Update github-actions non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	minor	v6.0.1 → v6.1.0
actions/setup-dotnet	action	minor	v5.0.1 → v5.4.0
azure/login	action	patch	v2.3.0 → v2.3.1
fluxcd/flux2	action	minor	v2.7.5 → v2.9.4
github/codeql-action	action	minor	v3.31.9 → v3.37.7
mikefarah/yq	action	minor	v4.50.1 → v4.53.3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

actions/checkout (actions/checkout)

v6.1.0

Compare Source

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

actions/setup-dotnet (actions/setup-dotnet)

v5.4.0

Compare Source

What's Changed

Enhancements

• Improve global.json SDK version validation for rollForward by @​priyagupta108 in #​742
• Pin actions to commit SHAs in workflows by @​priya-kinthali in #​744
• Expand the CSC problem matcher to light up more errors on GitHub. by @​StephenCleary in #​717

Documentation

• Docs(action): Explicitly mark all optional inputs with required: false by @​kranthipoturaju in #​737

Bug Fixes

• Fix global.json creation command by @​michal2612 in #​694

Dependency Updates

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in #​746

New Contributors

• @​jasongin made their first contribution in #​746
• @​michal2612 made their first contribution in #​694
• @​kranthipoturaju made their first contribution in #​737
• @​StephenCleary made their first contribution in #​717

Full Changelog: actions/setup-dotnet@v5...v5.4.0

v5.3.0

Compare Source

What's Changed

Enhancements

• Add dotnet-version: latest support with dotnet-channel input by @​mahabaleshwars in #​730
• Support global.json's rollForward latest* variants by @​js6pak in #​538
• Improve version resolution by @​akoeplinger in #​560

Dependency Updates

• Upgrade @​actions/* and fast-xml-parser dependencies by @​Copilot in #​728
• Update install scripts to v2026.05.19 (preserve archive links) by @​MichaelSimons in #​736
• Add rollForward note in README, improve proxy health check in e2e tests and bump version to v5.3.0 by @​priyagupta108 in #​738

Bug Fixes

• Update Test Proxy job by @​priya-kinthali in #​703

New Contributors

• @​Copilot made their first contribution in #​728
• @​akoeplinger made their first contribution in #​560
• @​MichaelSimons made their first contribution in #​736
• @​js6pak made their first contribution in #​538

Full Changelog: actions/setup-dotnet@v5...v5.3.0

v5.2.0

Compare Source

What's changed

Enhancements

• Add support for workloads input by @​gowridurgad in #​693
• Add support for optional architecture input for cross-architecture .NET installs by @​priya-kinthali in #​700

Dependency Updates

• Upgrade fast-xml-parser from 4.4.1 to 5.3.6 by @​dependabot in #​671
• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in #​705

Full Changelog: actions/setup-dotnet@v5...v5.2.0

v5.1.0

Compare Source

What's Changed

Documentation

• Readme update for environment variable on self hosted linux runners by @​priya-kinthali in #​689
• Contributor icon updates by @​Falco20019 in #​604

Dependency updates

• Upgrade actions/checkout from 5 to 6 by @​dependabot in #​684
• Upgrade to latest actions packages by @​salmanmkc in #​687
• Upgrade dependencies in testproject and checkout in Readme by @​priya-kinthali in #​692

New Contributors

• @​priya-kinthali made their first contribution in #​689
• @​Falco20019 made their first contribution in #​604

Full Changelog: actions/setup-dotnet@v5...v5.1.0

azure/login (azure/login)

v2.3.1: Azure Login Action v2.3.1

Compare Source

What's Changed

• Escape single quotes in PowerShell login script inputs by @​MaddyMicrosoft in Azure#599

Full Changelog: Azure/login@v2.3.0...v2.3.1

fluxcd/flux2 (fluxcd/flux2)

v2.9.4

Compare Source

Highlights

Flux v2.9.4 is a patch release that ships various fixes to the Flux controllers, covering source-watcher tarball extraction and glob expansion limits, the refspecs accepted by ImageUpdateAutomation, the HTTP request limits of the notification-controller servers, and Helm repository index loading, OCI chart digest pinning, Bucket error handling and GCS static authentication in source-controller. On the CLI side, flux migrate -f now supports migrating repositories to Flux 2.9. Users are encouraged to upgrade for the best experience.

Note that this release contains CRD schema changes for ArtifactGenerator and ImageUpdateAutomation; both CRDs must be updated along with the controllers.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Confine tarball extraction and bound glob expansion (source-watcher)
• Disallow force-update and deletion via refspecs (image-automation-controller)
• Unify HTTP server request limits (notification-controller)
• Align Helm repository index loading with upstream Helm v4 (source-controller)
• Improve error handling in Bucket reconciliation (source-controller)
• Pin OCI chart verification by digest (source-controller)
• Limit GCS static authentication to service account keys (source-controller)
• Restrict the allow-webhooks network policy to the receiver port (flux CLI)

Improvements:

• Add support for migrating repositories to 2.9 in flux migrate -f (flux CLI)
• Update fluxcd/pkg dependencies, which align the ECR host detection with upstream (source-controller, image-reflector-controller, flux CLI)
• Update Bitbucket Cloud receiver guidance (notification-controller)

Components changelog

• source-controller v1.9.4
• source-watcher v2.2.3
• notification-controller v1.9.3
• image-reflector-controller v1.2.4
• image-automation-controller v1.2.4

CLI changelog

• [release/v2.9.x] Add support for 2.9 in migrate -f by @​fluxcdbot in #​6021
• Update fluxcd/pkg dependencies by @​fluxcdbot in #​6026
• [release/v2.9.x] fix: restrict allow-webhooks netpol to receiver port by @​fluxcdbot in #​6029
• Update toolkit components by @​fluxcdbot in #​6031

Full Changelog: fluxcd/flux2@v2.9.3...v2.9.4

v2.9.3

Compare Source

Highlights

Flux v2.9.3 is a patch release. It fixes empty lines vanishing from rendered Helm chart manifests, HelmReleases being marked as tested when their Helm test hooks never ran, and spec.images entries that set only some image fields discarding the remaining fields already declared for the same image in the kustomization.yaml. The latter affects both kustomize-controller and the flux build|diff kustomization commands. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Fix empty lines vanishing from rendered chart manifests (helm-controller)
• Fix HasBeenTested for all corner cases, where a release could be marked as tested although its Helm test hooks never ran (helm-controller)
• Fix a spec.images entry setting only some of the image fields discarding the remaining fields already declared for the same image in the kustomization.yaml at spec.path, e.g. overriding only newName produced an untagged image reference (kustomize-controller, flux CLI)

Improvements:

• Update fluxcd/pkg dependencies
• Include source-watcher in the OCI flux-manifests artifact

Components changelog

• kustomize-controller v1.9.4
• helm-controller v1.6.3

CLI changelog

• [release/v2.9.x] Include source-watcher to oci flux-manifests by @​fluxcdbot in #​5996
• Update fluxcd/pkg dependencies by @​fluxcdbot in #​6006
• Update toolkit components by @​fluxcdbot in #​6011

Full Changelog: fluxcd/flux2@v2.9.2...v2.9.3

v2.9.2

Compare Source

Highlights

Flux v2.9.2 is a patch release. The main fix addresses a regression introduced in
v2.9.1 where a Kustomization with openapi.path pointing to a URL failed to
reconcile with failed to read OpenAPI schema. This release also corrects several
CRD field descriptions that contained inaccurate or leaked content. Users are
encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Fix a regression where a Kustomization with openapi.path pointing to a URL failed to reconcile with failed to read OpenAPI schema (kustomize-controller)
• Fix the HelmChart CRD description for .status.url, which pointed users at BucketStatus.Artifact instead of HelmChartStatus.Artifact (source-controller)
• Fix the ImageRepository CRD description for .status.observedExclusionList, which referred to spec.lastScanResult instead of status.lastScanResult (image-reflector-controller)
• Fix the ImageUpdateAutomation CRD description for .status.observedSourceRevision, which had a stray Go struct declaration leaking into it (image-automation-controller)

