chore(deps): bump the go group with 5 updates by dependabot[bot] · Pull Request #236 · open-component-model/ocm-e2e-framework

dependabot · 2026-04-12T06:23:44Z

Bumps the go group with 5 updates:

Package	From	To
github.com/fluxcd/flux2/v2	`2.8.3`	`2.8.5`
github.com/fluxcd/kustomize-controller/api	`1.8.2`	`1.8.3`
github.com/fluxcd/notification-controller/api	`1.8.2`	`1.8.3`
github.com/fluxcd/source-controller/api	`1.8.1`	`1.8.2`
ocm.software/ocm	`0.38.0`	`0.39.0`

Updates github.com/fluxcd/flux2/v2 from 2.8.3 to 2.8.5

Release notes

Sourced from github.com/fluxcd/flux2/v2's releases.

v2.8.5

Highlights

Flux v2.8.5 is a patch release that includes bug fixes and improvements across kustomize-controller, source-controller, and notification-controller. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

Fix a race condition where a cancelled reconciliation could leave stale data in the cache, causing Kustomizations to get stuck (kustomize-controller)

Fix Azure Blob prefix option not being passed to the storage client (source-controller)

Improvements:

Improve error message for encrypted SSH keys without password (source-controller)

Add optional email and audience fields to the GCR Receiver for tighter verification (notification-controller)

Add provider manifest example for Azure Event Hub managed identity authentication (notification-controller)

Components changelog

kustomize-controller v1.8.3

source-controller v1.8.2

notification-controller v1.8.3

CLI changelog

Update toolkit components by @fluxcdbot in fluxcd/flux2#5822

Full Changelog: fluxcd/flux2@v2.8.4...v2.8.5

v2.8.4

Highlights

Flux v2.8.4 is a patch release that includes fixes for the Flux CLI. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

Fix flux build ks and flux diff ks on Windows

Fix --source flag validation in create kustomization command

CLI changelog

Update fluxcd/pkg dependencies by @fluxcdbot in fluxcd/flux2#5796

[release/v2.8.x] fix: validate --source flag in create kustomization command by @fluxcdbot in fluxcd/flux2#5799

Full Changelog: fluxcd/flux2@v2.8.3...v2.8.4

Commits

5adad89 Merge pull request #5822 from fluxcd/update-components-release/v2.8.x
29cc0b3 Update toolkit components
3cf3cb5 Merge pull request #5799 from fluxcd/backport-5798-to-release/v2.8.x
1569932 fix: validate --source flag in create kustomization command
836f87e Merge pull request #5796 from fluxcd/update-pkg-deps/release/v2.8.x
19545a8 Update fluxcd/pkg dependencies
See full diff in compare view

Updates github.com/fluxcd/kustomize-controller/api from 1.8.2 to 1.8.3

Release notes

Sourced from github.com/fluxcd/kustomize-controller/api's releases.

v1.8.3

Changelog

v1.8.3 changelog

Container images

docker.io/fluxcd/kustomize-controller:v1.8.3

ghcr.io/fluxcd/kustomize-controller:v1.8.3

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/kustomize-controller/api's changelog.

1.8.3

Release date: 2026-04-07

This patch release fixes a race condition where a cancelled reconciliation could leave stale data in the cache, causing Kustomizations to get stuck.

Fixes:

Requeue on cancellation to avoid stale cache race condition #1625

Commits

8e93522 Merge pull request #1630 from fluxcd/release-v1.8.3
3016285 Release v1.8.3
8ea73d6 Add changelog entry for v1.8.3
45f975a Merge pull request #1626 from fluxcd/backport-1625-to-release/v1.8.x
8de1f6a Requeue on cancellation to avoid stale cache race condition
See full diff in compare view

Updates github.com/fluxcd/notification-controller/api from 1.8.2 to 1.8.3

Release notes

Sourced from github.com/fluxcd/notification-controller/api's releases.

v1.8.3

Changelog

v1.8.3 changelog

Container images

docker.io/fluxcd/notification-controller:v1.8.3

ghcr.io/fluxcd/notification-controller:v1.8.3

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/notification-controller/api's changelog.

1.8.3

Release date: 2026-04-07

This patch release adds optional email and audience fields to the GCR Receiver for tighter verification, and includes a provider manifest example for Azure Event Hub managed identity authentication.

Improvements:

Refactor GCR Receiver #1279

Add provider manifest example for Azure Event Hub managed identity auth #1275

Commits

e8dd599 Merge pull request #1282 from fluxcd/release-v1.8.3
4a0eb45 Release v1.8.3
cd43202 Add changelog entry for v1.8.3
2d2ebed Merge pull request #1281 from fluxcd/backport-1279-to-release/v1.8.x
61b0521 Refactor GCR Receiver
4ab88fe Merge pull request #1276 from fluxcd/backport-1275-to-release/v1.8.x
cace0eb Add provider manifest example for Azure Event Hub managed identity auth
See full diff in compare view

Updates github.com/fluxcd/source-controller/api from 1.8.1 to 1.8.2

Release notes

Sourced from github.com/fluxcd/source-controller/api's releases.

v1.8.2

Changelog

v1.8.2 changelog

Container images

docker.io/fluxcd/source-controller:v1.8.2

ghcr.io/fluxcd/source-controller:v1.8.2

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/source-controller/api's changelog.

1.8.2

Release date: 2026-04-07

This patch release fixes the Azure Blob prefix option not being passed to the storage client, and improves the error message when using encrypted SSH keys without a password.

Fixes:

Fix azure blob prefix option not passed #2014

Improvements:

Improve error message for encrypted SSH keys without password #2013

Commits

e1b0d6f Merge pull request #2022 from fluxcd/release-v1.8.2
0f11ff8 Release v1.8.2
345a234 Add changelog entry for v1.8.2
725815b Merge pull request #2018 from fluxcd/backport-2013-to-release/v1.8.x
956faff Improve error message for encrypted SSH keys without password
5add99f Merge pull request #2015 from fluxcd/backport-2014-to-release/v1.8.x
6d4c355 Fix azure blob prefix option not passed
See full diff in compare view

Updates ocm.software/ocm from 0.38.0 to 0.39.0

Release notes

Sourced from ocm.software/ocm's releases.

v0.39.0

What's Changed

⬆️ Dependencies

chore(deps): bump the go group across 1 directory with 16 updates by @dependabot[bot] in open-component-model/ocm#1868

chore(deps): bump google.golang.org/grpc from 1.79.2 to 1.79.3 by @dependabot[bot] in open-component-model/ocm#1871

chore(deps): bump the go group with 6 updates by @dependabot[bot] in open-component-model/ocm#1875

🧰 Maintenance

chore: bump VERSION to 0.39.0-dev by @ocmbot[bot] in open-component-model/ocm#1863

chore: update code of conduct link by @Skarlso in open-component-model/ocm#1873

Full Changelog: open-component-model/ocm@v0.38...v0.39.0

v0.39.0-rc.1

What's Changed

⬆️ Dependencies

chore(deps): bump the go group across 1 directory with 16 updates by @dependabot[bot] in open-component-model/ocm#1868

chore(deps): bump google.golang.org/grpc from 1.79.2 to 1.79.3 by @dependabot[bot] in open-component-model/ocm#1871

chore(deps): bump the go group with 6 updates by @dependabot[bot] in open-component-model/ocm#1875

🧰 Maintenance

chore: bump VERSION to 0.39.0-dev by @ocmbot[bot] in open-component-model/ocm#1863

chore: update code of conduct link by @Skarlso in open-component-model/ocm#1873

Full Changelog: open-component-model/ocm@v0.38...v0.39.0

Commits

afad52d chore(deps): bump the ci group with 3 updates (#1877)
dcde376 chore: update 'flake.nix' (#1876)
d53d156 chore(deps): bump the go group with 6 updates (#1875)
0296cfd chore(deps): bump actions/cache from 5.0.3 to 5.0.4 in the ci group (#1872)
f345599 chore: update 'flake.nix' (#1874)
8803551 chore(deps): bump google.golang.org/grpc from 1.79.2 to 1.79.3 (#1871)
36f060c chore: update code of conduct link (#1873)
9e528e2 chore(deps): bump github/codeql-action from 4.32.6 to 4.33.0 in the ci group ...
91917a6 chore: update 'flake.nix' (#1869)
b477b09 chore(deps): bump the go group across 1 directory with 16 updates (#1868)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go group with 5 updates: | Package | From | To | | --- | --- | --- | | [github.com/fluxcd/flux2/v2](https://github.com/fluxcd/flux2) | `2.8.3` | `2.8.5` | | [github.com/fluxcd/kustomize-controller/api](https://github.com/fluxcd/kustomize-controller) | `1.8.2` | `1.8.3` | | [github.com/fluxcd/notification-controller/api](https://github.com/fluxcd/notification-controller) | `1.8.2` | `1.8.3` | | [github.com/fluxcd/source-controller/api](https://github.com/fluxcd/source-controller) | `1.8.1` | `1.8.2` | | [ocm.software/ocm](https://github.com/open-component-model/ocm) | `0.38.0` | `0.39.0` | Updates `github.com/fluxcd/flux2/v2` from 2.8.3 to 2.8.5 - [Release notes](https://github.com/fluxcd/flux2/releases) - [Commits](fluxcd/flux2@v2.8.3...v2.8.5) Updates `github.com/fluxcd/kustomize-controller/api` from 1.8.2 to 1.8.3 - [Release notes](https://github.com/fluxcd/kustomize-controller/releases) - [Changelog](https://github.com/fluxcd/kustomize-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/kustomize-controller@v1.8.2...v1.8.3) Updates `github.com/fluxcd/notification-controller/api` from 1.8.2 to 1.8.3 - [Release notes](https://github.com/fluxcd/notification-controller/releases) - [Changelog](https://github.com/fluxcd/notification-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/notification-controller@v1.8.2...v1.8.3) Updates `github.com/fluxcd/source-controller/api` from 1.8.1 to 1.8.2 - [Release notes](https://github.com/fluxcd/source-controller/releases) - [Changelog](https://github.com/fluxcd/source-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/source-controller@v1.8.1...v1.8.2) Updates `ocm.software/ocm` from 0.38.0 to 0.39.0 - [Release notes](https://github.com/open-component-model/ocm/releases) - [Changelog](https://github.com/open-component-model/ocm/blob/main/RELEASE_PROCESS.md) - [Commits](open-component-model/ocm@v0.38...v0.39) --- updated-dependencies: - dependency-name: github.com/fluxcd/flux2/v2 dependency-version: 2.8.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/kustomize-controller/api dependency-version: 1.8.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/notification-controller/api dependency-version: 1.8.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/source-controller/api dependency-version: 1.8.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: ocm.software/ocm dependency-version: 0.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels Apr 12, 2026

dependabot bot requested a review from a team as a code owner April 12, 2026 06:23

frewilhelm approved these changes Apr 13, 2026

View reviewed changes

frewilhelm merged commit 2784096 into main Apr 13, 2026
5 checks passed

dependabot bot deleted the dependabot/go_modules/go-f4a487c1fd branch April 13, 2026 06:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the go group with 5 updates#236

chore(deps): bump the go group with 5 updates#236
frewilhelm merged 1 commit intomainfrom
dependabot/go_modules/go-f4a487c1fd

dependabot bot commented on behalf of github Apr 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot bot commented on behalf of github Apr 12, 2026

v2.8.5

Highlights

Components changelog

CLI changelog

v2.8.4

Highlights

CLI changelog

v1.8.3

Changelog

Container images

1.8.3

v1.8.3

Changelog

Container images

1.8.3

v1.8.2

Changelog

Container images

1.8.2

v0.39.0

What's Changed

⬆️ Dependencies

🧰 Maintenance

v0.39.0-rc.1

What's Changed

⬆️ Dependencies

🧰 Maintenance

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant