chore(deps): bump the go group with 11 updates by dependabot[bot] · Pull Request #223 · open-component-model/ocm-e2e-framework

dependabot · 2026-03-01T06:22:53Z

Bumps the go group with 11 updates:

Package	From	To
github.com/fluxcd/cli-utils	`0.37.1-flux.1`	`0.37.2-flux.1`
github.com/fluxcd/flux2/v2	`2.7.5`	`2.8.1`
github.com/fluxcd/helm-controller/api	`1.5.0`	`1.5.1`
github.com/fluxcd/kustomize-controller/api	`1.8.0`	`1.8.1`
github.com/fluxcd/notification-controller/api	`1.8.0`	`1.8.1`
k8s.io/api	`0.35.1`	`0.35.2`
k8s.io/apiextensions-apiserver	`0.35.1`	`0.35.2`
k8s.io/apimachinery	`0.35.1`	`0.35.2`
k8s.io/cli-runtime	`0.35.1`	`0.35.2`
k8s.io/client-go	`0.35.1`	`0.35.2`
ocm.software/ocm	`0.35.0`	`0.36.0`

Updates github.com/fluxcd/cli-utils from 0.37.1-flux.1 to 0.37.2-flux.1

Commits

aeb0ebe Merge pull request #23 from fluxcd/k8s-1.35.1
655fbc4 Update dependencies to Kubernetes v1.35.1
05291d6 Merge pull request #22 from fluxcd/fix-kstatus-polling-pending-pods
28dac90 fix: exclude transient pod failures from controller status
See full diff in compare view

Updates github.com/fluxcd/flux2/v2 from 2.7.5 to 2.8.1

Release notes

Sourced from github.com/fluxcd/flux2/v2's releases.

v2.8.1

Highlights

Flux v2.8.1 is a patch release that comes with various fixes. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

Fix Git commit status events being dropped for Kustomizations (notification-controller)

Fix health check for StatefulSets when the Pods are Pending/Unschedulable during rollout (helm-controller, kustomize-controller)

Components changelog

kustomize-controller v1.8.1

notification-controller v1.8.1

helm-controller v1.5.1

CLI changelog

[release/v2.8.x] Remove no longer needed workaround for Flux 2.8 by @fluxcdbot in fluxcd/flux2#5735

Update fluxcd/pkg dependencies by @fluxcdbot in fluxcd/flux2#5739

[release/v2.8.x] Update toolkit components by @fluxcdbot in fluxcd/flux2#5741

Full Changelog: fluxcd/flux2@v2.8.0...v2.8.1

v2.8.0

Highlights

Flux v2.8.0 is a feature release. Users are encouraged to upgrade for the best experience.

For a compressive overview of new features and API changes included in this release, please refer to the Announcing Flux 2.8 GA blog post.

Overview of the new features:

Helm v4 support, including server-side apply and kstatus-based health checking (HelmRelease)

Readiness evaluation of Helm-managed objects with CEL expressions (HelmRelease)

Improved observability of Helm releases with inventory tracking in .status.inventory (HelmRelease)

Reduced the mean time to recovery of Flux-managed applications via CancelHealthCheckOnNewRevision feature gate (Kustomization, HelmRelease)

Support for commenting on Pull Requests directly from Flux notifications (Provider)

Custom SSA apply stages for ordering resource application in kustomize-controller (Kustomization)

Automatic GitHub App installation ID lookup from the repository owner (GitRepository, ImageUpdateAutomation, Provider)

Support for Cosign v3 for verifying OCI artifacts and container images (OCIRepository)

ArtifactGenerator support for extracting and modifying Helm charts (ArtifactGenerator)

Bypass cache when fetching source objects via DirectSourceFetch feature gate (Kustomization, HelmRelease, ArtifactGenerator)

❤️ Big thanks to all the Flux contributors that helped us with this release!

