chore(deps): update dependency fluxcd/flux2 to v2.9.5 #3

Merged

valeninki merged 1 commit from renovate/fluxcd-flux2-2.x into k0s

2026-09-09 00:43:05 +00:00

shark bot commented

2026-09-09 00:24:13 +00:00

Collaborator

This PR contains the following updates:

Package	Update	Change
fluxcd/flux2	patch	`v2.9.4` -> `v2.9.5`

Release Notes

fluxcd/flux2 (fluxcd/flux2)

`v2.9.5`

Compare Source

Highlights

Flux v2.9.5 is a patch release that moves helm-controller and source-controller back to upstream Helm, now at v4.2.4, dropping the temporary Flux fork. It hardens the handling of kubeconfig Secrets in helm-controller and kustomize-controller, which now reject kubeconfigs referencing files on the local filesystem and require credentials and certificates to be embedded inline. It also stops kustomize-controller from leaving behind the temporary directories of a previous process that exited without running its cleanup, and fixes a crash in post-build substitution where a substring expression with a negative length, e.g. ${VAR:2:-1}, panicked instead of counting back from the end of the string like Bash does. Across all controllers and the CLI, the fluxcd/pkg dependencies have been updated, bringing Kubernetes to 1.36.4. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

Validate kubeconfigs from .spec.kubeConfig Secrets, rejecting local file references in certificate-authority, tokenFile, client-certificate and client-key; credentials and certificates must be embedded inline (helm-controller, kustomize-controller)
Purge temporary directories at startup (kustomize-controller)
Fix panic on negative-length substring expressions in post-build substitution (kustomize-controller, flux CLI)

Improvements:

Move back to upstream Helm v4.2.4, dropping the Flux fork (helm-controller, source-controller)
Update fluxcd/pkg dependencies, which bring Kubernetes to 1.36.4 (all controllers, flux CLI)

Components changelog

source-controller v1.9.5
source-watcher v2.2.4
kustomize-controller v1.9.5
helm-controller v1.6.4
notification-controller v1.9.4
image-reflector-controller v1.2.5
image-automation-controller v1.2.5

CLI changelog

Update fluxcd/pkg dependencies by @fluxcdbot in #6046
Update fluxcd/pkg dependencies by @fluxcdbot in #6048
Update toolkit components by @fluxcdbot in #6049

Full Changelog: https://github.com/fluxcd/flux2/compare/v2.9.4...v2.9.5

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [fluxcd/flux2](https://github.com/fluxcd/flux2) | patch | `v2.9.4` -> `v2.9.5` | --- ### Release Notes <details> <summary>fluxcd/flux2 (fluxcd/flux2)</summary> ### [`v2.9.5`](https://github.com/fluxcd/flux2/releases/tag/v2.9.5) [Compare Source](https://github.com/fluxcd/flux2/compare/v2.9.4...v2.9.5) #### Highlights Flux v2.9.5 is a patch release that moves helm-controller and source-controller back to upstream Helm, now at v4.2.4, dropping the temporary Flux fork. It hardens the handling of kubeconfig Secrets in helm-controller and kustomize-controller, which now reject kubeconfigs referencing files on the local filesystem and require credentials and certificates to be embedded inline. It also stops kustomize-controller from leaving behind the temporary directories of a previous process that exited without running its cleanup, and fixes a crash in post-build substitution where a substring expression with a negative length, e.g. `${VAR:2:-1}`, panicked instead of counting back from the end of the string like Bash does. Across all controllers and the CLI, the fluxcd/pkg dependencies have been updated, bringing Kubernetes to 1.36.4. Users are encouraged to upgrade for the best experience. ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version. Fixes: - Validate kubeconfigs from `.spec.kubeConfig` Secrets, rejecting local file references in `certificate-authority`, `tokenFile`, `client-certificate` and `client-key`; credentials and certificates must be embedded inline (helm-controller, kustomize-controller) - Purge temporary directories at startup (kustomize-controller) - Fix panic on negative-length substring expressions in post-build substitution (kustomize-controller, flux CLI) Improvements: - Move back to upstream Helm v4.2.4, dropping the Flux fork (helm-controller, source-controller) - Update fluxcd/pkg dependencies, which bring Kubernetes to 1.36.4 (all controllers, flux CLI) #### Components changelog - source-controller [v1.9.5](https://github.com/fluxcd/source-controller/blob/v1.9.5/CHANGELOG.md) - source-watcher [v2.2.4](https://github.com/fluxcd/source-watcher/blob/v2.2.4/CHANGELOG.md) - kustomize-controller [v1.9.5](https://github.com/fluxcd/kustomize-controller/blob/v1.9.5/CHANGELOG.md) - helm-controller [v1.6.4](https://github.com/fluxcd/helm-controller/blob/v1.6.4/CHANGELOG.md) - notification-controller [v1.9.4](https://github.com/fluxcd/notification-controller/blob/v1.9.4/CHANGELOG.md) - image-reflector-controller [v1.2.5](https://github.com/fluxcd/image-reflector-controller/blob/v1.2.5/CHANGELOG.md) - image-automation-controller [v1.2.5](https://github.com/fluxcd/image-automation-controller/blob/v1.2.5/CHANGELOG.md) #### CLI changelog - Update fluxcd/pkg dependencies by [@fluxcdbot](https://github.com/fluxcdbot) in [#6046](https://github.com/fluxcd/flux2/pull/6046) - Update fluxcd/pkg dependencies by [@fluxcdbot](https://github.com/fluxcdbot) in [#6048](https://github.com/fluxcd/flux2/pull/6048) - Update toolkit components by [@fluxcdbot](https://github.com/fluxcdbot) in [#6049](https://github.com/fluxcd/flux2/pull/6049) **Full Changelog**: <https://github.com/fluxcd/flux2/compare/v2.9.4...v2.9.5> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

shark bot added 1 commit

2026-09-09 00:24:13 +00:00

chore(deps): update dependency fluxcd/flux2 to v2.9.5 d5a6ebe574