chore(deps): bump the go group with 9 updates by dependabot[bot] · Pull Request #283 · open-component-model/ocm-e2e-framework

dependabot · 2026-09-06T06:23:10Z

Bumps the go group with 9 updates:

Package	From	To
github.com/fluxcd/cli-utils	`1.2.2`	`1.2.3`
github.com/fluxcd/flux2/v2	`2.9.4`	`2.9.5`
github.com/fluxcd/helm-controller/api	`1.6.3`	`1.6.4`
github.com/fluxcd/image-automation-controller/api	`1.2.4`	`1.2.5`
github.com/fluxcd/image-reflector-controller/api	`1.2.4`	`1.2.5`
github.com/fluxcd/kustomize-controller/api	`1.9.4`	`1.9.5`
github.com/fluxcd/notification-controller/api	`1.9.3`	`1.9.4`
github.com/fluxcd/pkg/runtime	`0.111.0`	`0.112.0`
github.com/fluxcd/source-controller/api	`1.9.4`	`1.9.5`

Updates github.com/fluxcd/cli-utils from 1.2.2 to 1.2.3

Release notes

Sourced from github.com/fluxcd/cli-utils's releases.

v1.2.3

What's Changed

Upgrade to k8s 1.36.4 by @matheuscscp in fluxcd/cli-utils#39

Full Changelog: fluxcd/cli-utils@v1.2.2...v1.2.3

Commits

8155c12 Merge pull request #39 from fluxcd/upgrade-k8s-1.36
2522108 Upgrade to k8s 1.36.4
See full diff in compare view

Updates github.com/fluxcd/flux2/v2 from 2.9.4 to 2.9.5

Release notes

Sourced from github.com/fluxcd/flux2/v2's releases.

v2.9.5

Highlights

Flux v2.9.5 is a patch release that moves helm-controller and source-controller back to upstream Helm, now at v4.2.4, dropping the temporary Flux fork. It hardens the handling of kubeconfig Secrets in helm-controller and kustomize-controller, which now reject kubeconfigs referencing files on the local filesystem and require credentials and certificates to be embedded inline. It also stops kustomize-controller from leaving behind the temporary directories of a previous process that exited without running its cleanup, and fixes a crash in post-build substitution where a substring expression with a negative length, e.g. ${VAR:2:-1}, panicked instead of counting back from the end of the string like Bash does. Across all controllers and the CLI, the fluxcd/pkg dependencies have been updated, bringing Kubernetes to 1.36.4. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

Validate kubeconfigs from .spec.kubeConfig Secrets, rejecting local file references in certificate-authority, tokenFile, client-certificate and client-key; credentials and certificates must be embedded inline (helm-controller, kustomize-controller)

Purge temporary directories at startup (kustomize-controller)

Fix panic on negative-length substring expressions in post-build substitution (kustomize-controller, flux CLI)

Improvements:

Move back to upstream Helm v4.2.4, dropping the Flux fork (helm-controller, source-controller)

Update fluxcd/pkg dependencies, which bring Kubernetes to 1.36.4 (all controllers, flux CLI)

Components changelog

source-controller v1.9.5

source-watcher v2.2.4

kustomize-controller v1.9.5

helm-controller v1.6.4

notification-controller v1.9.4

image-reflector-controller v1.2.5

image-automation-controller v1.2.5

CLI changelog

Update fluxcd/pkg dependencies by @fluxcdbot in fluxcd/flux2#6046

Update fluxcd/pkg dependencies by @fluxcdbot in fluxcd/flux2#6048

Update toolkit components by @fluxcdbot in fluxcd/flux2#6049

Full Changelog: fluxcd/flux2@v2.9.4...v2.9.5

Commits

dd233c4 Merge pull request #6049 from fluxcd/update-components-release/v2.9.x
4d44125 Update toolkit components
17374db Merge pull request #6048 from fluxcd/update-pkg-deps/release/v2.9.x
370b47b Update fluxcd/pkg dependencies
58e047b Merge pull request #6046 from fluxcd/update-pkg-deps/release/v2.9.x
f384418 Update fluxcd/pkg dependencies
See full diff in compare view

Updates github.com/fluxcd/helm-controller/api from 1.6.3 to 1.6.4

Release notes

Sourced from github.com/fluxcd/helm-controller/api's releases.

v1.6.4

Changelog

v1.6.4 changelog

Container images

docker.io/fluxcd/helm-controller:v1.6.4

ghcr.io/fluxcd/helm-controller:v1.6.4

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/helm-controller/api's changelog.

1.6.4

Release date: 2026-08-31

This patch release hardens the handling of HelmRelease kubeconfig Secrets: kubeconfigs referencing local files are now rejected, credentials and certificates must be embedded inline. It also moves the controller back to upstream Helm, now at v4.2.4, dropping the temporary Flux fork, and updates Kubernetes to 1.36.4.

Fixes:

Validate HelmRelease kubeconfigs #1572

Improvements:

Move v1.6 back to upstream helm #1565

Update fluxcd/pkg dependencies #1567 #1568

Commits

561379c Merge pull request #1573 from fluxcd/release-v1.6.4
70d5012 Release v1.6.4
82439e2 Add changelog entry for v1.6.4
8ddb4fc Validate HelmRelease kubeconfigs
01b3ef3 Merge pull request #1568 from fluxcd/update-pkg-deps/release/v1.6.x
7b0f616 Update fluxcd/pkg dependencies
91841e2 Merge pull request #1567 from fluxcd/update-pkg-deps/release/v1.6.x
7eac2c0 Update fluxcd/pkg dependencies
4293c5d Merge pull request #1565 from fluxcd/back-to-upstream
9cfd993 Move v1.6 back to upstream helm
See full diff in compare view

Updates github.com/fluxcd/image-automation-controller/api from 1.2.4 to 1.2.5

Release notes

Sourced from github.com/fluxcd/image-automation-controller/api's releases.

v1.2.5

Changelog

v1.2.5 changelog

Container images

docker.io/fluxcd/image-automation-controller:v1.2.5

ghcr.io/fluxcd/image-automation-controller:v1.2.5

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/image-automation-controller/api's changelog.

1.2.5

Release date: 2026-08-31

This patch release updates the fluxcd/pkg dependencies, which bring Kubernetes to 1.36.4.

Improvements:

Update fluxcd/pkg dependencies #1086 #1087

Commits

119f65d Merge pull request #1088 from fluxcd/release-v1.2.5
7aa86ba Release v1.2.5
79035eb Add changelog entry for v1.2.5
ed47b10 Merge pull request #1087 from fluxcd/update-pkg-deps/release/v1.2.x
ed19c2e Update fluxcd/pkg dependencies
b172d04 Merge pull request #1086 from fluxcd/update-pkg-deps/release/v1.2.x
563f051 Update fluxcd/pkg dependencies
See full diff in compare view

Updates github.com/fluxcd/image-reflector-controller/api from 1.2.4 to 1.2.5

Release notes

Sourced from github.com/fluxcd/image-reflector-controller/api's releases.

v1.2.5

Changelog

v1.2.5 changelog

Container images

docker.io/fluxcd/image-reflector-controller:v1.2.5

ghcr.io/fluxcd/image-reflector-controller:v1.2.5

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/image-reflector-controller/api's changelog.

1.2.5

Release date: 2026-08-31

This patch release updates the fluxcd/pkg dependencies, which bring Kubernetes to 1.36.4.

Improvements:

Update fluxcd/pkg dependencies #934 #935

Commits

d245eae Merge pull request #936 from fluxcd/release-v1.2.5
da1f5a3 Release v1.2.5
916f92c Add changelog entry for v1.2.5
6d112fd Merge pull request #935 from fluxcd/update-pkg-deps/release/v1.2.x
9297017 Update fluxcd/pkg dependencies
0fb00a3 Merge pull request #934 from fluxcd/update-pkg-deps/release/v1.2.x
868a389 Update fluxcd/pkg dependencies
See full diff in compare view

Updates github.com/fluxcd/kustomize-controller/api from 1.9.4 to 1.9.5

Release notes

Sourced from github.com/fluxcd/kustomize-controller/api's releases.

v1.9.5

Changelog

v1.9.5 changelog

Container images

docker.io/fluxcd/kustomize-controller:v1.9.5

ghcr.io/fluxcd/kustomize-controller:v1.9.5

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/kustomize-controller/api's changelog.

1.9.5

Release date: 2026-08-31

This patch release stops the controller from leaving behind the temporary directories of a previous process that exited without running its cleanup, and fixes a crash in post-build substitution: a substring expression with a negative length, e.g. ${VAR:2:-1}, panicked instead of counting back from the end of the string like Bash does. In addition, the kubeconfigs read from .spec.kubeConfig Secrets are now required to be self-contained: credentials and certificates must be embedded inline (token, client-certificate-data, client-key-data, certificate-authority-data), and entries referencing files on the local filesystem are rejected. The fluxcd/pkg updates also bring Kubernetes to 1.36.4.

Fixes:

fix: purge tmp dirs at startup #1730

Update fluxcd/pkg dependencies #1727 #1728

Commits

d5d5d2b Merge pull request #1732 from fluxcd/release-v1.9.5
cf08b62 Release v1.9.5
f5c2bce Add changelog entry for v1.9.5
0a95b77 Merge pull request #1730 from fluxcd/backport-1729-to-release/v1.9.x
49e8acd fix: purge tmp dirs at startup
d537949 Merge pull request #1728 from fluxcd/update-pkg-deps/release/v1.9.x
e0b4d11 Update fluxcd/pkg dependencies
cbe2504 Merge pull request #1727 from fluxcd/update-pkg-deps/release/v1.9.x
ab3bbb7 Update fluxcd/pkg dependencies
See full diff in compare view

Updates github.com/fluxcd/notification-controller/api from 1.9.3 to 1.9.4

Release notes

Sourced from github.com/fluxcd/notification-controller/api's releases.

v1.9.4

Changelog

v1.9.4 changelog

Container images

docker.io/fluxcd/notification-controller:v1.9.4

ghcr.io/fluxcd/notification-controller:v1.9.4

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/notification-controller/api's changelog.

1.9.4

Release date: 2026-08-31

This patch release updates the fluxcd/pkg dependencies, which bring Kubernetes to 1.36.4.

Improvements:

Update fluxcd/pkg dependencies #1374 #1375

Commits

a1dff35 Merge pull request #1376 from fluxcd/release-v1.9.4
1b448fc Release v1.9.4
5a40ce1 Add changelog entry for v1.9.4
e3b041a Merge pull request #1375 from fluxcd/update-pkg-deps/release/v1.9.x
a2af556 Update fluxcd/pkg dependencies
d57b742 Merge pull request #1374 from fluxcd/update-pkg-deps/release/v1.9.x
6994836 Update fluxcd/pkg dependencies
See full diff in compare view

Updates github.com/fluxcd/pkg/runtime from 0.111.0 to 0.112.0

Commits

992c220 Merge pull request #1283 from fluxcd/release-main
a26a27b Prepare for release
6864165 Merge pull request #1275 from arpitjain099/fix/envsubst-negative-substr-length
d051a03 envsubst: support a negative substring length instead of panicking
1d136f7 Merge pull request #1285 from fluxcd/backport
271b023 Update backport workflow to use v0.14.0
c41b16d Merge pull request #1281 from fluxcd/kubeconfig-file-refs
e2ee0ac runtime/client: Reject file references in kubeconfigs
dfc427c Merge pull request #1274 from fluxcd/fix-e2e-azure
a20ff3a Fix Azure e2e tests after new major version with breaking changes
Additional commits viewable in compare view

Updates github.com/fluxcd/source-controller/api from 1.9.4 to 1.9.5

Release notes

Sourced from github.com/fluxcd/source-controller/api's releases.

v1.9.5

Changelog

v1.9.5 changelog

Container images

docker.io/fluxcd/source-controller:v1.9.5

ghcr.io/fluxcd/source-controller:v1.9.5

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/source-controller/api's changelog.

1.9.5

Release date: 2026-08-31

This patch release upgrades Helm to v4.2.4 to stay in sync with helm-controller 1.6, which moved back from the Flux fork of Helm to upstream. It also updates the fluxcd/pkg dependencies, which bring Kubernetes to 1.36.4.

Improvements:

Upgrade helm to 4.2.4 (sync with HC 1.6) #2140

Update fluxcd/pkg dependencies #2141 #2142

Commits

53194ad Merge pull request #2143 from fluxcd/release-v1.9.5
4a608b1 Release v1.9.5
801a3c5 Add changelog entry for v1.9.5
70c8429 Merge pull request #2142 from fluxcd/update-pkg-deps/release/v1.9.x
e786718 Update fluxcd/pkg dependencies
efab76c Merge pull request #2141 from fluxcd/update-pkg-deps/release/v1.9.x
91c4921 Update fluxcd/pkg dependencies
06b08ea Merge pull request #2140 from fluxcd/helm-4.2.4
edcbbcf Upgrade helm to 4.2.4 (sync with HC 1.6)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go group with 9 updates: | Package | From | To | | --- | --- | --- | | [github.com/fluxcd/cli-utils](https://github.com/fluxcd/cli-utils) | `1.2.2` | `1.2.3` | | [github.com/fluxcd/flux2/v2](https://github.com/fluxcd/flux2) | `2.9.4` | `2.9.5` | | [github.com/fluxcd/helm-controller/api](https://github.com/fluxcd/helm-controller) | `1.6.3` | `1.6.4` | | [github.com/fluxcd/image-automation-controller/api](https://github.com/fluxcd/image-automation-controller) | `1.2.4` | `1.2.5` | | [github.com/fluxcd/image-reflector-controller/api](https://github.com/fluxcd/image-reflector-controller) | `1.2.4` | `1.2.5` | | [github.com/fluxcd/kustomize-controller/api](https://github.com/fluxcd/kustomize-controller) | `1.9.4` | `1.9.5` | | [github.com/fluxcd/notification-controller/api](https://github.com/fluxcd/notification-controller) | `1.9.3` | `1.9.4` | | [github.com/fluxcd/pkg/runtime](https://github.com/fluxcd/pkg) | `0.111.0` | `0.112.0` | | [github.com/fluxcd/source-controller/api](https://github.com/fluxcd/source-controller) | `1.9.4` | `1.9.5` | Updates `github.com/fluxcd/cli-utils` from 1.2.2 to 1.2.3 - [Release notes](https://github.com/fluxcd/cli-utils/releases) - [Commits](fluxcd/cli-utils@v1.2.2...v1.2.3) Updates `github.com/fluxcd/flux2/v2` from 2.9.4 to 2.9.5 - [Release notes](https://github.com/fluxcd/flux2/releases) - [Commits](fluxcd/flux2@v2.9.4...v2.9.5) Updates `github.com/fluxcd/helm-controller/api` from 1.6.3 to 1.6.4 - [Release notes](https://github.com/fluxcd/helm-controller/releases) - [Changelog](https://github.com/fluxcd/helm-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/helm-controller@v1.6.3...v1.6.4) Updates `github.com/fluxcd/image-automation-controller/api` from 1.2.4 to 1.2.5 - [Release notes](https://github.com/fluxcd/image-automation-controller/releases) - [Changelog](https://github.com/fluxcd/image-automation-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/image-automation-controller@v1.2.4...v1.2.5) Updates `github.com/fluxcd/image-reflector-controller/api` from 1.2.4 to 1.2.5 - [Release notes](https://github.com/fluxcd/image-reflector-controller/releases) - [Changelog](https://github.com/fluxcd/image-reflector-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/image-reflector-controller@v1.2.4...v1.2.5) Updates `github.com/fluxcd/kustomize-controller/api` from 1.9.4 to 1.9.5 - [Release notes](https://github.com/fluxcd/kustomize-controller/releases) - [Changelog](https://github.com/fluxcd/kustomize-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/kustomize-controller@v1.9.4...v1.9.5) Updates `github.com/fluxcd/notification-controller/api` from 1.9.3 to 1.9.4 - [Release notes](https://github.com/fluxcd/notification-controller/releases) - [Changelog](https://github.com/fluxcd/notification-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/notification-controller@v1.9.3...v1.9.4) Updates `github.com/fluxcd/pkg/runtime` from 0.111.0 to 0.112.0 - [Commits](fluxcd/pkg@runtime/v0.111.0...runtime/v0.112.0) Updates `github.com/fluxcd/source-controller/api` from 1.9.4 to 1.9.5 - [Release notes](https://github.com/fluxcd/source-controller/releases) - [Changelog](https://github.com/fluxcd/source-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/source-controller@v1.9.4...v1.9.5) --- updated-dependencies: - dependency-name: github.com/fluxcd/cli-utils dependency-version: 1.2.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/flux2/v2 dependency-version: 2.9.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/helm-controller/api dependency-version: 1.6.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/image-automation-controller/api dependency-version: 1.2.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/image-reflector-controller/api dependency-version: 1.2.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/kustomize-controller/api dependency-version: 1.9.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/notification-controller/api dependency-version: 1.9.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/pkg/runtime dependency-version: 0.112.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/fluxcd/source-controller/api dependency-version: 1.9.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels Sep 6, 2026

dependabot Bot requested a review from a team as a code owner September 6, 2026 06:23

dependabot Bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels Sep 6, 2026

frewilhelm enabled auto-merge (squash) September 7, 2026 07:52

frewilhelm approved these changes Sep 7, 2026

View reviewed changes

frewilhelm merged commit 8abb769 into main Sep 7, 2026
5 checks passed

frewilhelm deleted the dependabot/go_modules/go-792af9131e branch September 7, 2026 07:53

Navigation Menu

Uh oh!

chore(deps): bump the go group with 9 updates - #283

chore(deps): bump the go group with 9 updates#283
frewilhelm merged 1 commit into
mainfrom
dependabot/go_modules/go-792af9131e

dependabot Bot commented on behalf of github Sep 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 6, 2026

v1.2.3

What's Changed

v2.9.5

Highlights

Components changelog

CLI changelog

v1.6.4

Changelog

Container images

1.6.4

v1.2.5

Changelog

Container images

1.2.5

v1.2.5

Changelog

Container images

1.2.5

v1.9.5

Changelog

Container images

1.9.5

v1.9.4

Changelog

Container images

1.9.4

v1.9.5

Changelog

Container images

1.9.5

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant