chore(deps): bump the go group across 1 directory with 8 updates

[dependabot]

Bumps the go group with 8 updates in the / directory:

Package	From	To
github.com/fluxcd/helm-controller/api	1.5.5	1.6.0
github.com/fluxcd/image-automation-controller/api	1.1.4	1.2.0
github.com/fluxcd/image-reflector-controller/api	1.1.2	1.2.0
github.com/fluxcd/kustomize-controller/api	1.8.5	1.9.0
github.com/fluxcd/notification-controller/api	1.8.4	1.9.0
github.com/fluxcd/source-controller/api	1.8.5	1.9.0
github.com/open-component-model/ocm-controller	0.30.0	0.31.0
ocm.software/ocm	0.43.0	0.44.0

Updates github.com/fluxcd/helm-controller/api from 1.5.5 to 1.6.0

Release notes

Sourced from github.com/fluxcd/helm-controller/api's releases.

v1.6.0

Changelog

v1.6.0 changelog

Container images

• docker.io/fluxcd/helm-controller:v1.6.0
• ghcr.io/fluxcd/helm-controller:v1.6.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/helm-controller/api's changelog.

1.6.0

Release date: 2026-06-17

This minor release continues aligning Flux with Helm v4, adding support for Helm's post-render strategies along with several new HelmRelease configuration options and improved drift observability.

⚠️ Breaking change: the default post-render strategy is now combined, to stay aligned with Helm v4.2's default for sending hooks to post-renderers. Users relying on the previous Helm v3 behavior can either enable the UseHelm3Defaults feature gate (which switches the default back to nohooks) or pin the behavior per HelmRelease via .spec.postRenderStrategy.

HelmRelease

Helm's post-render strategies are now supported through the new .spec.postRenderStrategy field, which controls how hooks are passed to post-renderers. The accepted values are nohooks, combined and separate. The default is combined to stay aligned with Helm v4.2, switching to nohooks when the UseHelm3Defaults feature gate is enabled.

A new .spec.upgrade.chartNameChangeStrategy field controls what happens when a HelmRelease's chart name changes. The default Reinstall keeps the current behavior of uninstalling and reinstalling the release, while InPlaceUpdate performs an in-place Helm upgrade instead, re-introducing on an opt-in basis the behavior present before Flux 2.2.

valuesFrom entries now accept a literal field. When set to true, the referenced value is used verbatim instead of being parsed with Helm's --set syntax, allowing arbitrary file content (JSON blobs, multi-line YAML, HOCON, etc.) that would otherwise be misinterpreted by the strvals parser.

A new Drifted condition is now set on the HelmRelease to improve the observability of drift detection.

Improvements:

• Add post-render strategy support and conditional defaults #1470
• Support helm release upgrade on helm chart name change #1447
• Add literal field to valuesFrom #1503
• Add Drifted condition to HelmRelease #1367
• Migrate DependencyReference to shared apis/meta type #1502
• Update source-controller API to v1.9.0 #1519
• Various dependency updates

... (truncated)

Commits

• 363c849 Merge pull request #1520 from fluxcd/release-v1.6.0
• c88ae15 Release v1.6.0
• 6e467b9 Add changelog entry for v1.6.0
• a2e22df Merge pull request #1519 from fluxcd/source-controller-v1.9.0
• 67f9b81 Upgrade source-controller API to v1.9.0
• a644069 Merge pull request #1447 from Nordix/issue-870
• 95f303b Add documentation to helmreleases.md
• 41a6f08 Add condition on new tests
• 68d284c Add tests to e2e for chart name change upgrade
• eb95b9f Updated for review comments
• Additional commits viewable in compare view

Updates github.com/fluxcd/image-automation-controller/api from 1.1.4 to 1.2.0

Release notes

Sourced from github.com/fluxcd/image-automation-controller/api's releases.

v1.2.0

Changelog

v1.2.0 changelog

Container images

• docker.io/fluxcd/image-automation-controller:v1.2.0
• ghcr.io/fluxcd/image-automation-controller:v1.2.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/image-automation-controller/api's changelog.

1.2.0

Release date: 2026-06-17

This minor release adds support for signing Git commits with SSH keys and for authenticating to AWS CodeCommit repositories using IAM roles, and removes the deprecated image.toolkit.fluxcd.io/v1beta2 API version.

In addition, the Kubernetes dependencies have been updated to v1.36 and the controller is now built with Go 1.26.

⚠️ The image.toolkit.fluxcd.io/v1beta2 APIs were removed. Before upgrading the CRDs, Flux users must follow the upgrade procedure to migrate the cluster storage off v1beta2. After the upgrade, all manifests in Git which contain ImageUpdateAutomation definitions must be updated to:

apiVersion: image.toolkit.fluxcd.io/v1

ImageUpdateAutomation

The controller can now sign automation commits with an SSH key, in addition to the existing OpenPGP signing support. A new optional .spec.git.commit.signingKey.type field selects the key format (gpg or ssh); it defaults to gpg so existing manifests are unaffected. Passphrase-protected keys are supported. #1035

Git repositories hosted on AWS CodeCommit can now be authenticated using IAM role authentication. #1026

Fixes:

• Preserve all object changes when the same object appears in multiple files #1042
• Propagate non-not-found errors when fetching the GitRepository #1036

Improvements:

• Update to Kubernetes 1.36 and Go 1.26 #1039
• Build for the host architecture in local builds and envtest #1044
• Various dependency updates #1027 #1040 #1045 #1046 #1047

... (truncated)

Commits

• f86e969 Merge pull request #1052 from fluxcd/release-v1.2.0
• cdce05c Release v1.2.0
• 3ba1a67 Add changelog entry for v1.2.0
• f5b7836 Merge pull request #1051 from fluxcd/image-reflector-controller-v1.2.0
• 4004b41 Upgrade image-reflector-controller API to v1.2.0
• a8d072c Merge pull request #1050 from fluxcd/source-controller-v1.9.0
• 8325be9 Upgrade source-controller API to v1.9.0
• 92da078 Merge pull request #1049 from fluxcd/remove-v1beta2
• 6b676f7 Remove deprecated APIs in group image.toolkit.fluxcd.io/v1beta2
• 4ff1e0b Merge pull request #1035 from fluxcd/feat/ssh-commit-signing
• Additional commits viewable in compare view

Updates github.com/fluxcd/image-reflector-controller/api from 1.1.2 to 1.2.0

Release notes

Sourced from github.com/fluxcd/image-reflector-controller/api's releases.

v1.2.0

Changelog

v1.2.0 changelog

Container images

• docker.io/fluxcd/image-reflector-controller:v1.2.0
• ghcr.io/fluxcd/image-reflector-controller:v1.2.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/image-reflector-controller/api's changelog.

1.2.0

Release date: 2026-06-17

This minor release removes the deprecated v1beta2 APIs, introduces an opt-in storage backend based on the standard Flux artifact storage, and comes with various dependency updates.

⚠️ The image.toolkit.fluxcd.io/v1beta2 APIs were removed. Before upgrading the CRDs, Flux users must follow the upgrade procedure to migrate the cluster storage off v1beta2. After the upgrade, all manifests in Git which contain ImagePolicy and ImageRepository definitions must be updated to:

apiVersion: image.toolkit.fluxcd.io/v1

Storage

The controller can now use the standard Flux artifact storage (fluxcd/pkg/artifact/storage) instead of the embedded BadgerDB for persisting image tags. This is gated behind the new FluxStorage feature gate, which is disabled by default. Note that enabling or disabling the gate wipes the existing storage.

General updates

The Kubernetes dependencies have been updated to v1.36 and the controller is now built with Go 1.26 and controller-runtime v0.24.

Improvements:

• Remove deprecated APIs in group image.toolkit.fluxcd.io/v1beta2 #896
• Introduce standard storage alternative #895
• Update to Kubernetes 1.36 and Go 1.26 #886
• Various dependency updates #887 #888 #891 #892 #893 #894

Commits

• cf3258b Merge pull request #897 from fluxcd/release-v1.2.0
• e4831fb Release v1.2.0
• f0375a3 Add changelog entry for v1.2.0
• 1a9b8cf Merge pull request #896 from fluxcd/remove-v1beta2
• f7fe4b6 Remove deprecated APIs in group image.toolkit.fluxcd.io/v1beta2
• 088d3ba Merge pull request #895 from fluxcd/flux-storage
• c4cc62a Introduce standard storage alternative
• 26ff82a Merge pull request #894 from fluxcd/update-pkg-deps/main
• 33b366d Fix tests for lazy artifact registry credentials
• 1743859 Update fluxcd/pkg dependencies
• Additional commits viewable in compare view

Updates github.com/fluxcd/kustomize-controller/api from 1.8.5 to 1.9.0

Release notes

Sourced from github.com/fluxcd/kustomize-controller/api's releases.

v1.9.0

Changelog

v1.9.0 changelog

Container images

• docker.io/fluxcd/kustomize-controller:v1.9.0
• ghcr.io/fluxcd/kustomize-controller:v1.9.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/kustomize-controller/api's changelog.

1.9.0

Release date: 2026-06-17

This minor release comes with new features for post-build variable substitution, drift detection, SOPS decryption and Kustomize build metadata, along with various bug fixes and dependency updates.

Kustomization

Post-build substitutions are now stricter by default: the controller fails the reconciliation when a variable without a default value is referenced in the manifests but is missing from the input vars. This behavior is controlled by the StrictPostBuildSubstitutions feature gate, which is now enabled by default and can be opted out of. In addition, a new .spec.postBuild.substituteStrategy: Always option was introduced to always perform substitutions even when no variables are defined, which is useful when the substitution expressions all carry defaults (e.g. ${var:=default}).

Drift detection can now be fine-tuned with ignore rules. The new .spec.ignore field accepts a list of rules selecting JSON pointer paths (optionally scoped to specific targets) to exclude from both drift detection and the apply process.

A new .spec.buildMetadata field allows enabling Kustomize build metadata annotations per Kustomization, supporting the originAnnotations and transformerAnnotations options.

The controller now keeps resources that failed to be pruned in the .status.inventory, ensuring they remain tracked and can be retried on the next reconciliation instead of becoming untracked orphans.

SOPS decryption

SOPS decryption now supports generic Kubernetes workload identity for the OpenBao/Vault transit engine, allowing the controller to authenticate to OpenBao by exchanging a Kubernetes ServiceAccount token for a short-lived OpenBao token through a JWT-backed auth method, instead of using a static token. This is purely additive and non-breaking: the existing sops.vault-token Secret and VAULT_TOKEN environment variable paths are unchanged and take precedence.

Age and SOPS have also been updated to support Age hybrid post-quantum encryption.

General updates

In addition, the Kubernetes dependencies have been updated to v1.36, the controller is now built with Go 1.26 and the source-controller API has been upgraded to v1.9.0. The shared DependencyReference type was migrated to the apis/meta package, preserving backward compatibility through a type alias.

Fixes:

... (truncated)

Commits

• 5469138 Merge pull request #1675 from fluxcd/release-v1.9.0
• 1b885f3 Release v1.9.0
• 94d4688 Add changelog entry for v1.9.0
• 9dfc5b3 Merge pull request #1674 from fluxcd/source-controller-v1.9.0
• 7365c20 Upgrade source-controller API to v1.9.0
• 77e3d98 Merge pull request #1673 from yugstar/docs-sops-dotenv-type
• 2bdabb9 docs: fix SOPS store type for dotenv files (env -> dotenv)
• 5b3449c Merge pull request #1672 from fluxcd/varsub-always
• 6214269 Introduce substituteStrategy: Always
• 3e12665 Merge pull request #1671 from fluxcd/strict-varsub-default
• Additional commits viewable in compare view

Updates github.com/fluxcd/notification-controller/api from 1.8.4 to 1.9.0

Release notes

Sourced from github.com/fluxcd/notification-controller/api's releases.

v1.9.0

Changelog

v1.9.0 changelog

Container images

• docker.io/fluxcd/notification-controller:v1.9.0
• ghcr.io/fluxcd/notification-controller:v1.9.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/notification-controller/api's changelog.

1.9.0

Release date: 2026-06-19

This minor release removes the deprecated notification.toolkit.fluxcd.io/v1beta2 API group, introduces a new secret-less generic-oidc Receiver with fine-grained resource filtering, and enforces the GCR Receiver security fix for CVE-2026-40109.

⚠️ Action required: The notification.toolkit.fluxcd.io/v1beta2 API group has reached end-of-life and has been removed from the CRDs. Before upgrading, migrate any remaining v1beta2 resources to v1. See the Flux 2.9 upgrade procedure for both the Flux CLI and Flux Operator migration paths.

⚠️ Breaking change: GCR Receivers now require the email and audience fields in the referenced Secret, enforcing the fix for CVE-2026-40109.

Receiver

A new generic-oidc Receiver type has been introduced, allowing webhook senders to authenticate with OIDC tokens validated against configured providers using CEL expressions, removing the need for a shared HMAC secret. The Receiver can be made fully secret-less and the OIDC audience is optional.

Receiver filtering has been enhanced: OIDC claims are now available in the .spec.resourceFilter CEL context, and a new per-resource .spec.resources[].filter field allows scoping which resources each request may trigger. The two filters are AND'd together.

General updates

In addition, the Kubernetes dependencies have been updated to v1.36 and the controller is now built with Go 1.26. The Google Pub/Sub and Sentry provider SDKs have been upgraded to their latest versions.

Fixes:

• Fix error events being dropped by commit status providers #1317

Improvements:

• Introduce generic-oidc Receiver #1306
• Make Receiver OIDC audience optional #1309
• Reject secretRef for generic-oidc Receiver #1311
• Enrich Receiver resourceFilter with OIDC claims #1313
• Introduce resource-level filter for Receiver

... (truncated)

Commits

• 866a178 Merge pull request #1329 from fluxcd/release-v1.9.0
• f5447c9 Release v1.9.0
• 9d787b6 Add changelog entry for v1.9.0
• 71cc3c1 Merge pull request #1327 from fluxcd/remove-v1beta2
• f4b4c8f Remove deprecated APIs in group notification.toolkit.fluxcd.io/v1beta2
• db443e3 Merge pull request #1326 from fluxcd/update-pkg-deps/main
• 138662f Update fluxcd/pkg dependencies
• 8671216 Merge pull request #1325 from fluxcd/update-pkg-deps/main
• cde9bb1 Update fluxcd/pkg dependencies
• ff1e514 Merge pull request #1316 from fluxcd/dependabot/github_actions/ci-15f8cbcb04
• Additional commits viewable in compare view

Updates github.com/fluxcd/source-controller/api from 1.8.5 to 1.9.0

Release notes

Sourced from github.com/fluxcd/source-controller/api's releases.

v1.9.0

Changelog

v1.9.0 changelog

Container images

• docker.io/fluxcd/source-controller:v1.9.0
• ghcr.io/fluxcd/source-controller:v1.9.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/source-controller/api's changelog.

1.9.0

Release date: 2026-06-17

This minor release comes with new authentication and verification features for the source APIs, along with various improvements, fixes and dependency updates.

GitRepository

The GitRepository controller now supports AWS CodeCommit as a Git provider, allowing authentication to CodeCommit repositories.

Git commit and tag verification now supports SSH signatures in addition to OpenPGP, so commits and tags signed with SSH keys can be verified via .spec.verify.

OCIRepository

The OCIRepository controller now supports configuring a custom Sigstore trusted root for keyless signature verification, via a Secret referenced in the verification configuration.

OCI artifacts are now resolved and stored strictly by their content digest.

Fixes:

• cosign: fix v3 bundle verify on http and private CA registries and pass TLS to Rekor #2061
• Close OCI blob reader and wrap errors consistently across controllers #2066
• Remove unimplemented field from HelmChart CRD #2080

Improvements:

• AWS CodeCommit support #2035
• Add git commit/tag SSH signature verification #2077
• Add custom Sigstore trusted root support #2003
• Ensure OCI artifacts are handled strictly by digest #2075
• build: target host architecture for local builds and envtest #2076
• Various dependency updates #2067 #2071 #2072 #2073 #2078

... (truncated)

Commits

• 57734ac Merge pull request #2082 from fluxcd/release-v1.9.0
• 565d3f0 Release v1.9.0
• 63e7ba2 Add changelog entry for v1.9.0
• 16e724e Merge pull request #2081 from fluxcd/update-pkg-deps/main
• e3d8a3f Fix tests for lazy artifact registry credentials
• d00344a Update fluxcd/pkg dependencies
• 54f9f98 Merge pull request #2080 from fluxcd/fix-hc-trusted-root
• 1ecb593 fix: remove unimplemented field from HelmChart CRD
• bed4f74 Merge pull request #2079 from fluxcd/update-pkg-deps/main
• 9ab0968 Update fluxcd/pkg dependencies
• Additional commits viewable in compare view

Updates github.com/open-component-model/ocm-controller from 0.30.0 to 0.31.0

Release notes

Sourced from github.com/open-component-model/ocm-controller's releases.

v0.31.0

Release v0.31.0

• docs: use latest version in installation (#843)
• security: harden GitHub Actions workflow permissions (#934)
• chore: bump containerd (#941)
• feat: Add duration and renewBefore configuration for TLS certificates (#942)
• chore(fix): update coc to linux foundation eu (#937)
• chore: remove blackduck (#935)
• chore: add environment (#936)
• chore: update coc, contributing and readme (#920)

🧰 Maintenance

• chore(deps): bump the go group with 9 updates (#943)
• chore(deps): bump the go group with 3 updates (#940)
• chore(deps): bump github.com/containerd/containerd/v2 from 2.3.0 to 2.3.1 (#929)
• chore(deps): bump the go group across 1 directory with 15 updates (#933)
• chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#927)
• chore(deps): bump the go group across 1 directory with 6 updates (#922)
• chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 (#923)
• chore(deps): bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 (#924)

⬆️ Dependencies

• chore(deps): bump the go group with 9 updates (#943)
• chore(deps): bump the go group with 3 updates (#940)
• chore(deps): bump github.com/containerd/containerd/v2 from 2.3.0 to 2.3.1 (#929)
• chore(deps): bump the go group across 1 directory with 15 updates (#933)
• chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#927)
• chore(deps): bump the go group across 1 directory with 6 updates (#922)
• chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 (#923)
• chore(deps): bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 (#924)

Commits

• 58763f7 chore: release docs for v0.31.0 (#944)
• 61a3b55 docs: use latest version in installation (#843)
• ff73831 chore(deps): bump the go group with 9 updates (#943)
• 41e0c57 security: harden GitHub Actions workflow permissions (#934)
• 67c56bc chore: bump containerd (#941)
• d8e43ca feat: Add duration and renewBefore configuration for TLS certificates (#942)
• 50a3ec1 chore(deps): bump the go group with 3 updates (#940)
• 4c27b1e chore(deps): bump github/codeql-action from 4.36.1 to 4.36.2 in the ci group ...
• 8b3ced7 chore(deps): bump the ci group with 2 updates (#938)
• 725cd80 chore(fix): update coc to linux foundation eu (#937)
• Additional commits viewable in compare view

Updates ocm.software/ocm from 0.43.0 to 0.44.0

Release notes

Sourced from ocm.software/ocm's releases.

v0.44.0

What's Changed

🐛 Bug Fixes

• fix: pin ocm cli v2 by @​frewilhelm in open-component-model/ocm#1978
• fix(tests): replace AddGlob with AddWithOptions to fix go-git v5.19.1… by @​matthiasbruns in open-component-model/ocm#1983

⬆️ Dependencies

• chore(deps): update go to 1.26.3 by @​matthiasbruns in open-component-model/ocm#1967
• chore(deps): bump github.com/containerd/containerd/v2 from 2.3.0 to 2.3.1 by @​dependabot[bot] in open-component-model/ocm#1969
• chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 by @​dependabot[bot] in open-component-model/ocm#1965
• chore(releases-044): cherry-pick: #1994 and #2000 by @​frewilhelm in open-component-model/ocm#2002

🧰 Maintenance

• chore: bump VERSION to 0.44.0-dev by @​ocmbot[bot] in open-component-model/ocm#1962
• chore: use github environment by @​frewilhelm in open-component-model/ocm#1976
• chore: remove blackduck by @​matthiasbruns in open-component-model/ocm#1975
• chore: remove blackduck workflow call by @​frewilhelm in open-component-model/ocm#1980

Full Changelog: open-component-model/ocm@v0.43...v0.44.0

v0.44.0-rc.2

What's Changed

🐛 Bug Fixes

• fix: pin ocm cli v2 by @​frewilhelm in open-component-model/ocm#1978
• fix(tests): replace AddGlob with AddWithOptions to fix go-git v5.19.1… by @​matthiasbruns in open-component-model/ocm#1983

⬆️ Dependencies

• chore(deps): update go to 1.26.3 by @​matthiasbruns in open-component-model/ocm#1967
• chore(deps): bump github.com/containerd/containerd/v2 from 2.3.0 to 2.3.1 by @​dependabot[bot] in open-component-model/ocm#1969
• chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 by @​dependabot[bot] in open-component-model/ocm#1965
• chore(releases-044): cherry-pick: #1994 and #2000 by @​frewilhelm in open-component-model/ocm#2002

🧰 Maintenance

• chore: bump VERSION to 0.44.0-dev by @​ocmbot[bot] in open-component-model/ocm#1962
• chore: use github environment by @​frewilhelm in open-component-model/ocm#1976
• chore: remove blackduck by @​matthiasbruns in open-component-model/ocm#1975
• chore: remove blackduck workflow call by @​frewilhelm in open-component-model/ocm#1980

Full Changelog: open-component-model/ocm@v0.43...v0.44.0

v0.44.0-rc.1

What's Changed

🐛 Bug Fixes

• fix: pin ocm cli v2 by @​frewilhelm in open-component-model/ocm#1978

... (truncated)

Commits

• 0d30a2f chore: update 'flake.nix' (#1984)
• c666a61 chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#1965)
• d41adba fix(tests): replace AddGlob with AddWithOptions to fix go-git v5.19.1… (#1983)
• 5b88451 chore: remove blackduck workflow call (#1980)
• fb4a954 chore: update 'flake.nix' (#1977)
• 938bb3e chore(deps): bump github.com/containerd/containerd/v2 from 2.3.0 to 2.3.1 (#1...
• 78a7295 chore: remove blackduck (#1975)
• de5284f chore: use github environment (#1976)
• 37075fa chore(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0 in the ci grou...
• b1a749a fix: pin ocm cli v2 (#1978)
• Additional commits viewable in compare view