chore(deps): bump the go group with 5 updates (#236)

Bumps the go group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/fluxcd/flux2/v2](https://github.com/fluxcd/flux2) |
`2.8.3` | `2.8.5` |
|
[github.com/fluxcd/kustomize-controller/api](https://github.com/fluxcd/kustomize-controller)
| `1.8.2` | `1.8.3` |
|
[github.com/fluxcd/notification-controller/api](https://github.com/fluxcd/notification-controller)
| `1.8.2` | `1.8.3` |
|
[github.com/fluxcd/source-controller/api](https://github.com/fluxcd/source-controller)
| `1.8.1` | `1.8.2` |
| [ocm.software/ocm](https://github.com/open-component-model/ocm) |
`0.38.0` | `0.39.0` |

Updates `github.com/fluxcd/flux2/v2` from 2.8.3 to 2.8.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fluxcd/flux2/releases">github.com/fluxcd/flux2/v2's
releases</a>.</em></p>
<blockquote>
<h2>v2.8.5</h2>
<h2>Highlights</h2>
<p>Flux v2.8.5 is a patch release that includes bug fixes and
improvements across kustomize-controller, source-controller, and
notification-controller. Users are encouraged to upgrade for the best
experience.</p>
<p>ℹ️ Please follow the <a
href="https://github.com/fluxcd/flux2/discussions/5572">Upgrade
Procedure for Flux v2.7+</a> for a smooth upgrade from Flux v2.6 to the
latest version.</p>
<p>Fixes:</p>
<ul>
<li>Fix a race condition where a cancelled reconciliation could leave
stale data in the cache, causing Kustomizations to get stuck
(kustomize-controller)</li>
<li>Fix Azure Blob prefix option not being passed to the storage client
(source-controller)</li>
</ul>
<p>Improvements:</p>
<ul>
<li>Improve error message for encrypted SSH keys without password
(source-controller)</li>
<li>Add optional <code>email</code> and <code>audience</code> fields to
the GCR Receiver for tighter verification (notification-controller)</li>
<li>Add provider manifest example for Azure Event Hub managed identity
authentication (notification-controller)</li>
</ul>
<h2>Components changelog</h2>
<ul>
<li>kustomize-controller <a
href="https://github.com/fluxcd/kustomize-controller/blob/v1.8.3/CHANGELOG.md">v1.8.3</a></li>
<li>source-controller <a
href="https://github.com/fluxcd/source-controller/blob/v1.8.2/CHANGELOG.md">v1.8.2</a></li>
<li>notification-controller <a
href="https://github.com/fluxcd/notification-controller/blob/v1.8.3/CHANGELOG.md">v1.8.3</a></li>
</ul>
<h2>CLI changelog</h2>
<ul>
<li>Update toolkit components by <a
href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a
href="https://redirect.github.com/fluxcd/flux2/pull/5822">fluxcd/flux2#5822</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/fluxcd/flux2/compare/v2.8.4...v2.8.5">https://github.com/fluxcd/flux2/compare/v2.8.4...v2.8.5</a></p>
<h2>v2.8.4</h2>
<h2>Highlights</h2>
<p>Flux v2.8.4 is a patch release that includes fixes for the Flux CLI.
