131.json (11521B)
1 { 2 "number": 131, 3 "title": "chore(deps): update dependency fluxcd/flux2 to v2.8.8", 4 "state": "open", 5 "diff_file": "131.diff", 6 "author": "renovate[bot]", 7 "created_at": "2026-04-07T17:09:13Z", 8 "closed_at": null, 9 "merged_at": null, 10 "base_ref": "main", 11 "head_ref": "renovate/flux-components", 12 "labels": [ 13 "type/patch-update" 14 ], 15 "assignees": [], 16 "requested_reviewers": [], 17 "body": "This PR contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n| [fluxcd/flux2](https://redirect.github.com/fluxcd/flux2) | patch | `v2.8.3` \u2192 `v2.8.8` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>fluxcd/flux2 (fluxcd/flux2)</summary>\n\n### [`v2.8.8`](https://redirect.github.com/fluxcd/flux2/releases/tag/v2.8.8)\n\n[Compare Source](https://redirect.github.com/fluxcd/flux2/compare/v2.8.7...v2.8.8)\n\n##### Highlights\n\nFlux v2.8.8 is a patch release that includes CVE fixes via go-git v5.19.1 (source-controller, image-automation-controller), reliability fixes in helm-controller and source-controller, the move of Helm back to upstream v4.2.0, support for GCP sovereign cloud artifact registries, and dependency updates. Users are encouraged to upgrade for the best experience.\n\n\u2139\ufe0f Please follow the [Upgrade Procedure for Flux v2.7+](https://redirect.github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version.\n\nFixes:\n\n- Add a configurable HTTP timeout for artifact fetching, preventing fetches that could block indefinitely and stall reconciliations (helm-controller)\n- Fix unbounded memory growth caused by a Kubernetes client transport retry wrapper accumulating on every reconcile (helm-controller)\n- Stop force-applying non-CRD objects placed under a chart's `crds/` directory (helm-controller)\n- Fix the Helm test action failing to find releases with names longer than 53 characters (helm-controller)\n- Improve path handling in the source reconcilers (source-controller)\n- Support Helm semver build-metadata encoding in OCIRepository tags (source-controller)\n\nImprovements:\n\n- Update go-git to v5.19.1 which fixes [CVE-2026-45571](https://redirect.github.com/advisories/GHSA-crhj-59gh-8x96) and [CVE-2026-45570](https://redirect.github.com/advisories/GHSA-m7cr-m3pv-hgrp) (source-controller, image-automation-controller)\n- Move Helm back to upstream v4.2.0 (source-controller, helm-controller)\n- Add support for GCP sovereign cloud artifact registries (source-controller, image-reflector-controller)\n- Upgrade Kubernetes to 1.36.1 (source-controller, helm-controller)\n- Update fluxcd/pkg dependencies\n\n##### Components changelog\n\n- helm-controller [v1.5.5](https://redirect.github.com/fluxcd/helm-controller/blob/v1.5.5/CHANGELOG.md)\n- image-automation-controller [v1.1.4](https://redirect.github.com/fluxcd/image-automation-controller/blob/v1.1.4/CHANGELOG.md)\n- image-reflector-controller [v1.1.2](https://redirect.github.com/fluxcd/image-reflector-controller/blob/v1.1.2/CHANGELOG.md)\n- source-controller [v1.8.5](https://redirect.github.com/fluxcd/source-controller/blob/v1.8.5/CHANGELOG.md)\n\n##### CLI changelog\n\n- Update toolkit components by [@​fluxcdbot](https://redirect.github.com/fluxcdbot) in [#​5904](https://redirect.github.com/fluxcd/flux2/pull/5904)\n\n**Full Changelog**: <https://github.com/fluxcd/flux2/compare/v2.8.7...v2.8.8>\n\n### [`v2.8.7`](https://redirect.github.com/fluxcd/flux2/releases/tag/v2.8.7)\n\n[Compare Source](https://redirect.github.com/fluxcd/flux2/compare/v2.8.6...v2.8.7)\n\n##### Highlights\n\nFlux v2.8.7 is a patch release that includes a bug fix in kustomize-controller, a CVE fix in source-controller and image-automation-controller via go-git v5.19.0, and dependency updates. Users are encouraged to upgrade for the best experience.\n\n\u2139\ufe0f Please follow the [Upgrade Procedure for Flux v2.7+](https://redirect.github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version.\n\nFixes:\n\n- Fix management of objects annotated with `kustomize.toolkit.fluxcd.io/ssa: IfNotPresent` where non-namespaced resources were being deleted and recreated on each reconciliation (kustomize-controller)\n\nImprovements:\n\n- Update go-git to v5.19.0 which fixes [CVE-2026-45022](https://redirect.github.com/advisories/GHSA-389r-gv7p-r3rp) (source-controller, image-automation-controller)\n- Update fluxcd/pkg dependencies (source-controller, kustomize-controller, image-automation-controller)\n\n##### Components changelog\n\n- helm-controller [v1.5.4](https://redirect.github.com/fluxcd/helm-controller/blob/v1.5.4/CHANGELOG.md)\n- image-automation-controller [v1.1.3](https://redirect.github.com/fluxcd/image-automation-controller/blob/v1.1.3/CHANGELOG.md)\n- kustomize-controller [v1.8.5](https://redirect.github.com/fluxcd/kustomize-controller/blob/v1.8.5/CHANGELOG.md)\n- notification-controller [v1.8.4](https://redirect.github.com/fluxcd/notification-controller/blob/v1.8.4/CHANGELOG.md)\n- source-controller [v1.8.4](https://redirect.github.com/fluxcd/source-controller/blob/v1.8.4/CHANGELOG.md)\n\n##### CLI changelog\n\n- Update toolkit components by [@​fluxcdbot](https://redirect.github.com/fluxcdbot) in [#​5891](https://redirect.github.com/fluxcd/flux2/pull/5891)\n\n**Full Changelog**: <https://github.com/fluxcd/flux2/compare/v2.8.6...v2.8.7>\n\n### [`v2.8.6`](https://redirect.github.com/fluxcd/flux2/releases/tag/v2.8.6)\n\n[Compare Source](https://redirect.github.com/fluxcd/flux2/compare/v2.8.5...v2.8.6)\n\n##### Highlights\n\nFlux v2.8.6 is a patch release that includes bug fixes and improvements across helm-controller, image-automation-controller, kustomize-controller, notification-controller, and source-controller. Users are encouraged to upgrade for the best experience.\n\n\u2139\ufe0f Please follow the [Upgrade Procedure for Flux v2.7+](https://redirect.github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version.\n\nFixes:\n\n- Fix a post-renderer conflict between overlapping hooks and templates (helm-controller)\n- Ignore force replace when server-side apply is enabled (helm-controller)\n- Fix a regression where generic providers would not forward commit status events (notification-controller)\n- Require the `audience` field on the GCR Receiver secret for tighter verification \u2014 will become mandatory in Flux v2.9 (notification-controller)\n\nImprovements:\n\n- Introduce the `MigrateAPIVersion` feature gate for migrating the API version of resources in managed field entries (kustomize-controller)\n- Update go-git to v5.18.0 bringing performance improvements for Git operations (source-controller, image-automation-controller)\n\n##### Components changelog\n\n- helm-controller [v1.5.4](https://redirect.github.com/fluxcd/helm-controller/blob/v1.5.4/CHANGELOG.md)\n- image-automation-controller [v1.1.2](https://redirect.github.com/fluxcd/image-automation-controller/blob/v1.1.2/CHANGELOG.md)\n- kustomize-controller [v1.8.4](https://redirect.github.com/fluxcd/kustomize-controller/blob/v1.8.4/CHANGELOG.md)\n- notification-controller [v1.8.4](https://redirect.github.com/fluxcd/notification-controller/blob/v1.8.4/CHANGELOG.md)\n- source-controller [v1.8.3](https://redirect.github.com/fluxcd/source-controller/blob/v1.8.3/CHANGELOG.md)\n\n##### CLI changelog\n\n- Update toolkit components by [@​fluxcdbot](https://redirect.github.com/fluxcdbot) in [#​5857](https://redirect.github.com/fluxcd/flux2/pull/5857)\n\n**Full Changelog**: <https://github.com/fluxcd/flux2/compare/v2.8.5...v2.8.6>\n\n### [`v2.8.5`](https://redirect.github.com/fluxcd/flux2/releases/tag/v2.8.5)\n\n[Compare Source](https://redirect.github.com/fluxcd/flux2/compare/v2.8.4...v2.8.5)\n\n##### Highlights\n\nFlux v2.8.5 is a patch release that includes bug fixes and improvements across kustomize-controller, source-controller, and notification-controller. Users are encouraged to upgrade for the best experience.