Flux v2.8.8
security++++++++++~~~~~!
Changes
- Update go-git to v5.19.1 which fixes CVE-2026-45571 and CVE-2026-45570 (source-controller, image-automation-controller)security
- Helm-controller v1.5.5changed
- Image-automation-controller v1.1.4changed
- Image-reflector-controller v1.1.2changed
- Source-controller v1.8.5changed
- Update toolkit componentschanged
- Add a configurable HTTP timeout for artifact fetching, preventing fetches that could block indefinitely and stall reconciliations (helm-controller)added
- Fix unbounded memory growth caused by a Kubernetes client transport retry wrapper accumulating on every reconcile (helm-controller)added
- Stop force-applying non-CRD objects placed under a chart's crds/ directory (helm-controller)added
- Fix the Helm test action failing to find releases with names longer than 53 characters (helm-controller)added
- Improve path handling in the source reconcilers (source-controller)added
- Support Helm semver build-metadata encoding in OCIRepository tags (source-controller)added
4 more lines
- Move Helm back to upstream v4.2.0 (source-controller, helm-controller)added
- Add support for GCP sovereign cloud artifact registries (source-controller, image-reflector-controller)added
- Upgrade Kubernetes to 1.36.1 (source-controller, helm-controller)added
- Update fluxcd/pkg dependenciesadded
16 lines1 security10 added5 changedtyped from the source notes