Improvements:

• Update fluxcd/pkg dependencies

Components changelog

• source-controller v1.9.3
• kustomize-controller v1.9.3
• helm-controller v1.6.2
• notification-controller v1.9.2
• image-reflector-controller v1.2.3
• image-automation-controller v1.2.3
• source-watcher v2.2.2

CLI changelog

• Update fluxcd/pkg dependencies by @​fluxcdbot in #​5984
• Update fluxcd/pkg dependencies by @​fluxcdbot in #​5990
• Update toolkit components by @​fluxcdbot in #​5994

Full Changelog: fluxcd/flux2@v2.9.1...v2.9.2

v2.9.1

Compare Source

v2.9.0

Compare Source

Highlights

Flux v2.9.0 is a feature release. Users are encouraged to upgrade for the best experience.

For a compressive overview of new features and API changes included in this release, please refer to the Announcing Flux 2.9 GA blog post.

Overview of the new features:

• Flux CLI Plugin System with the Mirror and Schema plugins (flux plugin)
• Server-Side Apply field ignore rules for fine-grained drift control (Kustomization)
• SOPS decryption with the Age post-quantum cipher (Kustomization)
• Kubernetes Workload Identity authentication for OpenBao and Vault (Kustomization)
• Helm post-render strategies, including chart hooks support (HelmRelease)
• Literal mode for Helm values references mirroring helm --set-literal (HelmRelease)
• Allow empty kind in CEL health check expressions (Kustomization, HelmRelease)
• Git commit signing and verification with SSH keys (GitRepository, ImageUpdateAutomation)
• AWS CodeCommit authentication using Workload Identity (GitRepository)
• Custom Sigstore trusted root for keyless verification in air-gapped environments (OCIRepository)
• Path pattern directory discovery for monorepos (ArtifactGenerator)
• Secret-less, OIDC-secured webhook Receivers (Receiver)

❤️ Big thanks to all the Flux contributors that helped us with this release!

Kubernetes compatibility

This release is compatible with the following Kubernetes versions:

Kubernetes version	Minimum required
v1.34	>= 1.34.1
v1.35	>= 1.35.0
v1.36	>= 1.36.0

[!NOTE]
Note that the Flux project offers support only for the latest three minor versions of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors such as
ControlPlane that provide enterprise support for Flux.

OpenShift compatibility

Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using Flux Operator. The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage.

Upgrade procedure

⚠️ The Flux APIs image.toolkit.fluxcd.io/v1beta2 and notification.toolkit.fluxcd.io/v1beta2
have reached end-of-life and have been removed from the CRDs.

Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from older versions of Flux to v2.9.

Components changelog

• source-controller v1.9.1
• kustomize-controller v1.9.1
• notification-controller v1.9.1
• helm-controller v1.6.1
• image-reflector-controller v1.2.1
• image-automation-controller v1.2.1
• source-watcher v2.2.1