Users are encouraged to upgrade for the best experience.</p>
<p>ℹ️ Please follow the <a
href="https://github.com/fluxcd/flux2/discussions/5572">Upgrade
Procedure for Flux v2.7+</a> for a smooth upgrade from Flux v2.6 to the
latest version.</p>
<p>Fixes:</p>
<ul>
<li>Fix <code>flux build ks</code> and <code>flux diff ks</code> on
Windows</li>
<li>Fix <code>--source</code> flag validation in <code>create
kustomization</code> command</li>
</ul>
<h2>CLI changelog</h2>
<ul>
<li>Update fluxcd/pkg dependencies by <a
href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a
href="https://redirect.github.com/fluxcd/flux2/pull/5796">fluxcd/flux2#5796</a></li>
<li>[release/v2.8.x] fix: validate --source flag in create kustomization
command by <a
href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a
href="https://redirect.github.com/fluxcd/flux2/pull/5799">fluxcd/flux2#5799</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/fluxcd/flux2/compare/v2.8.3...v2.8.4">https://github.com/fluxcd/flux2/compare/v2.8.3...v2.8.4</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/fluxcd/flux2/commit/5adad89dcce7b79f20274ae8e112bcec7bd46764"><code>5adad89</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/flux2/issues/5822">#5822</a>
from fluxcd/update-components-release/v2.8.x</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/29cc0b337e5a584fe34408495cccc477d098bd54"><code>29cc0b3</code></a>
Update toolkit components</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/3cf3cb546fc549fa7e8a9ec6d3254accc027b46e"><code>3cf3cb5</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/flux2/issues/5799">#5799</a>
from fluxcd/backport-5798-to-release/v2.8.x</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/1569932e08e7ce653160ec49a53a31ffd585fd55"><code>1569932</code></a>
fix: validate --source flag in create kustomization command</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/836f87ef8fa5cec21493cf4d846a236d32e3c4b1"><code>836f87e</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/flux2/issues/5796">#5796</a>
from fluxcd/update-pkg-deps/release/v2.8.x</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/19545a8e465a5321717a0775746c1e5121f08a6b"><code>19545a8</code></a>
Update fluxcd/pkg dependencies</li>
<li>See full diff in <a
href="https://github.com/fluxcd/flux2/compare/v2.8.3...v2.8.5">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/fluxcd/kustomize-controller/api` from 1.8.2 to 1.8.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fluxcd/kustomize-controller/releases">github.com/fluxcd/kustomize-controller/api's
releases</a>.</em></p>
<blockquote>
<h2>v1.8.3</h2>
<h2>Changelog</h2>
<p><a
href="https://github.com/fluxcd/kustomize-controller/blob/v1.8.3/CHANGELOG.md">v1.8.3
changelog</a></p>
<h2>Container images</h2>
<ul>
<li><code>docker.io/fluxcd/kustomize-controller:v1.8.3</code></li>
<li><code>ghcr.io/fluxcd/kustomize-controller:v1.8.3</code></li>
</ul>
<p>Supported architectures: <code>linux/amd64</code>,
<code>linux/arm64</code> and <code>linux/arm/v7</code>.</p>
<p>The container images are built on GitHub hosted runners and are
signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the
<a href="https://fluxcd.io/flux/security/">security
documentation</a>.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/fluxcd/kustomize-controller/blob/main/CHANGELOG.md">github.com/fluxcd/kustomize-controller/api's
changelog</a>.</em></p>
<blockquote>
<h2>1.8.3</h2>
<p><strong>Release date:</strong> 2026-04-07</p>
<p>This patch release fixes a race condition where a cancelled
reconciliation
could leave stale data in the cache, causing Kustomizations to get
stuck.</p>
<p>Fixes:</p>
<ul>
<li>Requeue on cancellation to avoid stale cache race condition
<a
href="https://redirect.github.com/fluxcd/kustomize-controller/pull/1625">#1625</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/fluxcd/kustomize-controller/commit/8e935221142a41b7f354c0a233cdfe6eed9bcea0"><code>8e93522</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/kustomize-controller/issues/1630">#1630</a>
from fluxcd/release-v1.8.3</li>
<li><a
href="https://github.com/fluxcd/kustomize-controller/commit/3016285e17897974c9844926ace17664334494ad"><code>3016285</code></a>
Release v1.8.3</li>
<li><a
href="https://github.com/fluxcd/kustomize-controller/commit/8ea73d6575e58f9764aa1cf7e0b43c5694ed5fc7"><code>8ea73d6</code></a>
Add changelog entry for v1.8.3</li>
<li><a
href="https://github.com/fluxcd/kustomize-controller/commit/45f975a9c385cacc40842846a6ead95e4603eafc"><code>45f975a</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/kustomize-controller/issues/1626">#1626</a>
from fluxcd/backport-1625-to-release/v1.8.x</li>
<li><a
href="https://github.com/fluxcd/kustomize-controller/commit/8de1f6a8d6cad0ba3faf904cf6a88915ce62b72d"><code>8de1f6a</code></a>
Requeue on cancellation to avoid stale cache race condition</li>
<li>See full diff in <a
href="https://github.com/fluxcd/kustomize-controller/compare/v1.8.2...v1.8.3">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/fluxcd/notification-controller/api` from 1.8.2 to
1.8.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fluxcd/notification-controller/releases">github.com/fluxcd/notification-controller/api's
releases</a>.</em></p>
<blockquote>
<h2>v1.8.3</h2>
<h2>Changelog</h2>
<p><a
href="https://github.com/fluxcd/notification-controller/blob/v1.8.3/CHANGELOG.md">v1.8.3
changelog</a></p>
<h2>Container images</h2>
<ul>
<li><code>docker.io/fluxcd/notification-controller:v1.8.3</code></li>
<li><code>ghcr.io/fluxcd/notification-controller:v1.8.3</code></li>
</ul>
<p>Supported architectures: <code>linux/amd64</code>,
<code>linux/arm64</code> and <code>linux/arm/v7</code>.</p>
<p>The container images are built on GitHub hosted runners and are
signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the
<a href="https://fluxcd.io/flux/security/">security
documentation</a>.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/fluxcd/notification-controller/blob/main/CHANGELOG.md">github.com/fluxcd/notification-controller/api's
changelog</a>.</em></p>
<blockquote>
<h2>1.8.3</h2>
<p><strong>Release date:</strong> 2026-04-07</p>
<p>This patch release adds optional <code>email</code> and
<code>audience</code> fields to the GCR
Receiver for tighter verification, and includes a provider manifest
example
for Azure Event Hub managed identity authentication.</p>
<p>Improvements:</p>
<ul>
<li>Refactor GCR Receiver
<a
href="https://redirect.github.com/fluxcd/notification-controller/pull/1279">#1279</a></li>
<li>Add provider manifest example for Azure Event Hub managed identity
auth
<a
href="https://redirect.github.com/fluxcd/notification-controller/pull/1275">#1275</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/fluxcd/notification-controller/commit/e8dd599ccf5d5ebc651486d536bc73ac4761a94c"><code>e8dd599</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/notification-controller/issues/1282">#1282</a>
from fluxcd/release-v1.8.3</li>
<li><a
href="https://github.com/fluxcd/notification-controller/commit/4a0eb4590d22cb51c868e0e16309ba70fd6f0840"><code>4a0eb45</code></a>
Release v1.8.3</li>
<li><a
href="https://github.com/fluxcd/notification-controller/commit/cd43202f5b658db4871642cc77bd440af99d6117"><code>cd43202</code></a>
Add changelog entry for v1.8.3</li>
<li><a
href="https://github.com/fluxcd/notification-controller/commit/2d2ebedd9e39aed87f15d48667bdf21ea5037bc7"><code>2d2ebed</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/notification-controller/issues/1281">#1281</a>
from fluxcd/backport-1279-to-release/v1.8.x</li>
<li><a
href="https://github.com/fluxcd/notification-controller/commit/61b0521f3c7678ea2460a7ac06844b8d94c1140b"><code>61b0521</code></a>
Refactor GCR Receiver</li>
<li><a
href="https://github.com/fluxcd/notification-controller/commit/4ab88fe16205117f3ffa9e5bc114110bd1aa2711"><code>4ab88fe</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/notification-controller/issues/1276">#1276</a>
from fluxcd/backport-1275-to-release/v1.8.x</li>
<li><a
href="https://github.com/fluxcd/notification-controller/commit/cace0eb6c8464d63cc4c640f2c617054961a46dd"><code>cace0eb</code></a>
Add provider manifest example for Azure Event Hub managed identity
auth</li>
<li>See full diff in <a
href="https://github.com/fluxcd/notification-controller/compare/v1.8.2...v1.8.3">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/fluxcd/source-controller/api` from 1.8.1 to 1.8.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fluxcd/source-controller/releases">github.com/fluxcd/source-controller/api's
releases</a>.</em></p>
<blockquote>
<h2>v1.8.2</h2>
<h2>Changelog</h2>
<p><a
href="https://github.com/fluxcd/source-controller/blob/v1.8.2/CHANGELOG.md">v1.8.2
changelog</a></p>
<h2>Container images</h2>
<ul>
<li><code>docker.io/fluxcd/source-controller:v1.8.2</code></li>
<li><code>ghcr.io/fluxcd/source-controller:v1.8.2</code></li>
</ul>
<p>Supported architectures: <code>linux/amd64</code>,
<code>linux/arm64</code> and <code>linux/arm/v7</code>.</p>
<p>The container images are built on GitHub hosted runners and are
signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the
<a href="https://fluxcd.io/flux/security/">security
documentation</a>.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/fluxcd/source-controller/blob/main/CHANGELOG.md">github.com/fluxcd/source-controller/api's
changelog</a>.</em></p>
<blockquote>
<h2>1.8.2</h2>
<p><strong>Release date:</strong> 2026-04-07</p>
<p>This patch release fixes the Azure Blob prefix option not being
passed
to the storage client, and improves the error message when using
encrypted
SSH keys without a password.</p>
<p>Fixes:</p>
<ul>
<li>Fix azure blob prefix option not passed
<a
href="https://redirect.github.com/fluxcd/source-controller/pull/2014">#2014</a></li>
</ul>
<p>Improvements:</p>
<ul>
<li>Improve error message for encrypted SSH keys without password
<a
href="https://redirect.github.com/fluxcd/source-controller/pull/2013">#2013</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/fluxcd/source-controller/commit/e1b0d6f3087a4c775a06ce5294e4c0d9010c0ac1"><code>e1b0d6f</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/source-controller/issues/2022">#2022</a>
from fluxcd/release-v1.8.2</li>
<li><a
href="https://github.com/fluxcd/source-controller/commit/0f11ff813b05935e2d37b8ba772dcbd48746ef81"><code>0f11ff8</code></a>
Release v1.8.2</li>
<li><a
href="https://github.com/fluxcd/source-controller/commit/345a23402b19dcce764e2f49c609855cc4bbd2cd"><code>345a234</code></a>
Add changelog entry for v1.8.2</li>
<li><a
href="https://github.com/fluxcd/source-controller/commit/725815bf12ad03e142f4a49fe5409f5eaf4cd897"><code>725815b</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/source-controller/issues/2018">#2018</a>
from fluxcd/backport-2013-to-release/v1.8.x</li>
<li><a
href="https://github.com/fluxcd/source-controller/commit/956faff4a3053e664bdd412aa32bdb38ff0a5f61"><code>956faff</code></a>
Improve error message for encrypted SSH keys without password</li>
<li><a
href="https://github.com/fluxcd/source-controller/commit/5add99fa4cd1c034c1b3374a296b02799e2d0faa"><code>5add99f</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/source-controller/issues/2015">#2015</a>
from fluxcd/backport-2014-to-release/v1.8.x</li>
<li><a
href="https://github.com/fluxcd/source-controller/commit/6d4c3551dfcef4815b02678e870d4d4828734bbf"><code>6d4c355</code></a>
Fix azure blob prefix option not passed</li>
<li>See full diff in <a
href="https://github.com/fluxcd/source-controller/compare/v1.8.1...v1.8.2">compare
view</a></li>
</ul>
</details>
<br />

Updates `ocm.software/ocm` from 0.38.0 to 0.39.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-component-model/ocm/releases">ocm.software/ocm's
releases</a>.</em></p>
<blockquote>
<h2>v0.39.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>⬆️ Dependencies</h3>
<ul>
<li>chore(deps): bump the go group across 1 directory with 16 updates by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/open-component-model/ocm/pull/1868">open-component-model/ocm#1868</a></li>
<li>chore(deps): bump google.golang.org/grpc from 1.79.2 to 1.79.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/open-component-model/ocm/pull/1871">open-component-model/ocm#1871</a></li>
<li>chore(deps): bump the go group with 6 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/open-component-model/ocm/pull/1875">open-component-model/ocm#1875</a></li>
</ul>
<h3>🧰 Maintenance</h3>
<ul>
<li>chore: bump VERSION to 0.39.0-dev by <a
href="https://github.com/ocmbot"><code>@​ocmbot</code></a>[bot] in <a
href="https://redirect.github.com/open-component-model/ocm/pull/1863">open-component-model/ocm#1863</a></li>
<li>chore: update code of conduct link by <a
href="https://github.com/Skarlso"><code>@​Skarlso</code></a> in <a
href="https://redirect.github.com/open-component-model/ocm/pull/1873">open-component-model/ocm#1873</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/open-component-model/ocm/compare/v0.38...v0.39.0">https://github.com/open-component-model/ocm/compare/v0.38...v0.39.0</a></p>
<h2>v0.39.0-rc.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>⬆️ Dependencies</h3>
<ul>
<li>chore(deps): bump the go group across 1 directory with 16 updates by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/open-component-model/ocm/pull/1868">open-component-model/ocm#1868</a></li>
<li>chore(deps): bump google.golang.org/grpc from 1.79.2 to 1.79.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/open-component-model/ocm/pull/1871">open-component-model/ocm#1871</a></li>
<li>chore(deps): bump the go group with 6 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/open-component-model/ocm/pull/1875">open-component-model/ocm#1875</a></li>
</ul>
<h3>🧰 Maintenance</h3>
<ul>
<li>chore: bump VERSION to 0.39.0-dev by <a
href="https://github.com/ocmbot"><code>@​ocmbot</code></a>[bot] in <a
href="https://redirect.github.com/open-component-model/ocm/pull/1863">open-component-model/ocm#1863</a></li>
<li>chore: update code of conduct link by <a
href="https://github.com/Skarlso"><code>@​Skarlso</code></a> in <a
href="https://redirect.github.com/open-component-model/ocm/pull/1873">open-component-model/ocm#1873</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/open-component-model/ocm/compare/v0.38...v0.39.0">https://github.com/open-component-model/ocm/compare/v0.38...v0.39.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/open-component-model/ocm/commit/afad52d1d9098a5157c5f26635ba4afba3b1462e"><code>afad52d</code></a>
chore(deps): bump the ci group with 3 updates (<a
href="https://redirect.github.com/open-component-model/ocm/issues/1877">#1877</a>)</li>
<li><a
href="https://github.com/open-component-model/ocm/commit/dcde3768d27fb699914d1129a5834521a021b93b"><code>dcde376</code></a>
chore: update 'flake.nix' (<a
href="https://redirect.github.com/open-component-model/ocm/issues/1876">#1876</a>)</li>
<li><a
href="https://github.com/open-component-model/ocm/commit/d53d156578b78a34f2393227274ad2131e403ed0"><code>d53d156</code></a>
chore(deps): bump the go group with 6 updates (<a
href="https://redirect.github.com/open-component-model/ocm/issues/1875">#1875</a>)</li>
<li><a
href="https://github.com/open-component-model/ocm/commit/0296cfd8102197ff637d75b46b0c63cfd29d0857"><code>0296cfd</code></a>
chore(deps): bump actions/cache from 5.0.3 to 5.0.4 in the ci group (<a
href="https://redirect.github.com/open-component-model/ocm/issues/1872">#1872</a>)</li>
<li><a
href="https://github.com/open-component-model/ocm/commit/f345599e67fe0da3c330d3c951299b7cbc50eef7"><code>f345599</code></a>
chore: update 'flake.nix' (<a
href="https://redirect.github.com/open-component-model/ocm/issues/1874">#1874</a>)</li>
<li><a
href="https://github.com/open-component-model/ocm/commit/88035515972f884558d72b21c8530022924dee26"><code>8803551</code></a>
chore(deps): bump google.golang.org/grpc from 1.79.2 to 1.79.3 (<a
href="https://redirect.github.com/open-component-model/ocm/issues/1871">#1871</a>)</li>
