131.md (11068B)
1 # PR #131 chore(deps): update dependency fluxcd/flux2 to v2.8.8 2 3 - **Status:** open 4 - **Author:** @renovate[bot] 5 - **Created:** 2026-04-07T17:09:13Z 6 - **Branch:** renovate/flux-components → main 7 - **Labels:** type/patch-update 8 - **Diff:** [131.diff](./131.diff) 9 10 --- 11 12 This PR contains the following updates: 13 14 | Package | Update | Change | 15 |---|---|---| 16 | [fluxcd/flux2](https://redirect.github.com/fluxcd/flux2) | patch | `v2.8.3` → `v2.8.8` | 17 18 --- 19 20 ### Release Notes 21 22 <details> 23 <summary>fluxcd/flux2 (fluxcd/flux2)</summary> 24 25 ### [`v2.8.8`](https://redirect.github.com/fluxcd/flux2/releases/tag/v2.8.8) 26 27 [Compare Source](https://redirect.github.com/fluxcd/flux2/compare/v2.8.7...v2.8.8) 28 29 ##### Highlights 30 31 Flux v2.8.8 is a patch release that includes CVE fixes via go-git v5.19.1 (source-controller, image-automation-controller), reliability fixes in helm-controller and source-controller, the move of Helm back to upstream v4.2.0, support for GCP sovereign cloud artifact registries, and dependency updates. Users are encouraged to upgrade for the best experience. 32 33 ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://redirect.github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version. 34 35 Fixes: 36 37 - Add a configurable HTTP timeout for artifact fetching, preventing fetches that could block indefinitely and stall reconciliations (helm-controller) 38 - Fix unbounded memory growth caused by a Kubernetes client transport retry wrapper accumulating on every reconcile (helm-controller) 39 - Stop force-applying non-CRD objects placed under a chart's `crds/` directory (helm-controller) 40 - Fix the Helm test action failing to find releases with names longer than 53 characters (helm-controller) 41 - Improve path handling in the source reconcilers (source-controller) 42 - Support Helm semver build-metadata encoding in OCIRepository tags (source-controller) 43 44 Improvements: 45 46 - Update go-git to v5.19.1 which fixes [CVE-2026-45571](https://redirect.github.com/advisories/GHSA-crhj-59gh-8x96) and [CVE-2026-45570](https://redirect.github.com/advisories/GHSA-m7cr-m3pv-hgrp) (source-controller, image-automation-controller) 47 - Move Helm back to upstream v4.2.0 (source-controller, helm-controller) 48 - Add support for GCP sovereign cloud artifact registries (source-controller, image-reflector-controller) 49 - Upgrade Kubernetes to 1.36.1 (source-controller, helm-controller) 50 - Update fluxcd/pkg dependencies 51 52 ##### Components changelog 53 54 - helm-controller [v1.5.5](https://redirect.github.com/fluxcd/helm-controller/blob/v1.5.5/CHANGELOG.md) 55 - image-automation-controller [v1.1.4](https://redirect.github.com/fluxcd/image-automation-controller/blob/v1.1.4/CHANGELOG.md) 56 - image-reflector-controller [v1.1.2](https://redirect.github.com/fluxcd/image-reflector-controller/blob/v1.1.2/CHANGELOG.md) 57 - source-controller [v1.8.5](https://redirect.github.com/fluxcd/source-controller/blob/v1.8.5/CHANGELOG.md) 58 59 ##### CLI changelog 60 61 - Update toolkit components by [@​fluxcdbot](https://redirect.github.com/fluxcdbot) in [#​5904](https://redirect.github.com/fluxcd/flux2/pull/5904) 62 63 **Full Changelog**: <https://github.com/fluxcd/flux2/compare/v2.8.7...v2.8.8> 64 65 ### [`v2.8.7`](https://redirect.github.com/fluxcd/flux2/releases/tag/v2.8.7) 66 67 [Compare Source](https://redirect.github.com/fluxcd/flux2/compare/v2.8.6...v2.8.7) 68 69 ##### Highlights 70 71 Flux v2.8.7 is a patch release that includes a bug fix in kustomize-controller, a CVE fix in source-controller and image-automation-controller via go-git v5.19.0, and dependency updates. Users are encouraged to upgrade for the best experience. 72 73 ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://redirect.github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version. 74 75 Fixes: 76 77 - Fix management of objects annotated with `kustomize.toolkit.fluxcd.io/ssa: IfNotPresent` where non-namespaced resources were being deleted and recreated on each reconciliation (kustomize-controller) 78 79 Improvements: 80 81 - Update go-git to v5.19.0 which fixes [CVE-2026-45022](https://redirect.github.com/advisories/GHSA-389r-gv7p-r3rp) (source-controller, image-automation-controller) 82 - Update fluxcd/pkg dependencies (source-controller, kustomize-controller, image-automation-controller) 83 84 ##### Components changelog 85 86 - helm-controller [v1.5.4](https://redirect.github.com/fluxcd/helm-controller/blob/v1.5.4/CHANGELOG.md) 87 - image-automation-controller [v1.1.3](https://redirect.github.com/fluxcd/image-automation-controller/blob/v1.1.3/CHANGELOG.md) 88 - kustomize-controller [v1.8.5](https://redirect.github.com/fluxcd/kustomize-controller/blob/v1.8.5/CHANGELOG.md) 89 - notification-controller [v1.8.4](https://redirect.github.com/fluxcd/notification-controller/blob/v1.8.4/CHANGELOG.md) 90 - source-controller [v1.8.4](https://redirect.github.com/fluxcd/source-controller/blob/v1.8.4/CHANGELOG.md) 91 92 ##### CLI changelog 93 94 - Update toolkit components by [@​fluxcdbot](https://redirect.github.com/fluxcdbot) in [#​5891](https://redirect.github.com/fluxcd/flux2/pull/5891) 95 96 **Full Changelog**: <https://github.com/fluxcd/flux2/compare/v2.8.6...v2.8.7> 97 98 ### [`v2.8.6`](https://redirect.github.com/fluxcd/flux2/releases/tag/v2.8.6) 99 100 [Compare Source](https://redirect.github.com/fluxcd/flux2/compare/v2.8.5...v2.8.6) 101 102 ##### Highlights 103 104 Flux v2.8.6 is a patch release that includes bug fixes and improvements across helm-controller, image-automation-controller, kustomize-controller, notification-controller, and source-controller. Users are encouraged to upgrade for the best experience. 105 106 ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://redirect.github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version. 107 108 Fixes: 109 110 - Fix a post-renderer conflict between overlapping hooks and templates (helm-controller) 111 - Ignore force replace when server-side apply is enabled (helm-controller) 112 - Fix a regression where generic providers would not forward commit status events (notification-controller) 113 - Require the `audience` field on the GCR Receiver secret for tighter verification — will become mandatory in Flux v2.9 (notification-controller) 114 115 Improvements: 116 117 - Introduce the `MigrateAPIVersion` feature gate for migrating the API version of resources in managed field entries (kustomize-controller) 118 - Update go-git to v5.18.0 bringing performance improvements for Git operations (source-controller, image-automation-controller) 119 120 ##### Components changelog 121 122 - helm-controller [v1.5.4](https://redirect.github.com/fluxcd/helm-controller/blob/v1.5.4/CHANGELOG.md) 123 - image-automation-controller [v1.1.2](https://redirect.github.com/fluxcd/image-automation-controller/blob/v1.1.2/CHANGELOG.md) 124 - kustomize-controller [v1.8.4](https://redirect.github.com/fluxcd/kustomize-controller/blob/v1.8.4/CHANGELOG.md) 125 - notification-controller [v1.8.4](https://redirect.github.com/fluxcd/notification-controller/blob/v1.8.4/CHANGELOG.md) 126 - source-controller [v1.8.3](https://redirect.github.com/fluxcd/source-controller/blob/v1.8.3/CHANGELOG.md) 127 128 ##### CLI changelog 129 130 - Update toolkit components by [@​fluxcdbot](https://redirect.github.com/fluxcdbot) in [#​5857](https://redirect.github.com/fluxcd/flux2/pull/5857) 131 132 **Full Changelog**: <https://github.com/fluxcd/flux2/compare/v2.8.5...v2.8.6> 133 134 ### [`v2.8.5`](https://redirect.github.com/fluxcd/flux2/releases/tag/v2.8.5) 135 136 [Compare Source](https://redirect.github.com/fluxcd/flux2/compare/v2.8.4...v2.8.5) 137 138 ##### Highlights 139 140 Flux v2.8.5 is a patch release that includes bug fixes and improvements across kustomize-controller, source-controller, and notification-controller. Users are encouraged to upgrade for the best experience. 141 142 ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://redirect.github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version. 143 144 Fixes: 145 146 - Fix a race condition where a cancelled reconciliation could leave stale data in the cache, causing Kustomizations to get stuck (kustomize-controller) 147 - Fix Azure Blob prefix option not being passed to the storage client (source-controller) 148 149 Improvements: 150 151 - Improve error message for encrypted SSH keys without password (source-controller) 152 - Add optional `email` and `audience` fields to the GCR Receiver for tighter verification (notification-controller) 153 - Add provider manifest example for Azure Event Hub managed identity authentication (notification-controller) 154 155 ##### Components changelog 156 157 - kustomize-controller [v1.8.3](https://redirect.github.com/fluxcd/kustomize-controller/blob/v1.8.3/CHANGELOG.md) 158 - source-controller [v1.8.2](https://redirect.github.com/fluxcd/source-controller/blob/v1.8.2/CHANGELOG.md) 159 - notification-controller [v1.8.3](https://redirect.github.com/fluxcd/notification-controller/blob/v1.8.3/CHANGELOG.md) 160 161 ##### CLI changelog 162 163 - Update toolkit components by [@​fluxcdbot](https://redirect.github.com/fluxcdbot) in [#​5822](https://redirect.github.com/fluxcd/flux2/pull/5822) 164 165 **Full Changelog**: <https://github.com/fluxcd/flux2/compare/v2.8.4...v2.8.5> 166 167 ### [`v2.8.4`](https://redirect.github.com/fluxcd/flux2/releases/tag/v2.8.4) 168 169 [Compare Source](https://redirect.github.com/fluxcd/flux2/compare/v2.8.3...v2.8.4) 170 171 ##### Highlights 172 173 Flux v2.8.4 is a patch release that includes fixes for the Flux CLI. Users are encouraged to upgrade for the best experience. 174 175 ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://redirect.github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version. 176 177 Fixes: 178 179 - Fix `flux build ks` and `flux diff ks` on Windows 180 - Fix `--source` flag validation in `create kustomization` command 181 182 ##### CLI changelog 183 184 - Update fluxcd/pkg dependencies by [@​fluxcdbot](https://redirect.github.com/fluxcdbot) in [#​5796](https://redirect.github.com/fluxcd/flux2/pull/5796) 185 - \[release/v2.8.x] fix: validate --source flag in create kustomization command by [@​fluxcdbot](https://redirect.github.com/fluxcdbot) in [#​5799](https://redirect.github.com/fluxcd/flux2/pull/5799) 186 187 **Full Changelog**: <https://github.com/fluxcd/flux2/compare/v2.8.3...v2.8.4> 188 189 </details> 190 191 --- 192 193 ### Configuration 194 195 📅 **Schedule**: (UTC) 196 197 - Branch creation 198 - At any time (no schedule defined) 199 - Automerge 200 - At any time (no schedule defined) 201 202 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. 203 204 ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 205 206 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. 207 208 --- 209 210 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box 211 212 --- 213 214 This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/MTRNord/cluster). 215 <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDIuMTEiLCJ1cGRhdGVkSW5WZXIiOiI0My4yNDIuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsidHlwZS9wYXRjaC11cGRhdGUiXX0=--> 216 217