Skip to content

Bump the "project" group with 2 updates across multiple ecosystems - #92

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/project-79b0aa68cb
Open

Bump the "project" group with 2 updates across multiple ecosystems#92
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/project-79b0aa68cb

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps the project group with 6 updates:

Package From To
fluxcd/flux-cli v2.9.2 v2.9.5
controlplaneio-fluxcd/flux-operator-cli v0.55.0 v0.59.0
mikefarah/yq 11a1f0b cfc4eee
alpine/helm 4.2.3 4.2.4
kubectl v1.36.2 v1.37.0
distroless/static-debian12 8c28702 d5563cc

Updates fluxcd/flux-cli from v2.9.2 to v2.9.5

Release notes

Sourced from fluxcd/flux-cli's releases.

v2.9.5

Highlights

Flux v2.9.5 is a patch release that moves helm-controller and source-controller back to upstream Helm, now at v4.2.4, dropping the temporary Flux fork. It hardens the handling of kubeconfig Secrets in helm-controller and kustomize-controller, which now reject kubeconfigs referencing files on the local filesystem and require credentials and certificates to be embedded inline. It also stops kustomize-controller from leaving behind the temporary directories of a previous process that exited without running its cleanup, and fixes a crash in post-build substitution where a substring expression with a negative length, e.g. ${VAR:2:-1}, panicked instead of counting back from the end of the string like Bash does. Across all controllers and the CLI, the fluxcd/pkg dependencies have been updated, bringing Kubernetes to 1.36.4. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

  • Validate kubeconfigs from .spec.kubeConfig Secrets, rejecting local file references in certificate-authority, tokenFile, client-certificate and client-key; credentials and certificates must be embedded inline (helm-controller, kustomize-controller)
  • Purge temporary directories at startup (kustomize-controller)
  • Fix panic on negative-length substring expressions in post-build substitution (kustomize-controller, flux CLI)

Improvements:

  • Move back to upstream Helm v4.2.4, dropping the Flux fork (helm-controller, source-controller)
  • Update fluxcd/pkg dependencies, which bring Kubernetes to 1.36.4 (all controllers, flux CLI)

Components changelog

CLI changelog

Full Changelog: fluxcd/flux2@v2.9.4...v2.9.5

v2.9.4

Highlights

Flux v2.9.4 is a patch release that ships various fixes to the Flux controllers, covering source-watcher tarball extraction and glob expansion limits, the refspecs accepted by ImageUpdateAutomation, the HTTP request limits of the notification-controller servers, and Helm repository index loading, OCI chart digest pinning, Bucket error handling and GCS static authentication in source-controller. On the CLI side, flux migrate -f now supports migrating repositories to Flux 2.9. Users are encouraged to upgrade for the best experience.

Note that this release contains CRD schema changes for ArtifactGenerator and ImageUpdateAutomation; both CRDs must be updated along with the controllers.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

  • Confine tarball extraction and bound glob expansion (source-watcher)
  • Disallow force-update and deletion via refspecs (image-automation-controller)
  • Unify HTTP server request limits (notification-controller)
  • Align Helm repository index loading with upstream Helm v4 (source-controller)
  • Improve error handling in Bucket reconciliation (source-controller)
  • Pin OCI chart verification by digest (source-controller)

... (truncated)

Commits
  • dd233c4 Merge pull request #6049 from fluxcd/update-components-release/v2.9.x
  • 4d44125 Update toolkit components
  • 17374db Merge pull request #6048 from fluxcd/update-pkg-deps/release/v2.9.x
  • 370b47b Update fluxcd/pkg dependencies
  • 58e047b Merge pull request #6046 from fluxcd/update-pkg-deps/release/v2.9.x
  • f384418 Update fluxcd/pkg dependencies
  • 889be9d Merge pull request #6031 from fluxcd/update-components-release/v2.9.x
  • 3825429 Update toolkit components
  • ffe365a Merge pull request #6029 from fluxcd/backport-6028-to-release/v2.9.x
  • 8ac865c fix: restrict allow-webhooks netpol to receiver port
  • Additional commits viewable in compare view

Updates controlplaneio-fluxcd/flux-operator-cli from v0.55.0 to v0.59.0

Release notes

Sourced from controlplaneio-fluxcd/flux-operator-cli's releases.

v0.59.0

What's Changed

Full Changelog: controlplaneio-fluxcd/flux-operator@v0.58.1...v0.59.0

v0.58.1

What's Changed

New Contributors

Full Changelog: controlplaneio-fluxcd/flux-operator@v0.58.0...v0.58.1

v0.58.0

What's Changed

New Contributors

Full Changelog: controlplaneio-fluxcd/flux-operator@v0.57.0...v0.58.0

... (truncated)

Commits
  • e0f71db Merge pull request #1022 from controlplaneio-fluxcd/release-v0.59.0
  • e7cc9e1 Release v0.59.0
  • 85f2003 Merge pull request #1007 from controlplaneio-fluxcd/dependabot/github_actions...
  • d8933c9 Merge pull request #1012 from controlplaneio-fluxcd/dependabot/docker/cmd/cli...
  • ce2e2b3 Merge pull request #1021 from controlplaneio-fluxcd/mcp-docs-search
  • 0e433fd Refactor MCP search index
  • 756c099 Rebuild MCP docs search on the chunked docs index
  • b2ac4d4 Add fluxoperator.dev docs index to MCP library
  • f86ee40 Merge pull request #1020 from controlplaneio-fluxcd/mcp-patch-tool
  • dd5b2ac rset: validate dependsOn ready is set with readyExpr
  • Additional commits viewable in compare view

Updates mikefarah/yq from 11a1f0b to cfc4eee

Updates alpine/helm from 4.2.3 to 4.2.4

Updates kubectl from v1.36.2 to v1.37.0

Updates distroless/static-debian12 from 8c28702 to d5563cc

Bumps the project group with 4 updates in the /.github/workflows directory: docker/setup-buildx-action, fluxcd/flux2/action, controlplaneio-fluxcd/flux-operator/actions/setup and docker/login-action.

Updates docker/setup-buildx-action from 4.2.0 to 4.3.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.3.0

Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0

Commits
  • 37fe631 Merge pull request #595 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • b5c4f91 [dependabot skip] chore: update generated content
  • 3e93b63 build(deps): bump @​docker/actions-toolkit from 0.92.0 to 0.95.0
  • e527031 Merge pull request #600 from docker/dependabot/npm_and_yarn/brace-expansion-1...
  • c68814b [dependabot skip] chore: update generated content
  • 3f891b0 build(deps): bump brace-expansion from 1.1.13 to 1.1.18
  • 787db26 Merge pull request #585 from docker/dependabot/npm_and_yarn/js-yaml-5.2.1
  • f779368 [dependabot skip] chore: update generated content
  • 7d5e604 build(deps): bump js-yaml from 5.2.0 to 5.3.0
  • 292c2fb Merge pull request #590 from docker/dependabot/github_actions/actions/setup-n...
  • Additional commits viewable in compare view

Updates fluxcd/flux2/action from 2.9.2 to 2.9.4

Release notes

Sourced from fluxcd/flux2/action's releases.

v2.9.4

Highlights

Flux v2.9.4 is a patch release that ships various fixes to the Flux controllers, covering source-watcher tarball extraction and glob expansion limits, the refspecs accepted by ImageUpdateAutomation, the HTTP request limits of the notification-controller servers, and Helm repository index loading, OCI chart digest pinning, Bucket error handling and GCS static authentication in source-controller. On the CLI side, flux migrate -f now supports migrating repositories to Flux 2.9. Users are encouraged to upgrade for the best experience.