CLI changelog

• Add backport label for Flux 2.8 by @​matheuscscp in #​5732
• Remove no longer needed workaround for Flux 2.8 by @​matheuscscp in #​5733
• Update toolkit components by @​fluxcdbot in #​5740
• Add missing things to release notes template by @​matheuscscp in #​5743
• ci: add top-level permissions to upgrade-fluxcd-pkg workflow by @​gaganhr94 in #​5763
• build(deps): bump the ci group across 1 directory with 11 updates by @​dependabot[bot] in #​5764
• Update fluxcd/pkg dependencies by @​fluxcdbot in #​5766
• Update toolkit components by @​fluxcdbot in #​5769
• Add target branch name to update branch by @​matheuscscp in #​5773
• Fix/resume exit code by @​Aman-Cool in #​5701
• Mark RFC 0010, 0011 and 0012 as implemented by @​stefanprodan in #​5776
• Update toolkit components by @​fluxcdbot in #​5780
• Add --resolve-symlinks flag to build and push artifact commands by @​rohansood10 in #​5724
• fix: validate --source flag in create kustomization command by @​gma1k in #​5798
• Update toolkit components by @​fluxcdbot in #​5821
• Add --show-source to flux get ks and flux get hr by @​rafaelperoco in #​5828
• Add flux create secret receiver command by @​stefanprodan in #​5835
• fix: handle multiple symlinks to same target in build artifact by @​Iam-Karan-Suresh in #​5833
• Add --in-memory-build to flux build ks and flux diff ks by @​rycli in #​5794
• Migrate end-to-end test to latest cloud SDKs by @​stefanprodan in #​5840
• docs: Add AI Coding Assistants Guidance by @​stefanprodan in #​5841
• Add AI Agents guidance by @​stefanprodan in #​5847
• [RFC-0013] Flux CLI Plugin System by @​stefanprodan in #​5795
• Add --ignore-not-found to flux diff ks by @​rycli in #​5845
• [RFC-0013] Implement plugin system by @​stefanprodan in #​5849
• build(deps): bump github.com/go-git/go-git/v5 from 5.17.1 to 5.18.0 by @​dependabot[bot] in #​5853
• Update toolkit components by @​fluxcdbot in #​5856
• Add digest pinning support to flux plugin install by @​Iam-Karan-Suresh in #​5872
• Add --ns-follows-kube-context global flag for using the kubeconfig context namespace by @​jtyr in #​5831
• include source-watcher in install.yaml manifests by @​tmmorin in #​5881
• Update toolkit components by @​fluxcdbot in #​5890
• Update toolkit components by @​fluxcdbot in #​5903
• Update fluxcd/pkg dependencies by @​fluxcdbot in #​5907
• Validate Helm source URL schemes by @​immanuwell in #​5909
• Introduce flux trigger receiver by @​matheuscscp in #​5908
• refactor(api): migrate MakeDependsOn to shared apis/meta func by @​vecil in #​5912
• Update to Kubernetes 1.36 and Go 1.26 by @​stefanprodan in #​5924
• build(deps): bump the ci group across 1 directory with 19 updates by @​dependabot[bot] in #​5925
• Run conformance tests for Kubernetes 1.36 by @​stefanprodan in #​5926
• Add support for AWS CodeCommit to flux bootstrap git by @​taraspos in #​5868
• Validate plugin binary path by @​stefanprodan in #​5927
• Update fluxcd/pkg dependencies by @​fluxcdbot in #​5928
• fix: preserve invalid metadata.labels in flux build ks by @​raffis in #​5906
• build: target host arch for local builds/envtest by @​stealthybox in #​5932
• build(deps): bump the ci group with 6 updates by @​dependabot[bot] in #​5938
• Support specifing sparseCheckout in flux bootstrap by @​piny940 in #​5918
• Update toolkit components by @​fluxcdbot in #​5944
• Honor ks.spec.postBuild.substituteStrategy by @​matheuscscp in #​5945
• Add DriftIgnoreRules support to flux diff kustomization by @​dipti-pai in #​5923
• Allow signing commits using SSH key by @​hiddeco in #​5920
• Update toolkit components by @​fluxcdbot in #​5950
• Update fluxcd/pkg dependencies by @​fluxcdbot in #​5937
• cmd: support type!=status in get --status-selector by @​3uzbcqje in #​5952
• Fix flux get all --status-selector for empty results and notification resources by @​matheuscscp in #​5954
• Upgrade go-git-providers to v0.27.0 by @​matheuscscp in #​5956
• Fix using Receiver adapter for ArtifactGenerator by @​matheuscscp in #​5957
• feat: Install Plugins alongside Flux setup in gh actions by @​gat786 in #​5955
• Update fluxcd/pkg dependencies by @​fluxcdbot in #​5960
• Add CLI support for OCIRepository.spec.layerSelector in flux create source oci by @​dme86 in #​5892
• Update toolkit components by @​fluxcdbot in #​5963

