-automation-controller [v1.1.4](https://github.com/fluxcd/image-automation-controller/blob/v1.1.4/CHANGELOG.md) - image-reflector-controller [v1.1.2](https://github.com/fluxcd/image-reflector-controller/blob/v1.1.2/CHANGELOG.md) - source-controller [v1.8.5](https://github.com/fluxcd/source-controller/blob/v1.8.5/CHANGELOG.md) ##### CLI changelog - Update toolkit components by [@fluxcdbot](https://github.com/fluxcdbot) in [#5904](https://github.com/fluxcd/flux2/pull/5904) **Full Changelog**: <https://github.com/fluxcd/flux2/compare/v2.8.7...v2.8.8> ### [`v2.8.7`](https://github.com/fluxcd/flux2/releases/tag/v2.8.7) [Compare Source](https://github.com/fluxcd/flux2/compare/v2.8.6...v2.8.7) ##### Highlights Flux v2.8.7 is a patch release that includes a bug fix in kustomize-controller, a CVE fix in source-controller and image-automation-controller via go-git v5.19.0, and dependency updates. Users are encouraged to upgrade for the best experience. ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version. Fixes: - Fix management of objects annotated with `kustomize.toolkit.fluxcd.io/ssa: IfNotPresent` where non-namespaced resources were being deleted and recreated on each reconciliation (kustomize-controller) Improvements: - Update go-git to v5.19.0 which fixes [CVE-2026-45022](https://github.com/advisories/GHSA-389r-gv7p-r3rp) (source-controller, image-automation-controller) - Update fluxcd/pkg dependencies (source-controller, kustomize-controller, image-automation-controller) ##### Components changelog - helm-controller [v1.5.4](https://github.com/fluxcd/helm-controller/blob/v1.5.4/CHANGELOG.md) - image-automation-controller [v1.1.3](https://github.com/fluxcd/image-automation-controller/blob/v1.1.3/CHANGELOG.md) - kustomize-controller [v1.8.5](https://github.com/fluxcd/kustomize-controller/blob/v1.8.5/CHANGELOG.md) - notification-controller [v1.8.4](https://github.com/fluxcd/notification-controller/blob/v1.8.4/CHANGELOG.md) - source-controller [v1.8.4](https://github.com/fluxcd/source-controller/blob/v1.8.4/CHANGELOG.md) ##### CLI changelog - Update toolkit components by [@fluxcdbot](https://github.com/fluxcdbot) in [#5891](https://github.com/fluxcd/flux2/pull/5891) **Full Changelog**: <https://github.com/fluxcd/flux2/compare/v2.8.6...v2.8.7> </details> <details> <summary>fluxcd/helm-controller (ghcr.io/fluxcd/helm-controller)</summary> ### [`v1.6.3`](https://github.com/fluxcd/helm-controller/releases/tag/v1.6.3) [Compare Source](https://github.com/fluxcd/helm-controller/compare/v1.6.2...v1.6.3) ##### Changelog [v1.6.3 changelog](https://github.com/fluxcd/helm-controller/blob/v1.6.3/CHANGELOG.md) ##### Container images - `docker.io/fluxcd/helm-controller:v1.6.3` - `ghcr.io/fluxcd/helm-controller:v1.6.3` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). ### [`v1.6.2`](https://github.com/fluxcd/helm-controller/releases/tag/v1.6.2) [Compare Source](https://github.com/fluxcd/helm-controller/compare/v1.6.1...v1.6.2) ##### Changelog [v1.6.2 changelog](https://github.com/fluxcd/helm-controller/blob/v1.6.2/CHANGELOG.md) ##### Container images - `docker.io/fluxcd/helm-controller:v1.6.2` - `ghcr.io/fluxcd/helm-controller:v1.6.2` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). ### [`v1.6.1`](https://github.com/fluxcd/helm-controller/releases/tag/v1.6.1) [Compare Source](https://github.com/fluxcd/helm-controller/compare/v1.6.0...v1.6.1) ##### Changelog [v1.6.1 changelog](https://github.com/fluxcd/helm-controller/blob/v1.6.1/CHANGELOG.md) ##### Container images - `docker.io/fluxcd/helm-controller:v1.6.1` - `ghcr.io/fluxcd/helm-controller:v1.6.1` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). ### [`v1.6.0`](https://github.com/fluxcd/helm-controller/releases/tag/v1.6.0) [Compare Source](https://github.com/fluxcd/helm-controller/compare/v1.5.5...v1.6.0) ##### Changelog [v1.6.0 changelog](https://github.com/fluxcd/helm-controller/blob/v1.6.0/CHANGELOG.md) ##### Container images - `docker.io/fluxcd/helm-controller:v1.6.0` - `ghcr.io/fluxcd/helm-controller:v1.6.0` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). ### [`v1.5.5`](https://github.com/fluxcd/helm-controller/releases/tag/v1.5.5) [Compare Source](https://github.com/fluxcd/helm-controller/compare/v1.5.4...v1.5.5) ##### Changelog [v1.5.5 changelog](https://github.com/fluxcd/helm-controller/blob/v1.5.5/CHANGELOG.md) ##### Container images - `docker.io/fluxcd/helm-controller:v1.5.5` - `ghcr.io/fluxcd/helm-controller:v1.5.5` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). </details> <details> <summary>fluxcd/kustomize-controller (ghcr.io/fluxcd/kustomize-controller)</summary> ### [`v1.9.4`](https://github.com/fluxcd/kustomize-controller/releases/tag/v1.9.4) [Compare Source](https://github.com/fluxcd/kustomize-controller/compare/v1.9.3...v1.9.4) ##### Changelog [v1.9.4 changelog](https://github.com/fluxcd/kustomize-controller/blob/v1.9.4/CHANGELOG.md) ##### Container images - `docker.io/fluxcd/kustomize-controller:v1.9.4` - `ghcr.io/fluxcd/kustomize-controller:v1.9.4` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). ### [`v1.9.3`](https://github.com/fluxcd/kustomize-controller/releases/tag/v1.9.3) [Compare Source](https://github.com/fluxcd/kustomize-controller/compare/v1.9.2...v1.9.3) ##### Changelog [v1.9.3 changelog](https://github.com/fluxcd/kustomize-controller/blob/v1.9.3/CHANGELOG.md) ##### Container images - `docker.io/fluxcd/kustomize-controller:v1.9.3` - `ghcr.io/fluxcd/kustomize-controller:v1.9.3` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). ### [`v1.9.2`](https://github.com/fluxcd/kustomize-controller/releases/tag/v1.9.2) [Compare Source](https://github.com/fluxcd/kustomize-controller/compare/v1.9.1...v1.9.2) ##### Changelog [v1.9.2 changelog](https://github.com/fluxcd/kustomize-controller/blob/v1.9.2/CHANGELOG.md) ##### Container images - `docker.io/fluxcd/kustomize-controller:v1.9.2` - `ghcr.io/fluxcd/kustomize-controller:v1.9.2` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). ### [`v1.9.1`](https://github.com/fluxcd/kustomize-controller/releases/tag/v1.9.1) [Compare Source](https://github.com/fluxcd/kustomize-controller/compare/v1.9.0...v1.9.1) ##### Changelog [v1.9.1 changelog](https://github.com/fluxcd/kustomize-controller/blob/v1.9.1/CHANGELOG.md) ##### Container images - `docker.io/fluxcd/kustomize-controller:v1.9.1` - `ghcr.io/fluxcd/kustomize-controller:v1.9.1` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). ### [`v1.9.0`](https://github.com/fluxcd/kustomize-controller/releases/tag/v1.9.0) [Compare Source](https://github.com/fluxcd/kustomize-controller/compare/v1.8.5...v1.9.0) ##### Changelog [v1.9.0 changelog](https://github.com/fluxcd/kustomize-controller/blob/v1.9.0/CHANGELOG.md) ##### Container images - `docker.io/fluxcd/kustomize-controller:v1.9.0` - `ghcr.io/fluxcd/kustomize-controller:v1.9.0` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). ### [`v1.8.5`](https://github.com/fluxcd/kustomize-controller/releases/tag/v1.8.5) [Compare Source](https://github.com/fluxcd/kustomize-controller/compare/v1.8.4...v1.8.5) ##### Changelog [v1.8.5 changelog](https://github.com/fluxcd/kustomize-controller/blob/v1.8.5/CHANGELOG.md) ##### Container images - `docker.io/fluxcd/kustomize-controller:v1.8.5` - `ghcr.io/fluxcd/kustomize-controller:v1.8.5` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). </details> <details> <summary>fluxcd/notification-controller (ghcr.io/fluxcd/notification-controller)</summary> ### [`v1.9.2`](https://github.com/fluxcd/notification-controller/releases/tag/v1.9.2) [Compare Source](https://github.com/fluxcd/notification-controller/compare/v1.9.1...v1.9.2) ##### Changelog [v1.9.2 changelog](https://github.com/fluxcd/notification-controller/blob/v1.9.2/CHANGELOG.md) ##### Container images - `docker.io/fluxcd/notification-controller:v1.9.2` - `ghcr.io/fluxcd/notification-controller:v1.9.2` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). ### [`v1.9.1`](https://github.com/fluxcd/notification-controller/releases/tag/v1.9.1) [Compare Source](https://github.com/fluxcd/notification-controller/compare/v1.9.0...v1.9.1) ##### Changelog [v1.9.1 changelog](https://github.com/fluxcd/notification-controller/blob/v1.9.1/CHANGELOG.md) ##### Container images - `docker.io/fluxcd/notification-controller:v1.9.1` - `ghcr.io/fluxcd/notification-controller:v1.9.1` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). ### [`v1.9.0`](https://github.com/fluxcd/notification-controller/releases/tag/v1.9.0) [Compare Source](https://github.com/fluxcd/notification-controller/compare/v1.8.4...v1.9.0) ##### Changelog [v1.9.0 changelog](https://github.com/fluxcd/notification-controller/blob/v1.9.0/CHANGELOG.md) ##### Container images - `docker.io/fluxcd/notification-controller:v1.9.0` - `ghcr.io/fluxcd/notification-controller:v1.9.0` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). </details> <details> <summary>fluxcd/source-controller (ghcr.io/fluxcd/source-controller)</summary> ### [`v1.9.3`](https://github.com/fluxcd/source-controller/releases/tag/v1.9.3) [Compare Source](https://github.com/fluxcd/source-controller/compare/v1.9.2...v1.9.3) ##### Changelog [v1.9.3 changelog](https://github.com/fluxcd/source-controller/blob/v1.9.3/CHANGELOG.md) ##### Container images - `docker.io/fluxcd/source-controller:v1.9.3` - `ghcr.io/fluxcd/source-controller:v1.9.3` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). ### [`v1.9.2`](https://github.com/fluxcd/source-controller/releases/tag/v1.9.2) [Compare Source](https://github.com/fluxcd/source-controller/compare/v1.9.1...v1.9.2) ##### Changelog [v1.9.2 changelog](https://github.com/fluxcd/source-controller/blob/v1.9.2/CHANGELOG.md) ##### Container images - `docker.io/fluxcd/source-controller:v1.9.2` - `ghcr.io/fluxcd/source-controller:v1.9.2` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). ### [`v1.9.1`](https://github.com/fluxcd/source-controller/releases/tag/v1.9.1) [Compare Source](https://github.com/fluxcd/source-controller/compare/v1.9.0...v1.9.1) ##### Changelog [v1.9.1 changelog](https://github.com/fluxcd/source-controller/blob/v1.9.1/CHANGELOG.md) ##### Container images - `docker.io/fluxcd/source-controller:v1.9.1` - `ghcr.io/fluxcd/source-controller:v1.9.1` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). ### [`v1.9.0`](https://github.com/fluxcd/source-controller/releases/tag/v1.9.0) [Compare Source](https://github.com/fluxcd/source-controller/compare/v1.8.5...v1.9.0) ##### Changelog [v1.9.0 changelog](https://github.com/fluxcd/source-controller/blob/v1.9.0/CHANGELOG.md) ##### Container images - `docker.io/fluxcd/source-controller:v1.9.0` - `ghcr.io/fluxcd/source-controller:v1.9.0` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). ### [`v1.8.5`](https://github.com/fluxcd/source-controller/releases/tag/v1.8.5) [Compare Source](https://github.com/fluxcd/source-controller/compare/v1.8.4...v1.8.5) ##### Changelog [v1.8.5 changelog](https://github.com/fluxcd/source-controller/blob/v1.8.5/CHANGELOG.md) ##### Container images - `docker.io/fluxcd/source-controller:v1.8.5` - `ghcr.io/fluxcd/source-controller:v1.8.5` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). ### [`v1.8.4`](https://github.com/fluxcd/source-controller/releases/tag/v1.8.4) [Compare Source](https://github.com/fluxcd/source-controller/compare/v1.8.3...v1.8.4) ##### Changelog [v1.8.4 changelog](https://github.com/fluxcd/source-controller/blob/v1.8.4/CHANGELOG.md) ##### Container images - `docker.io/fluxcd/source-controller:v1.8.4` - `ghcr.io/fluxcd/source-controller:v1.8.4` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - "before 6am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-08-02 22:01:04 +00:00

chore(deps): update fluxcd minor update 14f34a6288

renovate-bot force-pushed renovate/fluxcd-minor-update from 14f34a6288 to 1a39303419

2026-08-03 12:15:49 +00:00

Compare

renovate-bot commented

2026-08-03 12:30:18 +00:00

Author

Collaborator

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

### Edited/Blocked Notification Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. ⚠️ **Warning**: custom changes will be lost.

This pull request has changes conflicting with the target branch.

apps/production/jellyfin/deployment.yaml

View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Merge commit title

chore(deps): update fluxcd minor update (#29)

Merge commit body

Reviewed-on: https://forgejo.flomielke.de/florian/homelab-gitops/pulls/29

chore(deps): update fluxcd minor update (#29)

Reviewed-on: https://forgejo.flomielke.de/florian/homelab-gitops/pulls/29

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/fluxcd-minor-update:renovate/fluxcd-minor-update

git switch renovate/fluxcd-minor-update

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff renovate/fluxcd-minor-update

git switch renovate/fluxcd-minor-update

git rebase main

git switch main

git merge --ff-only renovate/fluxcd-minor-update

git switch renovate/fluxcd-minor-update

git rebase main

git switch main

git merge --no-ff renovate/fluxcd-minor-update

git switch main

git merge --squash renovate/fluxcd-minor-update

git switch main

git merge --ff-only renovate/fluxcd-minor-update

git switch main

git merge renovate/fluxcd-minor-update

git push origin main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

florian/homelab-gitops!29

No description provided.

Rows
Columns