Note that this release contains CRD schema changes for ArtifactGenerator and ImageUpdateAutomation; both CRDs must be updated along with the controllers.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

  • Confine tarball extraction and bound glob expansion (source-watcher)
  • Disallow force-update and deletion via refspecs (image-automation-controller)
  • Unify HTTP server request limits (notification-controller)
  • Align Helm repository index loading with upstream Helm v4 (source-controller)
  • Improve error handling in Bucket reconciliation (source-controller)
  • Pin OCI chart verification by digest (source-controller)
  • Limit GCS static authentication to service account keys (source-controller)
  • Restrict the allow-webhooks network policy to the receiver port (flux CLI)

Improvements:

  • Add support for migrating repositories to 2.9 in flux migrate -f (flux CLI)
  • Update fluxcd/pkg dependencies, which align the ECR host detection with upstream (source-controller, image-reflector-controller, flux CLI)
  • Update Bitbucket Cloud receiver guidance (notification-controller)

Components changelog

CLI changelog

Full Changelog: fluxcd/flux2@v2.9.3...v2.9.4

v2.9.3

Highlights

Flux v2.9.3 is a patch release. It fixes empty lines vanishing from rendered Helm chart manifests, HelmReleases being marked as tested when their Helm test hooks never ran, and spec.images entries that set only some image fields discarding the remaining fields already declared for the same image in the kustomization.yaml. The latter affects both kustomize-controller and the flux build|diff kustomization commands. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

  • Fix empty lines vanishing from rendered chart manifests (helm-controller)

... (truncated)

Commits
  • 889be9d Merge pull request #6031 from fluxcd/update-components-release/v2.9.x
  • 3825429 Update toolkit components
  • ffe365a Merge pull request #6029 from fluxcd/backport-6028-to-release/v2.9.x
  • 8ac865c fix: restrict allow-webhooks netpol to receiver port
  • c49a486 Merge pull request #6026 from fluxcd/update-pkg-deps/release/v2.9.x
  • 4942d15 Update fluxcd/pkg dependencies
  • a2d0b29 Merge pull request #6021 from fluxcd/backport-6020-to-release/v2.9.x
  • f4ad9e5 Add support for 2.9 in migrate -f
  • 16602fa Merge pull request #6011 from fluxcd/update-components-release/v2.9.x
  • 62059b8 Update toolkit components
  • Additional commits viewable in compare view

Updates controlplaneio-fluxcd/flux-operator/actions/setup from 0.55.0 to 0.58.1

Release notes

Sourced from controlplaneio-fluxcd/flux-operator/actions/setup's releases.

v0.58.1

What's Changed

New Contributors

Full Changelog: controlplaneio-fluxcd/flux-operator@v0.58.0...v0.58.1

v0.58.0

What's Changed

New Contributors

Full Changelog: controlplaneio-fluxcd/flux-operator@v0.57.0...v0.58.0

v0.57.0

What's Changed

Full Changelog: controlplaneio-fluxcd/flux-operator@v0.56.0...v0.57.0

v0.56.0

What's Changed

... (truncated)

Commits
  • b3b3602 Merge pull request #1000 from controlplaneio-fluxcd/release-v0.58.1
  • a4b787a Release v0.58.1
  • 5683f43 Merge pull request #999 from controlplaneio-fluxcd/update-deps
  • 745f0db deps: Update golang.org/x packages
  • fd7daee Merge pull request #981 from manoj-1407/perf/inventory-diff-map-lookup
  • d62ffcd Optimize inventory.Diff with map lookup
  • c12727e Merge pull request #998 from controlplaneio-fluxcd/mirror-charts-cli
  • 33f6126 cli: add --include-operator-cli-image to distro mirror flags
  • be85b6b cli: add --include-instance-chart to distro mirror flags
  • 57db847 docs: format ResourceSet examples
  • Additional commits viewable in compare view

Updates docker/login-action from 4.4.0 to 4.6.0

Release notes

Sourced from docker/login-action's releases.

v4.6.0

Full Changelog: docker/login-action@v4.5.2...v4.6.0

v4.5.2

Full Changelog: docker/login-action@v4.5.1...v4.5.2

v4.5.1

Full Changelog: docker/login-action@v4.5.0...v4.5.1

v4.5.0

Full Changelog: docker/login-action@v4.4.0...v4.5.0

Commits
  • dbcb813 Merge pull request #1051 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
  • 5bcb015 [dependabot skip] chore: update generated content
  • b30b2f2 build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
  • 9087f1e Merge pull request #1057 from docker/dependabot/npm_and_yarn/js-yaml-5.2.2
  • 0009830 [dependabot skip] chore: update generated content
  • 2325523 build(deps): bump js-yaml from 5.2.1 to 5.2.2
  • 4ec1d4a Merge pull request #1056 from docker/dependabot/npm_and_yarn/postcss-8.5.22
  • 5fc99ba Merge pull request #1053 from docker/dependabot/github_actions/aws-actions/co...
  • e512bd5 Merge pull request #1052 from docker/dependabot/github_actions/codeql-actions...
  • a146c91 Merge pull request #1059 from crazy-max/harden-buildx-scope-paths
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the project group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [fluxcd/flux-cli](https://github.com/fluxcd/flux2) | `v2.9.2` | `v2.9.5` |
| [controlplaneio-fluxcd/flux-operator-cli](https://github.com/controlplaneio-fluxcd/flux-operator) | `v0.55.0` | `v0.59.0` |
| mikefarah/yq | ``11a1f0b`` | ``cfc4eee`` |
| alpine/helm | `4.2.3` | `4.2.4` |
| kubectl | `v1.36.2` | `v1.37.0` |
| distroless/static-debian12 | ``8c28702`` | ``d5563cc`` |


Updates `fluxcd/flux-cli` from v2.9.2 to v2.9.5
- [Release notes](https://github.com/fluxcd/flux2/releases)
- [Commits](fluxcd/flux2@v2.9.2...v2.9.5)

Updates `controlplaneio-fluxcd/flux-operator-cli` from v0.55.0 to v0.59.0
- [Release notes](https://github.com/controlplaneio-fluxcd/flux-operator/releases)
- [Commits](controlplaneio-fluxcd/flux-operator@v0.55.0...v0.59.0)

Updates `mikefarah/yq` from `11a1f0b` to `cfc4eee`

Updates `alpine/helm` from 4.2.3 to 4.2.4

Updates `kubectl` from v1.36.2 to v1.37.0

Updates `distroless/static-debian12` from `8c28702` to `d5563cc`
Bump the project group across 1 directory with 4 updates

Bumps the project group with 4 updates in the /.github/workflows directory: [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action), [fluxcd/flux2/action](https://github.com/fluxcd/flux2), [controlplaneio-fluxcd/flux-operator/actions/setup](https://github.com/controlplaneio-fluxcd/flux-operator) and [docker/login-action](https://github.com/docker/login-action).


Updates `docker/setup-buildx-action` from 4.2.0 to 4.3.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@bb05f3f...37fe631)

Updates `fluxcd/flux2/action` from 2.9.2 to 2.9.4
- [Release notes](https://github.com/fluxcd/flux2/releases)
- [Commits](fluxcd/flux2@6a650db...889be9d)

Updates `controlplaneio-fluxcd/flux-operator/actions/setup` from 0.55.0 to 0.58.1
- [Release notes](https://github.com/controlplaneio-fluxcd/flux-operator/releases)
- [Commits](controlplaneio-fluxcd/flux-operator@218983d...b3b3602)

Updates `docker/login-action` from 4.4.0 to 4.6.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@af1e73f...dbcb813)

---
updated-dependencies:
- dependency-name: fluxcd/flux-cli
  dependency-version: v2.9.5
  dependency-type: direct:production
  dependency-group: project
- dependency-name: controlplaneio-fluxcd/flux-operator-cli
  dependency-version: v0.59.0
  dependency-type: direct:production
  dependency-group: project
- dependency-name: mikefarah/yq
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: project
- dependency-name: alpine/helm
  dependency-version: 4.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: project
- dependency-name: kubectl
  dependency-version: v1.37.0
  dependency-type: direct:production
  dependency-group: project
- dependency-name: distroless/static-debian12
  dependency-version: debug-nonroot
  dependency-type: direct:production
  dependency-group: project
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: project
- dependency-name: fluxcd/flux2/action
  dependency-version: 2.9.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: project
- dependency-name: controlplaneio-fluxcd/flux-operator/actions/setup
  dependency-version: 0.58.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: project
- dependency-name: docker/login-action
  dependency-version: 4.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: project
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file docker Pull requests that update docker code labels Sep 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file docker Pull requests that update docker code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants