chore(deps): bump the go group across 1 directory with 5 updates by dependabot[bot] · Pull Request #964 · open-component-model/ocm-controller

dependabot · 2026-07-12T15:04:04Z

Bumps the go group with 5 updates in the / directory:

Package	From	To
github.com/fluxcd/helm-controller/api	`1.6.1`	`1.6.2`
github.com/fluxcd/kustomize-controller/api	`1.9.1`	`1.9.3`
github.com/fluxcd/pkg/kustomize	`1.36.0`	`1.38.0`
github.com/fluxcd/source-controller/api	`1.9.1`	`1.9.3`
helm.sh/helm/v3	`3.21.2`	`3.21.3`

Updates github.com/fluxcd/helm-controller/api from 1.6.1 to 1.6.2

Release notes

Sourced from github.com/fluxcd/helm-controller/api's releases.

v1.6.2

Changelog

v1.6.2 changelog

Container images

docker.io/fluxcd/helm-controller:v1.6.2

ghcr.io/fluxcd/helm-controller:v1.6.2

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/helm-controller/api's changelog.

1.6.2

Release date: 2026-07-07

This patch release disables Flux variable substitution on the HelmRelease CRD. The CRD is now annotated with kustomize.toolkit.fluxcd.io/substitute: disabled so that Kustomizations with post-build substitution enabled no longer corrupt the CRD schema when it contains ${...} sequences.

Fixes:

Disable variable substitution in CRDs #1538

Commits

7cabcd8 Merge pull request #1540 from fluxcd/release-v1.6.2
d32b57a Release v1.6.2
6104719 Add changelog entry for v1.6.2
7a0cbae Merge pull request #1538 from fluxcd/backport-1537-to-release/v1.6.x
95a3a56 Disable variable substition in CRDs
See full diff in compare view

Updates github.com/fluxcd/kustomize-controller/api from 1.9.1 to 1.9.3

Release notes

Sourced from github.com/fluxcd/kustomize-controller/api's releases.

v1.9.3

Changelog

v1.9.3 changelog

Container images

docker.io/fluxcd/kustomize-controller:v1.9.3

ghcr.io/fluxcd/kustomize-controller:v1.9.3

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

v1.9.2

Changelog

v1.9.2 changelog

Container images

docker.io/fluxcd/kustomize-controller:v1.9.2

ghcr.io/fluxcd/kustomize-controller:v1.9.2

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/kustomize-controller/api's changelog.

1.9.3

Release date: 2026-07-13

This patch release fixes a regression introduced in v1.9.2 where a Kustomization with openapi.path pointing to a URL failed to reconcile with failed to read OpenAPI schema.

Fixes:

Update fluxcd/pkg dependencies #1703

1.9.2

Release date: 2026-07-07

This patch release fixes three bugs. Flux variable substitution is now disabled on the Kustomization CRD by annotating it with kustomize.toolkit.fluxcd.io/substitute: disabled, preventing post-build substitution from corrupting the CRD schema when it contains ${...} sequences. The SOPS dependency was updated to fix decryption of .ini files. Finally, the fluxcd/pkg dependencies were updated to fix a dry-run error where applying a resource with a strategic merge patch could fail with <resource> is invalid.

Fixes:

Fix CRD going through variable substitution #1694

Update SOPS dependency to fix .ini file decryption #1699

Update fluxcd/pkg dependencies #1697

Commits

65f69a8 Merge pull request #1710 from fluxcd/release-v1.9.3
5a91c68 Release v1.9.3
5c230f8 Add changelog entry for v1.9.3
a98b610 Merge pull request #1709 from fluxcd/backport-ci
579657f ci: parallelize e2e job to speed it up
29e8364 Merge pull request #1703 from fluxcd/update-pkg-deps/release/v1.9.x
dbecc76 Update fluxcd/pkg dependencies
dbb931d Merge pull request #1701 from fluxcd/release-v1.9.2
87286b1 Release v1.9.2
0f32b00 Add changelog entry for v1.9.2
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/kustomize from 1.36.0 to 1.38.0

Commits

e2882a1 Merge pull request #1260 from fluxcd/fix-flux2-5981
4ccc4a6 kustomize: load builtin schemas after reset
59c882f Revert "kustomize: support merging the input OpenAPI schemas with the built-i...
f739e0e Merge pull request #1258 from fluxcd/fix-flux2-5972
add36fa kustomize: support merging the input OpenAPI schemas with the built-in ones
61592ec Merge pull request #1257 from Nordix/fix/sops_action_update
c5da74e Add checksum verification for SOPS in actions.yml
See full diff in compare view

Updates github.com/fluxcd/source-controller/api from 1.9.1 to 1.9.3

Release notes

Sourced from github.com/fluxcd/source-controller/api's releases.

v1.9.3

Changelog

v1.9.3 changelog

Container images

docker.io/fluxcd/source-controller:v1.9.3

ghcr.io/fluxcd/source-controller:v1.9.3

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

v1.9.2

Changelog

v1.9.2 changelog

Container images

docker.io/fluxcd/source-controller:v1.9.2

ghcr.io/fluxcd/source-controller:v1.9.2

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/source-controller/api's changelog.

1.9.3

Release date: 2026-07-13

This patch release fixes the HelmChart CRD description for .status.url, which was copy-pasted from Bucket and pointed users at BucketStatus.Artifact instead of HelmChartStatus.Artifact.

Improvements:

Fix HelmChartStatus.URL doc-comment referencing BucketStatus #2110

1.9.2

Release date: 2026-07-07

This patch release disables Flux variable substitution on the source-controller CRDs by annotating them with kustomize.toolkit.fluxcd.io/substitute: disabled, so that Kustomizations with post-build substitution enabled no longer corrupt the CRD schemas when they contain ${...} sequences. It also caches the registry authorization token during Notation verification, so the token is fetched once per verification instead of once per request, reducing token-endpoint traffic against the registry.

Fixes:

Disable variable substitution in CRDs #2103

Improvements:

Cache registry token during Notation verification #2105

Commits

ed61ebd Merge pull request #2111 from fluxcd/release-v1.9.3
03a1208 Release v1.9.3
f1e431a Add changelog entry for v1.9.3
deec0f1 Merge pull request #2110 from fluxcd/backport-2109-to-release/v1.9.x
048ce5c docs: regenerate API reference after doc-comment fix
2b0b313 Fix HelmChartStatus.URL doc-comment referencing BucketStatus
38cf78c Merge pull request #2107 from fluxcd/release-v1.9.2
43ebe98 Release v1.9.2
a0439ef Add changelog entry for v1.9.2
c4adb7f Merge pull request #2105 from fluxcd/backport-2098-to-release/v1.9.x
Additional commits viewable in compare view

Updates helm.sh/helm/v3 from 3.21.2 to 3.21.3

Release notes

Sourced from helm.sh/helm/v3's releases.

Helm v3.21.3 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

Join the discussion in Kubernetes Slack:

for questions and just to hang out

for discussing PRs, code, and bugs

Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom

Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.21.3. The common platform binaries are here:

MacOS amd64 (checksum / 76d0db4730b05d3d625eee11e80f0721b32b4d8422f4e5d093de6337bf3ac9f8)

MacOS arm64 (checksum / 19879a848cad832b7a1ac24b767a481d20fb3b95ab53a220849649422ada144e)

Linux amd64 (checksum / 15e041a93a590dce8100f39385cd98c84a765c9e36aeeb9e2dc6ff9e4769e2e0)

Linux arm (checksum / 60f3106ba5e24371af51574fccf489d382d2f59c56ce566d02f2a6f00bf4fb3b)

Linux arm64 (checksum / 67f58155079ff9ffab98ba5c88daff0ed9b542f3a4732f5dd426dde7dd0f5244)

Linux i386 (checksum / 95e7ef76d4631f30e3f6c17d4355420878ca85771dbe7deb7b797521007aebe4)

Linux ppc64le (checksum / c8657c0f77b7d3e2f9508c4a9a545b5862d01690f2a528fbbe659a3a4d534382)

Linux s390x (checksum / d6c2dd29b32da1cb9dfef5af0cb93a1f391beca4e714779186330681b39f4b59)

Linux riscv64 (checksum / ff063cc304a60af858242aa71b5635852d65aa7d3301a46eca17a31c54e8d994)

Windows amd64 (checksum / ff490897e07e976c65a9bd7690cfc139b35ba5e8f25d00eaf1e53a30f1ad3f62)

Windows arm64 (checksum / 1d409b98f99a38704ccb3f0917cbad2417ed53f75751902b6bd84447803b69a9)

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

4.2.4 and 3.21.4 are the next patch releases scheduled for August 12, 2026

4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

Apply suggestions from code review 1ad6e68924fdf6fb0c7dcef8e9e1dfc0f36eaed6 (Benoit Tigeot)

fix: drop containerd v1 dep to resolve govulncheck CVEs 037733e7d51b08e30a0233bd546c345ab3ea3bba (Benoit Tigeot)

chore(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33 d3e178ba06a8a1eeacaab1df9162b658b1e07fe9 (dependabot[bot])

Commits

1ad6e68 Apply suggestions from code review
037733e fix: drop containerd v1 dep to resolve govulncheck CVEs
d3e178b chore(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33
See full diff in compare view

frewilhelm · 2026-07-14T06:25:01Z

@dependabot rebase

Bumps the go group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/fluxcd/helm-controller/api](https://github.com/fluxcd/helm-controller) | `1.6.1` | `1.6.2` | | [github.com/fluxcd/kustomize-controller/api](https://github.com/fluxcd/kustomize-controller) | `1.9.1` | `1.9.3` | | [github.com/fluxcd/pkg/kustomize](https://github.com/fluxcd/pkg) | `1.36.0` | `1.38.0` | | [github.com/fluxcd/source-controller/api](https://github.com/fluxcd/source-controller) | `1.9.1` | `1.9.3` | | [helm.sh/helm/v3](https://github.com/helm/helm) | `3.21.2` | `3.21.3` | Updates `github.com/fluxcd/helm-controller/api` from 1.6.1 to 1.6.2 - [Release notes](https://github.com/fluxcd/helm-controller/releases) - [Changelog](https://github.com/fluxcd/helm-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/helm-controller@v1.6.1...v1.6.2) Updates `github.com/fluxcd/kustomize-controller/api` from 1.9.1 to 1.9.3 - [Release notes](https://github.com/fluxcd/kustomize-controller/releases) - [Changelog](https://github.com/fluxcd/kustomize-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/kustomize-controller@v1.9.1...v1.9.3) Updates `github.com/fluxcd/pkg/kustomize` from 1.36.0 to 1.38.0 - [Commits](fluxcd/pkg@kustomize/v1.36.0...kustomize/v1.38.0) Updates `github.com/fluxcd/source-controller/api` from 1.9.1 to 1.9.3 - [Release notes](https://github.com/fluxcd/source-controller/releases) - [Changelog](https://github.com/fluxcd/source-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/source-controller@v1.9.1...v1.9.3) Updates `helm.sh/helm/v3` from 3.21.2 to 3.21.3 - [Release notes](https://github.com/helm/helm/releases) - [Commits](helm/helm@v3.21.2...v3.21.3) --- updated-dependencies: - dependency-name: github.com/fluxcd/helm-controller/api dependency-version: 1.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/kustomize-controller/api dependency-version: 1.9.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/pkg/kustomize dependency-version: 1.38.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/fluxcd/source-controller/api dependency-version: 1.9.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: helm.sh/helm/v3 dependency-version: 3.21.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels Jul 12, 2026

dependabot Bot requested a review from a team as a code owner July 12, 2026 15:04

dependabot Bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels Jul 12, 2026

matthiasbruns previously approved these changes Jul 13, 2026

View reviewed changes

dependabot Bot changed the title ~~chore(deps): bump the go group with 5 updates~~ chore(deps): bump the go group across 1 directory with 5 updates Jul 14, 2026

dependabot Bot dismissed matthiasbruns’s stale review via 9e766fa July 14, 2026 06:27

dependabot Bot force-pushed the dependabot/go_modules/go-b508396f6c branch from 39f84d2 to 9e766fa Compare July 14, 2026 06:27

frewilhelm enabled auto-merge (squash) July 14, 2026 06:27

frewilhelm approved these changes Jul 14, 2026

View reviewed changes

frewilhelm merged commit ade813f into main Jul 14, 2026
9 checks passed

frewilhelm deleted the dependabot/go_modules/go-b508396f6c branch July 14, 2026 06:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the go group across 1 directory with 5 updates#964

chore(deps): bump the go group across 1 directory with 5 updates#964
frewilhelm merged 1 commit into
mainfrom
dependabot/go_modules/go-b508396f6c

dependabot Bot commented on behalf of github Jul 12, 2026 •

edited

Loading

Uh oh!

frewilhelm commented Jul 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.6.2

Changelog

Container images

1.6.2

v1.9.3

Changelog

Container images

v1.9.2

Changelog

Container images

1.9.3

1.9.2

v1.9.3

Changelog

Container images

v1.9.2

Changelog

Container images

1.9.3

1.9.2

Installation and Upgrading

What's Next

Changelog

Uh oh!

frewilhelm commented Jul 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github Jul 12, 2026 •

edited

Loading