<li><a
href="https://github.com/open-component-model/ocm/commit/36f060ceb98d0a40e7ecc6b5f3de2c8f8cd6241f"><code>36f060c</code></a>
chore: update code of conduct link (<a
href="https://redirect.github.com/open-component-model/ocm/issues/1873">#1873</a>)</li>
<li><a
href="https://github.com/open-component-model/ocm/commit/9e528e2b483c15960cf3b097f69cf1c23e39cf54"><code>9e528e2</code></a>
chore(deps): bump github/codeql-action from 4.32.6 to 4.33.0 in the ci
group ...</li>
<li><a
href="https://github.com/open-component-model/ocm/commit/91917a67aea70527c8810dc66bb17619b636d9f3"><code>91917a6</code></a>
chore: update 'flake.nix' (<a
href="https://redirect.github.com/open-component-model/ocm/issues/1869">#1869</a>)</li>
<li><a
href="https://github.com/open-component-model/ocm/commit/b477b090976741f4ce6f40561440bba038d83f4f"><code>b477b09</code></a>
chore(deps): bump the go group across 1 directory with 16 updates (<a
href="https://redirect.github.com/open-component-model/ocm/issues/1868">#1868</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-component-model/ocm/compare/v0.38...v0.39">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

go.mod

@@ -12,17 +12,17 @@ replace github.com/ThalesIgnite/crypto11 => github.com/ThalesGroup/crypto11 v1.6
 require (
 	code.gitea.io/sdk/gitea v0.24.1
 	github.com/fluxcd/cli-utils v0.37.2-flux.1
-	github.com/fluxcd/flux2/v2 v2.8.3
+	github.com/fluxcd/flux2/v2 v2.8.5
 	github.com/fluxcd/helm-controller/api v1.5.3
 	github.com/fluxcd/image-automation-controller/api v1.1.1
 	github.com/fluxcd/image-reflector-controller/api v1.1.1
-	github.com/fluxcd/kustomize-controller/api v1.8.2
-	github.com/fluxcd/notification-controller/api v1.8.2
+	github.com/fluxcd/kustomize-controller/api v1.8.3
+	github.com/fluxcd/notification-controller/api v1.8.3
 	github.com/fluxcd/pkg/apis/meta v1.26.0
 	github.com/fluxcd/pkg/runtime v0.103.0
 	github.com/fluxcd/pkg/ssa v0.70.0
 	github.com/fluxcd/pkg/version v0.14.0
-	github.com/fluxcd/source-controller/api v1.8.1
+	github.com/fluxcd/source-controller/api v1.8.2
 	github.com/open-component-model/git-controller v0.12.1
 	github.com/open-component-model/ocm-controller v0.29.0
 	github.com/open-component-model/replication-controller v0.13.1
@@ -32,15 +32,15 @@ require (
 	k8s.io/apimachinery v0.35.3
 	k8s.io/cli-runtime v0.35.3
 	k8s.io/client-go v0.35.3
-	ocm.software/ocm v0.38.0
+	ocm.software/ocm v0.39.0
 	sigs.k8s.io/controller-runtime v0.23.3
 	sigs.k8s.io/e2e-framework v0.6.0
 	sigs.k8s.io/kustomize/api v0.21.1
 	sigs.k8s.io/yaml v1.6.0
 )
 
 require (
-	cloud.google.com/go/auth v0.18.1 // indirect
+	cloud.google.com/go/auth v0.18.2 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	dario.cat/mergo v1.0.2 // indirect
@@ -80,25 +80,25 @@ require (
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/aws/aws-sdk-go-v2 v1.41.5 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.32.11 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.11 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.19 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.1.8 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.32.12 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.12 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.1.10 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.5 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ecr v1.55.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ecr v1.56.1 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.38.9 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 // indirect
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.0.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.30.12 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.16 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.41.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 // indirect
 	github.com/aws/smithy-go v1.24.2 // indirect
 	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.11.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
@@ -157,13 +157,13 @@ require (
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fluxcd/pkg/apis/acl v0.9.0 // indirect
 	github.com/fluxcd/pkg/apis/kustomize v1.16.0 // indirect
-	github.com/fluxcd/pkg/kustomize v1.27.1 // indirect
+	github.com/fluxcd/pkg/kustomize v1.27.2 // indirect
 	github.com/fluxcd/pkg/tar v0.17.0 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fvbommel/sortorder v1.1.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/ghodss/yaml v1.0.0 // indirect
-	github.com/go-chi/chi/v5 v5.2.4 // indirect
+	github.com/go-chi/chi/v5 v5.2.5 // indirect
 	github.com/go-errors/errors v1.5.1 // indirect
 	github.com/go-fed/httpsig v1.1.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
@@ -173,14 +173,14 @@ require (
 	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-openapi/analysis v0.24.1 // indirect
+	github.com/go-openapi/analysis v0.24.3 // indirect
 	github.com/go-openapi/errors v0.22.7 // indirect
-	github.com/go-openapi/jsonpointer v0.22.4 // indirect
-	github.com/go-openapi/jsonreference v0.21.4 // indirect
-	github.com/go-openapi/loads v0.23.2 // indirect
-	github.com/go-openapi/runtime v0.29.2 // indirect
-	github.com/go-openapi/spec v0.22.3 // indirect
-	github.com/go-openapi/strfmt v0.26.0 // indirect
+	github.com/go-openapi/jsonpointer v0.22.5 // indirect
+	github.com/go-openapi/jsonreference v0.21.5 // indirect
+	github.com/go-openapi/loads v0.23.3 // indirect
+	github.com/go-openapi/runtime v0.29.3 // indirect
+	github.com/go-openapi/spec v0.22.4 // indirect
+	github.com/go-openapi/strfmt v0.26.1 // indirect
 	github.com/go-openapi/swag v0.25.5 // indirect
 	github.com/go-openapi/swag/cmdutils v0.25.5 // indirect
 	github.com/go-openapi/swag/conv v0.25.5 // indirect
@@ -193,7 +193,7 @@ require (
 	github.com/go-openapi/swag/stringutils v0.25.5 // indirect
 	github.com/go-openapi/swag/typeutils v0.25.5 // indirect
 	github.com/go-openapi/swag/yamlutils v0.25.5 // indirect
-	github.com/go-openapi/validate v0.25.1 // indirect
+	github.com/go-openapi/validate v0.25.2 // indirect
 	github.com/go-test/deep v1.1.1 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
@@ -213,7 +213,7 @@ require (
 	github.com/google/go-querystring v1.2.0 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.11 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.12 // indirect
 	github.com/googleapis/gax-go/v2 v2.17.0 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/gowebpki/jcs v1.0.1 // indirect
@@ -234,7 +234,7 @@ require (
 	github.com/jinzhu/copier v0.4.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kevinburke/ssh_config v1.4.0 // indirect
-	github.com/klauspost/compress v1.18.4 // indirect
+	github.com/klauspost/compress v1.18.5 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
 	github.com/letsencrypt/boulder v0.20251110.0 // indirect
@@ -300,7 +300,7 @@ require (
 	github.com/sigstore/cosign/v3 v3.0.5 // indirect
 	github.com/sigstore/fulcio v1.8.5 // indirect
 	github.com/sigstore/protobuf-specs v0.5.0 // indirect
-	github.com/sigstore/rekor v1.5.0 // indirect
+	github.com/sigstore/rekor v1.5.1 // indirect
 	github.com/sigstore/rekor-tiles/v2 v2.2.0 // indirect
 	github.com/sigstore/sigstore v1.10.4 // indirect
 	github.com/sigstore/sigstore-go v1.1.4 // indirect
@@ -357,17 +357,17 @@ require (
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/crypto v0.49.0 // indirect
 	golang.org/x/mod v0.33.0 // indirect
-	golang.org/x/net v0.51.0 // indirect
-	golang.org/x/oauth2 v0.35.0 // indirect
+	golang.org/x/net v0.52.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.42.0 // indirect
 	golang.org/x/term v0.41.0 // indirect
 	golang.org/x/text v0.35.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
-	google.golang.org/api v0.267.0 // indirect
+	google.golang.org/api v0.269.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260217215200-42d3e9bedb6d // indirect
 	google.golang.org/grpc v1.79.3 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect