Update dependency fluxcd/flux2 to v2.8.8 (main)

Sylva Renovate botrequested to merge
renovate/main-fluxcd-flux2-2.8.x into main

This MR contains the following updates:

Package Type Update Change
fluxcd/flux2 patch v2.8.6 -> v2.8.8
fluxcd/flux2 Kustomization patch v2.8.6 -> v2.8.8

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

fluxcd/flux2 (fluxcd/flux2)

v2.8.8

Compare Source

Highlights

Flux v2.8.8 is a patch release that includes CVE fixes via go-git v5.19.1 (source-controller, image-automation-controller), reliability fixes in helm-controller and source-controller, the move of Helm back to upstream v4.2.0, support for GCP sovereign cloud artifact registries, and dependency updates. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

  • Add a configurable HTTP timeout for artifact fetching, preventing fetches that could block indefinitely and stall reconciliations (helm-controller)
  • Fix unbounded memory growth caused by a Kubernetes client transport retry wrapper accumulating on every reconcile (helm-controller)
  • Stop force-applying non-CRD objects placed under a chart's crds/ directory (helm-controller)
  • Fix the Helm test action failing to find releases with names longer than 53 characters (helm-controller)
  • Improve path handling in the source reconcilers (source-controller)
  • Support Helm semver build-metadata encoding in OCIRepository tags (source-controller)

Improvements:

  • Update go-git to v5.19.1 which fixes CVE-2026-45571 and CVE-2026-45570 (source-controller, image-automation-controller)
  • Move Helm back to upstream v4.2.0 (source-controller, helm-controller)
  • Add support for GCP sovereign cloud artifact registries (source-controller, image-reflector-controller)
  • Upgrade Kubernetes to 1.36.1 (source-controller, helm-controller)
  • Update fluxcd/pkg dependencies
Components changelog
CLI changelog

Full Changelog: https://github.com/fluxcd/flux2/compare/v2.8.7...v2.8.8

v2.8.7

Compare Source

Highlights

Flux v2.8.7 is a patch release that includes a bug fix in kustomize-controller, a CVE fix in source-controller and image-automation-controller via go-git v5.19.0, and dependency updates. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

  • Fix management of objects annotated with kustomize.toolkit.fluxcd.io/ssa: IfNotPresent where non-namespaced resources were being deleted and recreated on each reconciliation (kustomize-controller)

Improvements:

  • Update go-git to v5.19.0 which fixes CVE-2026-45022 (source-controller, image-automation-controller)
  • Update fluxcd/pkg dependencies (source-controller, kustomize-controller, image-automation-controller)
Components changelog
CLI changelog

Full Changelog: https://github.com/fluxcd/flux2/compare/v2.8.6...v2.8.7

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about these updates again.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot Sylva instance.

CI configuration couldn't be handle by MR description. A dedicated comment has been posted to control it.

If no checkbox is checked, a default pipeline will be enabled (capm3, or capo if capo label is set)

Edited by Sylva Renovate bot

Merge request reports