Skip to content

fix(deps): update module github.com/fluxcd/flux2/v2 to v2.9.5 - #118

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-fluxcd-flux2-v2-2.x
Open

fix(deps): update module github.com/fluxcd/flux2/v2 to v2.9.5#118
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-fluxcd-flux2-v2-2.x

Conversation

@renovate

@renovate renovate Bot commented Sep 5, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change OpenSSF
github.com/fluxcd/flux2/v2 require patch v2.9.4v2.9.5 OpenSSF Scorecard

Release Notes

fluxcd/flux2 (github.com/fluxcd/flux2/v2)

v2.9.5

Compare Source

Highlights

Flux v2.9.5 is a patch release that moves helm-controller and source-controller back to upstream Helm, now at v4.2.4, dropping the temporary Flux fork. It hardens the handling of kubeconfig Secrets in helm-controller and kustomize-controller, which now reject kubeconfigs referencing files on the local filesystem and require credentials and certificates to be embedded inline. It also stops kustomize-controller from leaving behind the temporary directories of a previous process that exited without running its cleanup, and fixes a crash in post-build substitution where a substring expression with a negative length, e.g. ${VAR:2:-1}, panicked instead of counting back from the end of the string like Bash does. Across all controllers and the CLI, the fluxcd/pkg dependencies have been updated, bringing Kubernetes to 1.36.4. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

  • Validate kubeconfigs from .spec.kubeConfig Secrets, rejecting local file references in certificate-authority, tokenFile, client-certificate and client-key; credentials and certificates must be embedded inline (helm-controller, kustomize-controller)
  • Purge temporary directories at startup (kustomize-controller)
  • Fix panic on negative-length substring expressions in post-build substitution (kustomize-controller, flux CLI)

Improvements:

  • Move back to upstream Helm v4.2.4, dropping the Flux fork (helm-controller, source-controller)
  • Update fluxcd/pkg dependencies, which bring Kubernetes to 1.36.4 (all controllers, flux CLI)

Components changelog

CLI changelog

Full Changelog: fluxcd/flux2@v2.9.4...v2.9.5


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot enabled auto-merge (squash) September 5, 2026 18:04
@renovate
renovate Bot requested a review from maximiliantech as a code owner September 5, 2026 18:04
@renovate

renovate Bot commented Sep 5, 2026

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 2 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=5 days

Details:

Package Change
github.com/fluxcd/pkg/kustomize v1.35.4 -> v1.35.6
k8s.io/apiextensions-apiserver v0.36.2 -> v0.36.4

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants