Highlights

Flux v2.10.0 is a feature release. Users are encouraged to upgrade for the best experience.

Overview of the new features:

• Object identity is generally available; the ObjectLevelWorkloadIdentity feature gate is retired
• SPIFFE mTLS for inter-controller communication
• Notification Event, Alert and Provider APIs promoted to v1
• OCIRepository as a chart source for HelmRelease
• SOPS decryption for files encrypted with comment regexes, and --override-manager-before-dry-run (Kustomization)
• Image update batching with .spec.policyChangeDelay, retry on rejected pushes, and .Changed.Summary (ImageUpdateAutomation)
• Flux artifact storage backend enabled by default for ImageRepository tags
• Cross-namespace artifacts, tenant namespace provisioning, and path-pattern discovery (ArtifactGenerator)
• New Zoom, incident.io and Mastodon notification providers
• Built with Kubernetes 1.37 and Go 1.27

❤️ Big thanks to all the Flux contributors that helped us with this release!

Kubernetes compatibility

This release is compatible with the following Kubernetes versions:

OpenShift compatibility

Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using Flux Operator. The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage.

Upgrade procedure

⚠️ Breaking changes in this release:

• Object identity is always enabled and the default Flux RBAC no longer grants the create verb on the serviceaccounts/token resource. If your installation relies on the default RBAC, bind a ClusterRole with this permission to the controller ServiceAccount before upgrading. See fluxcd/flux2#6139 for the required ClusterRole and ClusterRoleBinding.
• The notification Alert and Provider APIs are promoted to v1. Converting a v1beta3 Alert or Provider to v1 drops the deprecated Alert.spec.summary and Provider.spec.interval fields, the static JWT token for Azure Event Hub, and TLS or proxy configuration in Provider.spec.secretRef. Use eventMetadata.summary, proxySecretRef and certSecretRef instead.
• The Flux artifact storage backend is now the default for the ImageRepository tag database. Switching the gate wipes the local tag database, so the first reconciliation after the upgrade rescans every ImageRepository. Set --feature-gates=FluxStorage=false to keep using BadgerDB.
• Remote cluster authentication with .spec.kubeConfig.configMapRef uses object identity; replace the legacy audiences key with credential.auth.fluxcd.io/audiences.

Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from older versions of Flux to v2.10.

Components changelog

• source-controller v1.10.1
• kustomize-controller v1.10.1
• notification-controller v1.10.0
• helm-controller v1.7.1
• image-reflector-controller v1.3.0
• image-automation-controller v1.3.0
• source-watcher v2.3.1

CLI changelog

• Add backport label for 2.9 by @matheuscscp in #5970
• Fix breaking change in-memory kustomization build by @matheuscscp in #5969
• Update fluxcd/pkg dependencies by @fluxcdbot in #5976
• Update toolkit components by @fluxcdbot in #5978
• Add checksum verification for SOPS in e2e workflows by @ivonaest in #5961
• Add --add-ignore-paths flag to artifact commands by @ruslan-shaydullin in #5885
• Update fluxcd/pkg dependencies by @fluxcdbot in #5983
• Update fluxcd/pkg dependencies by @fluxcdbot in #5989
• Update toolkit components by @fluxcdbot in #5993
• Include source-watcher to oci flux-manifests by @sergelogvinov in #5995
• docs: fix typo in RFC-0004 (enviornment -> environment) by @mridulagithub in #6002
• Update fluxcd/pkg dependencies by @fluxcdbot in #6005
• Update toolkit components by @fluxcdbot in #6010
• Add version-file input to the Flux CLI action by @somaz94 in #5975
• Add support for 2.9 in migrate -f by @matheuscscp in #6020
• Fix Azure e2e tests after new major version with breaking changes by @matheuscscp in #6022
• fix: restrict allow-webhooks netpol to receiver port by @stefanprodan in #6028
• Update toolkit components by @fluxcdbot in #6030
• Update toolkit components by @fluxcdbot in #6050
• build(deps): bump the ci group across 1 directory with 19 updates by @dependabot[bot] in #6052
• Format reproducible created timestamp in UTC by @lexfrei in #6074
• Update to Kubernetes 1.37 by @stefanprodan in #6082
• Run conformance tests for Kubernetes 1.37 by @stefanprodan in #6083
• Remove the Cosign v2.6.1 pin by @matheuscscp in #6084
• Add --app-client-id flag to create secret githubapp by @Erik-Schuetze in #6090
• Update toolkit components by @fluxcdbot in #6096
• Match plugin archive entries with a leading ./ by @Saadanjum0 in #6099
• Stop diff processing after an error by @idelchi in #6070
• Respect pruning exclusions in kustomization diff by @idelchi in #6073
• Introduce RBAC for ArtifactGenerator cross-namespace artifacts by @matheuscscp in #6101
• [RFC-0014] Advanced Support for Short-Lived Cryptographic Material by @matheuscscp in #5702
• Validate plugin manifest name by @Arawoof06 in #6104
• ci: disable Replicated conformance tests by @stefanprodan in #6111
• [RFC-0014] RFC refinements by @matheuscscp in #6105
• [RFC-0014] Annotations for AWS STS Endpoint and Docker Hub OIDC Connection by @matheuscscp in #6114
• Update to Kubernetes 1.37.1 and Go 1.27 by @stefanprodan in #6117
• build(deps): bump the ci group across 1 directory with 15 updates by @dependabot[bot] in #6118
• [RFC-0014] Add rules for missing corner cases by @matheuscscp in #6121
• [RFC-0014] Address final nits arising from apis/crypto implementation by @matheuscscp in #6122
• [RFC-0014] Final iterations for 2.10 by @matheuscscp in #6125
• Revert "Introduce RBAC for ArtifactGenerator cross-namespace artifacts" by @matheuscscp in #6129
• Allow controllers to perform SubjectAccessReview by @matheuscscp in #6132
• Accept TYPE/NAME resource args in get/reconcile by @souvik-biswas-dev in #6134
• Add digests flag to plugin search, which displays SHA values for all os/arch per binary by @datosh in #6016
• Extend kubectl-style resource args to all Flux kinds and commands by @stefanprodan in #6135
• Escape terminal control characters in CLI output by @Arawoof06 in #6110
• Add suspend, resume and reconcile commands for ArtifactGenerator by @xchose in #6119
• [RFC-0014] Address review findings by @matheuscscp in #6136
• [RFC-0014] Inter-controller mTLS via SPIFFE by @matheuscscp in #6127
• Fix proxy bypass in bootstrap --ca-file by @ljluestc in #6038
• use restrictive file modes for generated manifests by @Arawoof06 in #6113
• fix(goreleaser): make Homebrew formula pass brew audit by @trademomentumllc in #5973
• Fix envsubst dropping inpu...

Highlights

Flux v2.9.6 is a patch release that stops helm-controller from reapplying chart CRDs on every upgrade when server-side apply is enabled, and recovers HelmReleases left with a drifted Ready=Unknown condition after a failed status patch. source-controller normalizes Azure Blob listing ETags so unchanged containers are no longer re-downloaded on every reconcile, and evicts stale Helm repository index entries from the cache so repositories with frequently changing indexes no longer fail with "Cache is full". kustomize-controller extends SOPS decryption error redaction to spec.postBuild.substituteFrom values, so substituted secrets echoed back in API validation errors are masked out of status conditions and events, and adds the opt-in DisableCommitStatusEvent feature gate. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Stop reapplying chart CRDs on upgrades when using server-side apply with the default Create policy (helm-controller)
• Recover HelmReleases stranded with a drifted Ready=Unknown condition after a failed status patch (helm-controller)
• Ignore NotFound when deleting the HelmChart (helm-controller)
• Normalize Azure Blob listing ETags so unchanged containers are not re-downloaded on every reconcile (source-controller)
• Evict stale Helm repository index entries from the cache to avoid "Cache is full" errors (source-controller)
• Extend SOPS decryption error redaction to spec.postBuild.substituteFrom values (kustomize-controller)

Improvements:

• Add the opt-in DisableCommitStatusEvent feature gate (kustomize-controller)

Components changelog

• source-controller v1.9.6
• kustomize-controller v1.9.6
• helm-controller v1.6.5

CLI changelog

• [release/v2.9.x] Format reproducible created timestamp in UTC by @fluxcdbot in #6081
• Update toolkit components by @fluxcdbot in #6097

Full Changelog: v2.9.5...v2.9.6

Highlights

Flux v2.9.5 is a patch release that moves helm-controller and source-controller back to upstream Helm, now at v4.2.4, dropping the temporary Flux fork. It hardens the handling of kubeconfig Secrets in helm-controller and kustomize-controller, which now reject kubeconfigs referencing files on the local filesystem and require credentials and certificates to be embedded inline. It also stops kustomize-controller from leaving behind the temporary directories of a previous process that exited without running its cleanup, and fixes a crash in post-build substitution where a substring expression with a negative length, e.g. ${VAR:2:-1}, panicked instead of counting back from the end of the string like Bash does. Across all controllers and the CLI, the fluxcd/pkg dependencies have been updated, bringing Kubernetes to 1.36.4. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Validate kubeconfigs from .spec.kubeConfig Secrets, rejecting local file references in certificate-authority, tokenFile, client-certificate and client-key; credentials and certificates must be embedded inline (helm-controller, kustomize-controller)
• Purge temporary directories at startup (kustomize-controller)
• Fix panic on negative-length substring expressions in post-build substitution (kustomize-controller, flux CLI)

Improvements:

• Move back to upstream Helm v4.2.4, dropping the Flux fork (helm-controller, source-controller)
• Update fluxcd/pkg dependencies, which bring Kubernetes to 1.36.4 (all controllers, flux CLI)

Components changelog

• source-controller v1.9.5
• source-watcher v2.2.4
• kustomize-controller v1.9.5
• helm-controller v1.6.4
• notification-controller v1.9.4
• image-reflector-controller v1.2.5
• image-automation-controller v1.2.5

CLI changelog

• Update fluxcd/pkg dependencies by @fluxcdbot in #6046
• Update fluxcd/pkg dependencies by @fluxcdbot in #6048
• Update toolkit components by @fluxcdbot in #6049

Full Changelog: v2.9.4...v2.9.5

Highlights

Flux v2.9.4 is a patch release that ships various fixes to the Flux controllers, covering source-watcher tarball extraction and glob expansion limits, the refspecs accepted by ImageUpdateAutomation, the HTTP request limits of the notification-controller servers, and Helm repository index loading, OCI chart digest pinning, Bucket error handling and GCS static authentication in source-controller. On the CLI side, flux migrate -f now supports migrating repositories to Flux 2.9. Users are encouraged to upgrade for the best experience.

Note that this release contains CRD schema changes for ArtifactGenerator and ImageUpdateAutomation; both CRDs must be updated along with the controllers.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Confine tarball extraction and bound glob expansion (source-watcher)
• Disallow force-update and deletion via refspecs (image-automation-controller)
• Unify HTTP server request limits (notification-controller)
• Align Helm repository index loading with upstream Helm v4 (source-controller)
• Improve error handling in Bucket reconciliation (source-controller)
• Pin OCI chart verification by digest (source-controller)
• Limit GCS static authentication to service account keys (source-controller)
• Restrict the allow-webhooks network policy to the receiver port (flux CLI)

Improvements:

• Add support for migrating repositories to 2.9 in flux migrate -f (flux CLI)
• Update fluxcd/pkg dependencies, which align the ECR host detection with upstream (source-controller, image-reflector-controller, flux CLI)
• Update Bitbucket Cloud receiver guidance (notification-controller)

Components changelog

• source-controller v1.9.4
• source-watcher v2.2.3
• notification-controller v1.9.3
• image-reflector-controller v1.2.4
• image-automation-controller v1.2.4

CLI changelog

• [release/v2.9.x] Add support for 2.9 in migrate -f by @fluxcdbot in #6021
• Update fluxcd/pkg dependencies by @fluxcdbot in #6026
• [release/v2.9.x] fix: restrict allow-webhooks netpol to receiver port by @fluxcdbot in #6029
• Update toolkit components by @fluxcdbot in #6031

Full Changelog: v2.9.3...v2.9.4

Highlights

Flux v2.9.3 is a patch release. It fixes empty lines vanishing from rendered Helm chart manifests, HelmReleases being marked as tested when their Helm test hooks never ran, and spec.images entries that set only some image fields discarding the remaining fields already declared for the same image in the kustomization.yaml. The latter affects both kustomize-controller and the flux build|diff kustomization commands. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Fix empty lines vanishing from rendered chart manifests (helm-controller)
• Fix HasBeenTested for all corner cases, where a release could be marked as tested although its Helm test hooks never ran (helm-controller)
• Fix a spec.images entry setting only some of the image fields discarding the remaining fields already declared for the same image in the kustomization.yaml at spec.path, e.g. overriding only newName produced an untagged image reference (kustomize-controller, flux CLI)

Improvements:

• Update fluxcd/pkg dependencies
• Include source-watcher in the OCI flux-manifests artifact

Components changelog

• kustomize-controller v1.9.4
• helm-controller v1.6.3

CLI changelog

• [release/v2.9.x] Include source-watcher to oci flux-manifests by @fluxcdbot in #5996
• Update fluxcd/pkg dependencies by @fluxcdbot in #6006
• Update toolkit components by @fluxcdbot in #6011

Full Changelog: v2.9.2...v2.9.3

Highlights

Flux v2.9.2 is a patch release. The main fix addresses a regression introduced in
v2.9.1 where a Kustomization with openapi.path pointing to a URL failed to
reconcile with failed to read OpenAPI schema. This release also corrects several
CRD field descriptions that contained inaccurate or leaked content. Users are
encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Fix a regression where a Kustomization with openapi.path pointing to a URL failed to reconcile with failed to read OpenAPI schema (kustomize-controller)
• Fix the HelmChart CRD description for .status.url, which pointed users at BucketStatus.Artifact instead of HelmChartStatus.Artifact (source-controller)
• Fix the ImageRepository CRD description for .status.observedExclusionList, which referred to spec.lastScanResult instead of status.lastScanResult (image-reflector-controller)
• Fix the ImageUpdateAutomation CRD description for .status.observedSourceRevision, which had a stray Go struct declaration leaking into it (image-automation-controller)

Improvements:

• Update fluxcd/pkg dependencies

Components changelog

• source-controller v1.9.3
• kustomize-controller v1.9.3
• helm-controller v1.6.2
• notification-controller v1.9.2
• image-reflector-controller v1.2.3
• image-automation-controller v1.2.3
• source-watcher v2.2.2

CLI changelog

• Update fluxcd/pkg dependencies by @fluxcdbot in #5984
• Update fluxcd/pkg dependencies by @fluxcdbot in #5990
• Update toolkit components by @fluxcdbot in #5994

Full Changelog: v2.9.1...v2.9.2

Highlights

Flux v2.9.1 is a patch release. The main fix, applied across all controllers, disables Flux variable substitution on the Flux CRDs by annotating them with kustomize.toolkit.fluxcd.io/substitute: disabled, so that Kustomizations with post-build substitution enabled no longer corrupt the CRD schemas when they contain ${...} sequences. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Disable Flux variable substitution on all Flux CRDs, preventing post-build substitution from corrupting CRD schemas that contain ${...} sequences (all controllers)
• Update SOPS dependency to fix .ini file decryption (kustomize-controller)
• Fix a dry-run error where applying a resource with a strategic merge patch could fail with <resource> is invalid (kustomize-controller)
• Fix a breaking change in the in-memory Kustomization build (Flux CLI)

Improvements:

• Cache the registry authorization token during Notation verification, so it is fetched once per verification instead of once per request (source-controller)
• Update fluxcd/pkg dependencies

Components changelog

• source-controller v1.9.2
• kustomize-controller v1.9.2
• helm-controller v1.6.2
• notification-controller v1.9.2
• image-reflector-controller v1.2.2
• image-automation-controller v1.2.2
• source-watcher v2.2.2

CLI changelog

• [release/v2.9.x] Fix breaking change in-memory kustomization build by @fluxcdbot in #5971
• Update fluxcd/pkg dependencies by @fluxcdbot in #5977
• Update toolkit components by @fluxcdbot in #5979

Full Changelog: v2.9.0...v2.9.1

Highlights

Flux v2.9.0 is a feature release. Users are encouraged to upgrade for the best experience.

For a compressive overview of new features and API changes included in this release, please refer to the Announcing Flux 2.9 GA blog post.

Overview of the new features:

• Flux CLI Plugin System with the Mirror and Schema plugins (flux plugin)
• Server-Side Apply field ignore rules for fine-grained drift control (Kustomization)
• SOPS decryption with the Age post-quantum cipher (Kustomization)
• Kubernetes Workload Identity authentication for OpenBao and Vault (Kustomization)
• Helm post-render strategies, including chart hooks support (HelmRelease)
• Literal mode for Helm values references mirroring helm --set-literal (HelmRelease)
• Allow empty kind in CEL health check expressions (Kustomization, HelmRelease)
• Git commit signing and verification with SSH keys (GitRepository, ImageUpdateAutomation)
• AWS CodeCommit authentication using Workload Identity (GitRepository)
• Custom Sigstore trusted root for keyless verification in air-gapped environments (OCIRepository)
• Path pattern directory discovery for monorepos (ArtifactGenerator)
• Secret-less, OIDC-secured webhook Receivers (Receiver)

❤️ Big thanks to all the Flux contributors that helped us with this release!

Kubernetes compatibility

This release is compatible with the following Kubernetes versions:

OpenShift compatibility

Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using Flux Operator. The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage.

Upgrade procedure

⚠️ The Flux APIs image.toolkit.fluxcd.io/v1beta2 and notification.toolkit.fluxcd.io/v1beta2
have reached end-of-life and have been removed from the CRDs.

Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from older versions of Flux to v2.9.

Components changelog

• source-controller v1.9.1
• kustomize-controller v1.9.1
• notification-controller v1.9.1
• helm-controller v1.6.1
• image-reflector-controller v1.2.1
• image-automation-controller v1.2.1
• source-watcher v2.2.1

CLI changelog

• Add backport label for Flux 2.8 by @matheuscscp in #5732
• Remove no longer needed workaround for Flux 2.8 by @matheuscscp in #5733
• Update toolkit components by @fluxcdbot in #5740
• Add missing things to release notes template by @matheuscscp in #5743
• ci: add top-level permissions to upgrade-fluxcd-pkg workflow by @gaganhr94 in #5763
• build(deps): bump the ci group across 1 directory with 11 updates by @dependabot[bot] in #5764
• Update fluxcd/pkg dependencies by @fluxcdbot in #5766
• Update toolkit components by @fluxcdbot in #5769
• Add target branch name to update branch by @matheuscscp in #5773
• Fix/resume exit code by @Aman-Cool in #5701
• Mark RFC 0010, 0011 and 0012 as implemented by @stefanprodan in #5776
• Update toolkit components by @fluxcdbot in #5780
• Add --resolve-symlinks flag to build and push artifact commands by @rohansood10 in #5724
• fix: validate --source flag in create kustomization command by @gma1k in #5798
• Update toolkit components by @fluxcdbot in #5821
• Add --show-source to flux get ks and flux get hr by @rafaelperoco in #5828
• Add flux create secret receiver command by @stefanprodan in #5835
• fix: handle multiple symlinks to same target in build artifact by @Iam-Karan-Suresh in #5833
• Add --in-memory-build to flux build ks and flux diff ks by @rycli in #5794
• Migrate end-to-end test to latest cloud SDKs by @stefanprodan in #5840
• docs: Add AI Coding Assistants Guidance by @stefanprodan in #5841
• Add AI Agents guidance by @stefanprodan in #5847
• [RFC-0013] Flux CLI Plugin System by @stefanprodan in #5795
• Add --ignore-not-found to flux diff ks by @rycli in #5845
• [RFC-0013] Implement plugin system by @stefanprodan in #5849
• build(deps): bump github.com/go-git/go-git/v5 from 5.17.1 to 5.18.0 by @dependabot[bot] in #5853
• Update toolkit components by @fluxcdbot in #5856
• Add digest pinning support to flux plugin install by @Iam-Karan-Suresh in #5872
• Add --ns-follows-kube-context global flag for using the kubeconfig context namespace by @jtyr in #5831
• include source-watcher in install.yaml manifests by @tmmorin in #5881
• Update toolkit components by @fluxcdbot in #5890
• Update toolkit components by @fluxcdbot in #5903
• Update fluxcd/pkg dependencies by @fluxcdbot in #5907
• Validate Helm source URL schemes by @immanuwell in #5909
• Introduce flux trigger receiver by @matheuscscp in #5908
• refactor(api): migrate MakeDependsOn to shared apis/meta func by @vecil in #5912
• Update to Kubernetes 1.36 and Go 1.26 by @stefanprodan in #5924
• build(deps): bump the ci group across 1 directory with 19 updates by @dependabot[bot] in #5925
• Run conformance tests for Kubernetes 1.36 by @stefanprodan in #5926
• Add support for AWS CodeCommit to flux bootstrap git by @taraspos in #5868
• Validate plugin binary path by @stefanprodan in #5927
• Update fluxcd/pkg dependencies by @fluxcdbot in #5928
• fix: preserve invalid metadata.labels in flux build ks by @raffis in #5906
• build: target host arch for local builds/envtest by @stealthybox in #5932
• build(deps): bump the ci group with 6 updates by @dependabot[bot] in #5938
• Support specifing sparseCheckout in flux bootstrap by @piny940 in #5918
• Update toolkit components by @fluxcdbot in #5944
• Honor ks.spec.postBuild.substituteStrategy by @matheuscscp in #5945
• Add DriftIgnoreRules support to flux diff kustomization by @dipti-pai in #5923
• Allow signing commits using SSH key by @hiddeco in #5920
• Update toolkit components by @fluxcdbot in #5950
• Update fluxcd/pkg dependencies by @fluxcdbot in #5937
• cmd: support type!=status in get --status-selector by @3uzbcqje in #5952
• Fix flux get all --status-selector for empty results and notification resources by @matheuscscp in #5954
• Upgrade go-git-providers to v0.27.0 by @matheuscscp in #5956
• Fix using Receiver adapter for ArtifactGenerator by @matheuscscp in #5957
• feat: Install Plugins alongside Flux setup in gh actions by @gat786 in #5955
• Update fluxcd/pkg dependencies by @fluxcdbot in #5960
• Add CLI support for OCIRepository.spec.layerSelector in flux create source oci by @dme86 in #5892
• Update toolkit components by @fluxc...

Highlights

Flux v2.8.8 is a patch release that includes CVE fixes via go-git v5.19.1 (source-controller, image-automation-controller), reliability fixes in helm-controller and source-controller, the move of Helm back to upstream v4.2.0, support for GCP sovereign cloud artifact registries, and dependency updates. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Add a configurable HTTP timeout for artifact fetching, preventing fetches that could block indefinitely and stall reconciliations (helm-controller)
• Fix unbounded memory growth caused by a Kubernetes client transport retry wrapper accumulating on every reconcile (helm-controller)
• Stop force-applying non-CRD objects placed under a chart's crds/ directory (helm-controller)
• Fix the Helm test action failing to find releases with names longer than 53 characters (helm-controller)
• Improve path handling in the source reconcilers (source-controller)
• Support Helm semver build-metadata encoding in OCIRepository tags (source-controller)

Improvements:

• Update go-git to v5.19.1 which fixes CVE-2026-45571 and CVE-2026-45570 (source-controller, image-automation-controller)
• Move Helm back to upstream v4.2.0 (source-controller, helm-controller)
• Add support for GCP sovereign cloud artifact registries (source-controller, image-reflector-controller)
• Upgrade Kubernetes to 1.36.1 (source-controller, helm-controller)
• Update fluxcd/pkg dependencies

Components changelog

• helm-controller v1.5.5
• image-automation-controller v1.1.4
• image-reflector-controller v1.1.2
• source-controller v1.8.5

CLI changelog

• Update toolkit components by @fluxcdbot in #5904

Full Changelog: v2.8.7...v2.8.8

Highlights

Flux v2.8.7 is a patch release that includes a bug fix in kustomize-controller, a CVE fix in source-controller and image-automation-controller via go-git v5.19.0, and dependency updates. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Fix management of objects annotated with kustomize.toolkit.fluxcd.io/ssa: IfNotPresent where non-namespaced resources were being deleted and recreated on each reconciliation (kustomize-controller)

Improvements:

• Update go-git to v5.19.0 which fixes CVE-2026-45022 (source-controller, image-automation-controller)
• Update fluxcd/pkg dependencies (source-controller, kustomize-controller, image-automation-controller)

Components changelog

• helm-controller v1.5.4
• image-automation-controller v1.1.3
• kustomize-controller v1.8.5
• notification-controller v1.8.4
• source-controller v1.8.4

CLI changelog

• Update toolkit components by @fluxcdbot in #5891

Full Changelog: v2.8.6...v2.8.7