Merge pull request #2107 from fluxcd/release-v1.9.2

Release v1.9.2

Author: matheuscscp

CHANGELOG.md

@@ -2,6 +2,26 @@
 
 All notable changes to this project are documented in this file.
 
+## 1.9.2
+
+**Release date:** 2026-07-07
+
+This patch release disables Flux variable substitution on the source-controller
+CRDs by annotating them with `kustomize.toolkit.fluxcd.io/substitute: disabled`,
+so that Kustomizations with post-build substitution enabled no longer corrupt
+the CRD schemas when they contain `${...}` sequences. It also caches the
+registry authorization token during Notation verification, so the token is
+fetched once per verification instead of once per request, reducing
+token-endpoint traffic against the registry.
+
+Fixes:
+- Disable variable substitution in CRDs
+  [#2103](https://github.com/fluxcd/source-controller/pull/2103)
+
+Improvements:
+- Cache registry token during Notation verification
+  [#2105](https://github.com/fluxcd/source-controller/pull/2105)
+
 ## 1.9.1
 
 **Release date:** 2026-06-30

config/manager/kustomization.yaml

@@ -6,4 +6,4 @@ resources:
 images:
 - name: fluxcd/source-controller
   newName: fluxcd/source-controller
-  newTag: v1.9.1
+  newTag: v1.9.2

go.mod

@@ -39,7 +39,7 @@ require (
 	github.com/fluxcd/pkg/tar v1.2.0
 	github.com/fluxcd/pkg/testserver v0.14.0
 	github.com/fluxcd/pkg/version v0.16.0
-	github.com/fluxcd/source-controller/api v1.9.1
+	github.com/fluxcd/source-controller/api v1.9.2
 	github.com/go-git/go-billy/v5 v5.9.0
 	github.com/go-git/go-git/v5 v5.19.1
 	github.com/go-logr/logr v1.4.3