Flux v2.9.5 is a patch release that moves helm-controller and source-controller back to upstream Helm, now at v4.2.4, dropping the temporary Flux fork. It hardens the handling of kubeconfig Secrets in helm-controller and kustomize-controller, which now reject kubeconfigs referencing files on the local filesystem and require credentials and certificates to be embedded inline. It also stops kustomize-controller from leaving behind the temporary directories of a previous process that exited without running its cleanup, and fixes a crash in post-build substitution where a substring expression with a negative length, e.g. ${VAR:2:-1}, panicked instead of counting back from the end of the string like Bash does. Across all controllers and the CLI, the fluxcd/pkg dependencies have been updated, bringing Kubernetes to 1.36.4. Users are encouraged to upgrade for the best experience.
Validate kubeconfigs from .spec.kubeConfig Secrets, rejecting local file references in certificate-authority, tokenFile, client-certificate and client-key; credentials and certificates must be embedded inline (helm-controller, kustomize-controller)
Purge temporary directories at startup (kustomize-controller)
Fix panic on negative-length substring expressions in post-build substitution (kustomize-controller, flux CLI)
Improvements:
Move back to upstream Helm v4.2.4, dropping the Flux fork (helm-controller, source-controller)
Update fluxcd/pkg dependencies, which bring Kubernetes to 1.36.4 (all controllers, flux CLI)
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [fluxcd/flux2](https://github.com/fluxcd/flux2) | patch | `v2.9.4` → `v2.9.5` |
---
### Release Notes
<details>
<summary>fluxcd/flux2 (fluxcd/flux2)</summary>
### [`v2.9.5`](https://github.com/fluxcd/flux2/releases/tag/v2.9.5)
[Compare Source](https://github.com/fluxcd/flux2/compare/v2.9.4...v2.9.5)
#### Highlights
Flux v2.9.5 is a patch release that moves helm-controller and source-controller back to upstream Helm, now at v4.2.4, dropping the temporary Flux fork. It hardens the handling of kubeconfig Secrets in helm-controller and kustomize-controller, which now reject kubeconfigs referencing files on the local filesystem and require credentials and certificates to be embedded inline. It also stops kustomize-controller from leaving behind the temporary directories of a previous process that exited without running its cleanup, and fixes a crash in post-build substitution where a substring expression with a negative length, e.g. `${VAR:2:-1}`, panicked instead of counting back from the end of the string like Bash does. Across all controllers and the CLI, the fluxcd/pkg dependencies have been updated, bringing Kubernetes to 1.36.4. Users are encouraged to upgrade for the best experience.
ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version.
Fixes:
- Validate kubeconfigs from `.spec.kubeConfig` Secrets, rejecting local file references in `certificate-authority`, `tokenFile`, `client-certificate` and `client-key`; credentials and certificates must be embedded inline (helm-controller, kustomize-controller)
- Purge temporary directories at startup (kustomize-controller)
- Fix panic on negative-length substring expressions in post-build substitution (kustomize-controller, flux CLI)
Improvements:
- Move back to upstream Helm v4.2.4, dropping the Flux fork (helm-controller, source-controller)
- Update fluxcd/pkg dependencies, which bring Kubernetes to 1.36.4 (all controllers, flux CLI)
#### Components changelog
- source-controller [v1.9.5](https://github.com/fluxcd/source-controller/blob/v1.9.5/CHANGELOG.md)
- source-watcher [v2.2.4](https://github.com/fluxcd/source-watcher/blob/v2.2.4/CHANGELOG.md)
- kustomize-controller [v1.9.5](https://github.com/fluxcd/kustomize-controller/blob/v1.9.5/CHANGELOG.md)
- helm-controller [v1.6.4](https://github.com/fluxcd/helm-controller/blob/v1.6.4/CHANGELOG.md)
- notification-controller [v1.9.4](https://github.com/fluxcd/notification-controller/blob/v1.9.4/CHANGELOG.md)
- image-reflector-controller [v1.2.5](https://github.com/fluxcd/image-reflector-controller/blob/v1.2.5/CHANGELOG.md)
- image-automation-controller [v1.2.5](https://github.com/fluxcd/image-automation-controller/blob/v1.2.5/CHANGELOG.md)
#### CLI changelog
- Update fluxcd/pkg dependencies by [@​fluxcdbot](https://github.com/fluxcdbot) in [#​6046](https://github.com/fluxcd/flux2/pull/6046)
- Update fluxcd/pkg dependencies by [@​fluxcdbot](https://github.com/fluxcdbot) in [#​6048](https://github.com/fluxcd/flux2/pull/6048)
- Update toolkit components by [@​fluxcdbot](https://github.com/fluxcdbot) in [#​6049](https://github.com/fluxcd/flux2/pull/6049)
**Full Changelog**: <https://github.com/fluxcd/flux2/compare/v2.9.4...v2.9.5>
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC41My4wIiwidXBkYXRlZEluVmVyIjoiNDQuNTMuMCIsInRhcmdldEJyYW5jaCI6ImZyZXNoLXN0YXJ0IiwibGFiZWxzIjpbXX0=-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
v2.9.4→v2.9.5Release Notes
fluxcd/flux2 (fluxcd/flux2)
v2.9.5Compare Source
Highlights
Flux v2.9.5 is a patch release that moves helm-controller and source-controller back to upstream Helm, now at v4.2.4, dropping the temporary Flux fork. It hardens the handling of kubeconfig Secrets in helm-controller and kustomize-controller, which now reject kubeconfigs referencing files on the local filesystem and require credentials and certificates to be embedded inline. It also stops kustomize-controller from leaving behind the temporary directories of a previous process that exited without running its cleanup, and fixes a crash in post-build substitution where a substring expression with a negative length, e.g.
${VAR:2:-1}, panicked instead of counting back from the end of the string like Bash does. Across all controllers and the CLI, the fluxcd/pkg dependencies have been updated, bringing Kubernetes to 1.36.4. Users are encouraged to upgrade for the best experience.ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.
Fixes:
.spec.kubeConfigSecrets, rejecting local file references incertificate-authority,tokenFile,client-certificateandclient-key; credentials and certificates must be embedded inline (helm-controller, kustomize-controller)Improvements:
Components changelog
CLI changelog
Full Changelog: https://github.com/fluxcd/flux2/compare/v2.9.4...v2.9.5
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.