New Contributors

• @​gaganhr94 made their first contribution in #​5763
• @​rohansood10 made their first contribution in #​5724
• @​gma1k made their first contribution in #​5798
• @​rafaelperoco made their first contribution in #​5828
• @​Iam-Karan-Suresh made their first contribution in #​5833
• @​rycli made their first contribution in #​5794
• @​jtyr made their first contribution in #​5831
• @​tmmorin made their first contribution in #​5881
• @​immanuwell made their first contribution in #​5909
• @​vecil made their first contribution in #​5912
• @​taraspos made their first contribution in #​5868
• @​piny940 made their first contribution in #​5918
• @​3uzbcqje made their first contribution in #​5952
• @​gat786 made their first contribution in #​5955
• @​dme86 made their first contribution in #​5892

Full Changelog: fluxcd/flux2@v2.8.0...v2.9.0

v2.8.8

Compare Source

Highlights

Flux v2.8.8 is a patch release that includes CVE fixes via go-git v5.19.1 (source-controller, image-automation-controller), reliability fixes in helm-controller and source-controller, the move of Helm back to upstream v4.2.0, support for GCP sovereign cloud artifact registries, and dependency updates. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Add a configurable HTTP timeout for artifact fetching, preventing fetches that could block indefinitely and stall reconciliations (helm-controller)
• Fix unbounded memory growth caused by a Kubernetes client transport retry wrapper accumulating on every reconcile (helm-controller)
• Stop force-applying non-CRD objects placed under a chart's crds/ directory (helm-controller)
• Fix the Helm test action failing to find releases with names longer than 53 characters (helm-controller)
• Improve path handling in the source reconcilers (source-controller)
• Support Helm semver build-metadata encoding in OCIRepository tags (source-controller)

Improvements:

• Update go-git to v5.19.1 which fixes CVE-2026-45571 and CVE-2026-45570 (source-controller, image-automation-controller)
• Move Helm back to upstream v4.2.0 (source-controller, helm-controller)
• Add support for GCP sovereign cloud artifact registries (source-controller, image-reflector-controller)
• Upgrade Kubernetes to 1.36.1 (source-controller, helm-controller)
• Update fluxcd/pkg dependencies

Components changelog

• helm-controller v1.5.5
• image-automation-controller v1.1.4
• image-reflector-controller v1.1.2
• source-controller v1.8.5

CLI changelog

• Update toolkit components by @​fluxcdbot in #​5904

Full Changelog: fluxcd/flux2@v2.8.7...v2.8.8

v2.8.7

Compare Source

Highlights

Flux v2.8.7 is a patch release that includes a bug fix in kustomize-controller, a CVE fix in source-controller and image-automation-controller via go-git v5.19.0, and dependency updates. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Fix management of objects annotated with kustomize.toolkit.fluxcd.io/ssa: IfNotPresent where non-namespaced resources were being deleted and recreated on each reconciliation (kustomize-controller)

Improvements:

• Update go-git to v5.19.0 which fixes CVE-2026-45022 (source-controller, image-automation-controller)
• Update fluxcd/pkg dependencies (source-controller, kustomize-controller, image-automation-controller)

Components changelog

• helm-controller v1.5.4
• image-automation-controller v1.1.3
• kustomize-controller v1.8.5
• notification-controller v1.8.4
• source-controller v1.8.4

CLI changelog

• Update toolkit components by @​fluxcdbot in #​5891

Full Changelog: fluxcd/flux2@v2.8.6...v2.8.7

v2.8.6

Compare Source

Highlights

Flux v2.8.6 is a patch release that includes bug fixes and improvements across helm-controller, image-automation-controller, kustomize-controller, notification-controller, and source-controller. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Fix a post-renderer conflict between overlapping hooks and templates (helm-controller)
• Ignore force replace when server-side apply is enabled (helm-controller)
• Fix a regression where generic providers would not forward commit status events (notification-controller)
• Require the audience field on the GCR Receiver secret for tighter verification — will become mandatory in Flux v2.9 (notification-controller)

Improvements:

• Introduce the MigrateAPIVersion feature gate for migrating the API version of resources in managed field entries (kustomize-controller)
• Update go-git to v5.18.0 bringing performance improvements for Git operations (source-controller, image-automation-controller)

Components changelog

• helm-controller v1.5.4
• image-automation-controller v1.1.2
• kustomize-controller v1.8.4
• notification-controller v1.8.4
• source-controller v1.8.3

CLI changelog

• Update toolkit components by @​fluxcdbot in #​5857

Full Changelog: fluxcd/flux2@v2.8.5...v2.8.6

v2.8.5

Compare Source

Highlights

Flux v2.8.5 is a patch release that includes bug fixes and improvements across kustomize-controller, source-controller, and notification-controller. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Fix a race condition where a cancelled reconciliation could leave stale data in the cache, causing Kustomizations to get stuck (kustomize-controller)
• Fix Azure Blob prefix option not being passed to the storage client (source-controller)

Improvements:

• Improve error message for encrypted SSH keys without password (source-controller)
• Add optional email and audience fields to the GCR Receiver for tighter verification (notification-controller)
• Add provider manifest example for Azure Event Hub managed identity authentication (notification-controller)

Components changelog

• kustomize-controller v1.8.3
• source-controller v1.8.2
• notification-controller v1.8.3

CLI changelog

• Update toolkit components by @​fluxcdbot in #​5822

Full Changelog: fluxcd/flux2@v2.8.4...v2.8.5

v2.8.4

Compare Source

Highlights

Flux v2.8.4 is a patch release that includes fixes for the Flux CLI. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Fix flux build ks and flux diff ks on Windows
• Fix --source flag validation in create kustomization command

CLI changelog

• Update fluxcd/pkg dependencies by @​fluxcdbot in #​5796
• [release/v2.8.x] fix: validate --source flag in create kustomization command by @​fluxcdbot in #​5799

Full Changelog: fluxcd/flux2@v2.8.3...v2.8.4

v2.8.3

Compare Source

Highlights

Flux v2.8.3 is a patch release that fixes a regression in helm-controller. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Fix templating errors for charts that include --- in the content, e.g. YAML separators, embedded scripts, CAs inside ConfigMaps (helm-controller)

Components changelog

• helm-controller v1.5.3

CLI changelog

• [release/v2.8.x] Add target branch name to update branch by @​fluxcdbot in #​5774
• Update toolkit components by @​fluxcdbot in #​5779

Full Changelog: fluxcd/flux2@v2.8.2...v2.8.3

v2.8.2

Compare Source

Highlights

Flux v2.8.2 is a patch release that comes with various fixes. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Fix enqueuing new reconciliation requests for events on source Flux objects when they are already reconciling the revision present in the watch event (kustomize-controller, helm-controller)
• Fix the Go templates bug of YAML separator --- getting concatenated to apiVersion: by updating to Helm 4.1.3 (helm-controller)
• Fix canceled HelmReleases getting stuck when they don't have a retry strategy configured by introducing a new feature gate DefaultToRetryOnFailure that improves the experience when the CancelHealthCheckOnNewRevision is enabled (helm-controller)
• Fix the auth scope for Azure Container Registry to use the ACR-specific scope (source-controller, image-reflector-controller)
• Fix potential Denial of Service (DoS) during TLS handshakes (CVE-2026-27138) by building all controllers with Go 1.26.1

Components changelog

• source-controller v1.8.1
• kustomize-controller v1.8.2
• notification-controller v1.8.2
• helm-controller v1.5.2
• image-reflector-controller v1.1.1
• image-automation-controller v1.1.1
• source-watcher v2.1.1

CLI changelog

• [release/v2.8.x] build(deps): bump the ci group across 1 directory with 11 updates by @​fluxcdbot in #​5765
• Update fluxcd/pkg dependencies by @​fluxcdbot in #​5767
• Update toolkit components by @​matheuscscp in #​5770
• Update fluxcd/pkg dependencies by @​fluxcdbot in #​5771

Full Changelog: fluxcd/flux2@v2.8.1...v2.8.2

v2.8.1

Compare Source

Highlights

Flux v2.8.1 is a patch release that comes with various fixes. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Fix Git commit status events being dropped for Kustomizations (notification-controller)
• Fix health check for StatefulSets when the Pods are Pending/Unschedulable during rollout (helm-controller, kustomize-controller)

Components changelog

• kustomize-controller v1.8.1
• notification-controller v1.8.1
• helm-controller v1.5.1

CLI changelog

• [release/v2.8.x] Remove no longer needed workaround for Flux 2.8 by @​fluxcdbot in #​5735
• Update fluxcd/pkg dependencies by @​fluxcdbot in #​5739
• [release/v2.8.x] Update toolkit components by @​fluxcdbot in #​5741

Full Changelog: fluxcd/flux2@v2.8.0...v2.8.1

v2.8.0

Compare Source

Highlights

Flux v2.8.0 is a feature release. Users are encouraged to upgrade for the best experience.

For a compressive overview of new features and API changes included in this release, please refer to the Announcing Flux 2.8 GA blog post.

Overview of the new features:

• Helm v4 support, including server-side apply and kstatus-based health checking (HelmRelease)
• Readiness evaluation of Helm-managed objects with CEL expressions (HelmRelease)
• Improved observability of Helm releases with inventory tracking in .status.inventory (HelmRelease)
• Reduced the mean time to recovery of Flux-managed applications via CancelHealthCheckOnNewRevision feature gate (Kustomization, HelmRelease)
• Support for commenting on Pull Requests directly from Flux notifications (Provider)
• Custom SSA apply stages for ordering resource application in kustomize-controller (Kustomization)
• Automatic GitHub App installation ID lookup from the repository owner (GitRepository, ImageUpdateAutomation, Provider)
• Support for Cosign v3 for verifying OCI artifacts and container images (OCIRepository)
• ArtifactGenerator support for extracting and modifying Helm charts (ArtifactGenerator)
• Bypass cache when fetching source objects via DirectSourceFetch feature gate (Kustomization, HelmRelease, ArtifactGenerator)

❤️ Big thanks to all the Flux contributors that helped us with this release!

Kubernetes compatibility

This release is compatible with the following Kubernetes versions:

Kubernetes version	Minimum required
v1.33	>= 1.32.0
v1.34	>= 1.34.1
v1.35	>= 1.35.0

[!NOTE]
Note that the Flux project offers support only for the latest three minor versions of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors such as
ControlPlane that provide enterprise support for Flux.

OpenShift compatibility

Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using Flux Operator. The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage.

Upgrade procedure

⚠️ The Flux APIs v1beta2 and v2beta2 (deprecated in 2024) have reached end-of-life and have been removed from the CRDs.

Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from older versions of Flux to v2.8.

Components changelog

• source-controller v1.8.0
• kustomize-controller v1.8.0
• notification-controller v1.8.0
• helm-controller v1.5.0
• image-reflector-controller v1.1.0
• image-automation-controller v1.1.0
• source-watcher v2.1.0

CLI changelog

• ci: Set GITHUB_TOKEN in the release-flux-manifests workflow by @​stefanprodan in #​5547
• Add backport label for Flux 2.7 by @​matheuscscp in #​5550
• build(deps): bump the ci group across 1 directory with 3 updates by @​dependabot[bot] in #​5548
• Fix flux push artifact not working with --provider by @​matheuscscp in #​5551
• Extend flux migrate to work with local files by @​matheuscscp in #​5554
• Improve flux migrate for live cluster migrations by @​stefanprodan in #​5558
• Fix flux migrate -f command to work with comments by @​matheuscscp in #​5560
• Add source-watcher to docs by [@&#8203

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Oslo)

• Branch creation
  • "before 07:00 on Thursday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.