\n\n\u2139\ufe0f Please follow the [Upgrade Procedure for Flux v2.7+](https://redirect.github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version.\n\nFixes:\n\n- Fix a race condition where a cancelled reconciliation could leave stale data in the cache, causing Kustomizations to get stuck (kustomize-controller)\n- Fix Azure Blob prefix option not being passed to the storage client (source-controller)\n\nImprovements:\n\n- Improve error message for encrypted SSH keys without password (source-controller)\n- Add optional `email` and `audience` fields to the GCR Receiver for tighter verification (notification-controller)\n- Add provider manifest example for Azure Event Hub managed identity authentication (notification-controller)\n\n##### Components changelog\n\n- kustomize-controller [v1.8.3](https://redirect.github.com/fluxcd/kustomize-controller/blob/v1.8.3/CHANGELOG.md)\n- source-controller [v1.8.2](https://redirect.github.com/fluxcd/source-controller/blob/v1.8.2/CHANGELOG.md)\n- notification-controller [v1.8.3](https://redirect.github.com/fluxcd/notification-controller/blob/v1.8.3/CHANGELOG.md)\n\n##### CLI changelog\n\n- Update toolkit components by [@​fluxcdbot](https://redirect.github.com/fluxcdbot) in [#​5822](https://redirect.github.com/fluxcd/flux2/pull/5822)\n\n**Full Changelog**: <https://github.com/fluxcd/flux2/compare/v2.8.4...v2.8.5>\n\n### [`v2.8.4`](https://redirect.github.com/fluxcd/flux2/releases/tag/v2.8.4)\n\n[Compare Source](https://redirect.github.com/fluxcd/flux2/compare/v2.8.3...v2.8.4)\n\n##### Highlights\n\nFlux v2.8.4 is a patch release that includes fixes for the Flux CLI. Users are encouraged to upgrade for the best experience.\n\n\u2139\ufe0f Please follow the [Upgrade Procedure for Flux v2.7+](https://redirect.github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version.\n\nFixes:\n\n- Fix `flux build ks` and `flux diff ks` on Windows\n- Fix `--source` flag validation in `create kustomization` command\n\n##### CLI changelog\n\n- Update fluxcd/pkg dependencies by [@​fluxcdbot](https://redirect.github.com/fluxcdbot) in [#​5796](https://redirect.github.com/fluxcd/flux2/pull/5796)\n- \\[release/v2.8.x] fix: validate --source flag in create kustomization command by [@​fluxcdbot](https://redirect.github.com/fluxcdbot) in [#​5799](https://redirect.github.com/fluxcd/flux2/pull/5799)\n\n**Full Changelog**: <https://github.com/fluxcd/flux2/compare/v2.8.3...v2.8.4>\n\n</details>\n\n---\n\n### Configuration\n\n\ud83d\udcc5 **Schedule**: (UTC)\n\n- Branch creation\n - At any time (no schedule defined)\n- Automerge\n - At any time (no schedule defined)\n\n\ud83d\udea6 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.\n\n\u267b **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.\n\n\ud83d\udd15 **Ignore**: Close this PR and you won't be reminded about this update again.\n\n---\n\n - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/MTRNord/cluster).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDIuMTEiLCJ1cGRhdGVkSW5WZXIiOiI0My4yNDIuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsidHlwZS9wYXRjaC11cGRhdGUiXX0=-->\n", 18 "comments": [], 19 "review_comments": [] 20 }