... (truncated)

Commits

97222a7 Merge pull request #5741 from fluxcd/backport-5740-to-release/v2.8.x
959025e Update toolkit components
75f5e33 Merge pull request #5739 from fluxcd/update-pkg-deps/release/v2.8.x
79cae5d Update fluxcd/pkg dependencies
41505fd Merge pull request #5735 from fluxcd/backport-5733-to-release/v2.8.x
2042ddf Remove no longer needed workaround for Flux 2.8
ac71dd8 Merge pull request #5731 from fluxcd/conform-min-1.33
c5e5dfb Update conformance tests to min Kubernetes 1.33
6ae8805 Merge pull request #5730 from fluxcd/bump-min-k8s-version
fd547df Bump minimum Kubernetes version to 1.33
Additional commits viewable in compare view

Updates github.com/fluxcd/helm-controller/api from 1.5.0 to 1.5.1

Release notes

Sourced from github.com/fluxcd/helm-controller/api's releases.

v1.5.1

Changelog

v1.5.1 changelog

Container images

docker.io/fluxcd/helm-controller:v1.5.1

ghcr.io/fluxcd/helm-controller:v1.5.1

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/helm-controller/api's changelog.

1.5.1

Release date: 2026-02-27

This patch release fixes health check logic for StatefulSets during rolling updates when the Pods are Pending/Unschedulable.

Fixes:

Fix health check logic for StatefulSets during rolling updates #1424

Improvements:

Add note about MTTR only for kstatus #1416

Remove no longer needed workaround for Flux 2.8 #1420

Commits

2447764 Merge pull request #1425 from fluxcd/release-v1.5.1
1f42f67 Release v1.5.1
727ea4c Add changelog entry for v1.5.1
73872f9 Merge pull request #1424 from fluxcd/update-pkg-deps/release/v1.5.x
17ffe88 Update fluxcd/pkg dependencies
7568b08 Merge pull request #1421 from fluxcd/backport-1420-to-release/v1.5.x
b8d57fd Remove no longer needed workaround for Flux 2.8
9df94b5 Merge pull request #1417 from fluxcd/backport-1416-to-release/v1.5.x
6f7b802 Add note about MTTR only for kstatus
See full diff in compare view

Updates github.com/fluxcd/kustomize-controller/api from 1.8.0 to 1.8.1

Release notes

Sourced from github.com/fluxcd/kustomize-controller/api's releases.

v1.8.1

Changelog

v1.8.1 changelog

Container images

docker.io/fluxcd/kustomize-controller:v1.8.1

ghcr.io/fluxcd/kustomize-controller:v1.8.1

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/kustomize-controller/api's changelog.

1.8.1

Release date: 2026-02-27

This patch release fixes health check logic for StatefulSets during rolling updates when the Pods are Pending/Unschedulable.

Fixes:

Fix health check logic for StatefulSets during rolling updates #1602

Improvements:

Improve docs for .spec.force #1597

Remove no longer needed workaround for Flux 2.8 #1595

Commits

1fbb27f Merge pull request #1603 from fluxcd/release-v1.8.1
c8fd34b Release v1.8.1
73b2483 Add changelog entry for v1.8.1
794b701 Merge pull request #1602 from fluxcd/update-pkg-deps/release/v1.8.x
ea9478f Update fluxcd/pkg dependencies
8ccbdc9 Merge pull request #1598 from fluxcd/backport-1597-to-release/v1.8.x
9d0c746 Improve docs for .spec.force
4d1de8b Merge pull request #1596 from fluxcd/backport-1595-to-release/v1.8.x
628944a Remove no longer needed workaround for Flux 2.8
See full diff in compare view

Updates github.com/fluxcd/notification-controller/api from 1.8.0 to 1.8.1

Release notes

Sourced from github.com/fluxcd/notification-controller/api's releases.

v1.8.1

Changelog

v1.8.1 changelog

Container images

docker.io/fluxcd/notification-controller:v1.8.1

ghcr.io/fluxcd/notification-controller:v1.8.1

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/notification-controller/api's changelog.

1.8.1

Release date: 2026-02-27

This patch release fixes a regression introduced in 1.8.0 where commit status events were dropped.

Fixes:

Fix commit status providers requiring only commit event key #1247

Improvements:

Remove no longer needed workaround for Flux 2.8 #1244

Update fluxcd/pkg dependencies #1250

Commits

52ecadc Merge pull request #1252 from fluxcd/release-v1.8.1
50bf0fd Release v1.8.1
b624974 Add changelog entry for v1.8.1
89a1b36 Merge pull request #1250 from fluxcd/update-pkg-deps/release/v1.8.x
1c94ad3 Update fluxcd/pkg dependencies
24148ef Merge pull request #1249 from fluxcd/backport-1247-to-release/v1.8.x
da3292d Fix commit status providers requiring only commit even key
9ff4b34 Merge pull request #1245 from fluxcd/backport-1244-to-release/v1.8.x
2692130 Remove no longer needed workaround for Flux 2.8
See full diff in compare view

Updates k8s.io/api from 0.35.1 to 0.35.2

Commits

8a137cd Update dependencies to v0.35.2 tag
See full diff in compare view

Updates k8s.io/apiextensions-apiserver from 0.35.1 to 0.35.2

Commits

79000f4 Update dependencies to v0.35.2 tag
See full diff in compare view

Updates k8s.io/apimachinery from 0.35.1 to 0.35.2

Commits

See full diff in compare view

Updates k8s.io/cli-runtime from 0.35.1 to 0.35.2

Commits

81d4338 Update dependencies to v0.35.2 tag
See full diff in compare view

Updates k8s.io/client-go from 0.35.1 to 0.35.2

Commits

a21b329 Update dependencies to v0.35.2 tag
See full diff in compare view

Updates ocm.software/ocm from 0.35.0 to 0.36.0

Release notes

Sourced from ocm.software/ocm's releases.

v0.36.0

What's Changed

‼️ Breaking Changes

fix!: use Fulcio certificate instead of public key and upgrade Sigstore Cosign from v2 to v3 by @morri-son in open-component-model/ocm#1726

fix: chart access artifact set media type by @fabianburth in open-component-model/ocm#1786

🚀 Features

feat: support index based reading of OCI artifacts by @jakobmoellerdev in open-component-model/ocm#1646

🐛 Bug Fixes

fix: add --oci-layout flag for OCI Image Layout blob paths by @piotrjanik in open-component-model/ocm#1723

fix: update image reference name to use the open-component-model organization repository by @piotrjanik in open-component-model/ocm#1784

fix(1560): add more explicit errors on get cv by @matthiasbruns in open-component-model/ocm#1787

⬆️ Dependencies

chore(deps): bump the go group with 2 updates by @dependabot[bot] in open-component-model/ocm#1728

chore(deps): bump the go group with 18 updates by @dependabot[bot] in open-component-model/ocm#1734

chore: retract 0.33.0 and 0.34.1 by @frewilhelm in open-component-model/ocm#1740

chore(deps): bump the go group with 11 updates by @dependabot[bot] in open-component-model/ocm#1749

chore(deps): bump github.com/klauspost/compress by @frewilhelm in open-component-model/ocm#1752

chore(deps): bump golang from 1.25.4-alpine3.22 to 1.25.5-alpine3.22 by @dependabot[bot] in open-component-model/ocm#1718

chore: bump sigstore/fulcio by @jakobmoellerdev in open-component-model/ocm#1757

chore(deps): bump the go group with 3 updates by @dependabot[bot] in open-component-model/ocm#1764

chore(deps): bump the go group with 12 updates by @dependabot[bot] in open-component-model/ocm#1770

chore(deps): bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5 by @dependabot[bot] in open-component-model/ocm#1774

chore(deps): bump the go group with 6 updates by @dependabot[bot] in open-component-model/ocm#1778

chore(deps): bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 by @dependabot[bot] in open-component-model/ocm#1792

chore(deps): bump the go group with 7 updates by @dependabot[bot] in open-component-model/ocm#1795

chore(deps): bump golang from 1.25.5-alpine3.22 to 1.25.6-alpine3.22 by @dependabot[bot] in open-component-model/ocm#1794

🧰 Maintenance

chore: bump VERSION to 0.36.0-dev by @ocmbot[bot] in open-component-model/ocm#1724

New Contributors

@piotrjanik made their first contribution in open-component-model/ocm#1723

@matthiasbruns made their first contribution in open-component-model/ocm#1787

Full Changelog: open-component-model/ocm@v0.35...v0.36.0

v0.36.0-rc.2

What's Changed

‼️ Breaking Changes

fix!: use Fulcio certificate instead of public key and upgrade Sigstore Cosign from v2 to v3 by @morri-son in open-component-model/ocm#1726

... (truncated)

Commits

87fdfc7 chore(deps): bump golang from 1.25.5-alpine3.22 to 1.25.6-alpine3.22 (#1794)
ffe4118 chore(deps): bump the go group with 7 updates (#1795)
00100ff fix(1560): add more explicit errors on get cv (#1787)
e98265f chore(deps): bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 (#1792)
e18390a fix: chart access artifact set media type (#1786)
92a409a fix!: use Fulcio certificate instead of public key and upgrade Sigstore Cosig...
e408963 feat: support index based reading of OCI artifacts (#1646)
7a2ada0 fix: update image reference name to use the open-component-model organization...
2b9fa8e chore(deps): bump actions/cache from 5.0.1 to 5.0.2 in the ci group (#1780)
6ee834a chore(deps): bump the go group with 6 updates (#1778)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go group with 11 updates: | Package | From | To | | --- | --- | --- | | [github.com/fluxcd/cli-utils](https://github.com/fluxcd/cli-utils) | `0.37.1-flux.1` | `0.37.2-flux.1` | | [github.com/fluxcd/flux2/v2](https://github.com/fluxcd/flux2) | `2.7.5` | `2.8.1` | | [github.com/fluxcd/helm-controller/api](https://github.com/fluxcd/helm-controller) | `1.5.0` | `1.5.1` | | [github.com/fluxcd/kustomize-controller/api](https://github.com/fluxcd/kustomize-controller) | `1.8.0` | `1.8.1` | | [github.com/fluxcd/notification-controller/api](https://github.com/fluxcd/notification-controller) | `1.8.0` | `1.8.1` | | [k8s.io/api](https://github.com/kubernetes/api) | `0.35.1` | `0.35.2` | | [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) | `0.35.1` | `0.35.2` | | [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.35.1` | `0.35.2` | | [k8s.io/cli-runtime](https://github.com/kubernetes/cli-runtime) | `0.35.1` | `0.35.2` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.35.1` | `0.35.2` | | [ocm.software/ocm](https://github.com/open-component-model/ocm) | `0.35.0` | `0.36.0` | Updates `github.com/fluxcd/cli-utils` from 0.37.1-flux.1 to 0.37.2-flux.1 - [Commits](fluxcd/cli-utils@v0.37.1-flux.1...v0.37.2-flux.1) Updates `github.com/fluxcd/flux2/v2` from 2.7.5 to 2.8.1 - [Release notes](https://github.com/fluxcd/flux2/releases) - [Commits](fluxcd/flux2@v2.7.5...v2.8.1) Updates `github.com/fluxcd/helm-controller/api` from 1.5.0 to 1.5.1 - [Release notes](https://github.com/fluxcd/helm-controller/releases) - [Changelog](https://github.com/fluxcd/helm-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/helm-controller@v1.5.0...v1.5.1) Updates `github.com/fluxcd/kustomize-controller/api` from 1.8.0 to 1.8.1 - [Release notes](https://github.com/fluxcd/kustomize-controller/releases) - [Changelog](https://github.com/fluxcd/kustomize-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/kustomize-controller@v1.8.0...v1.8.1) Updates `github.com/fluxcd/notification-controller/api` from 1.8.0 to 1.8.1 - [Release notes](https://github.com/fluxcd/notification-controller/releases) - [Changelog](https://github.com/fluxcd/notification-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/notification-controller@v1.8.0...v1.8.1) Updates `k8s.io/api` from 0.35.1 to 0.35.2 - [Commits](kubernetes/api@v0.35.1...v0.35.2) Updates `k8s.io/apiextensions-apiserver` from 0.35.1 to 0.35.2 - [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases) - [Commits](kubernetes/apiextensions-apiserver@v0.35.1...v0.35.2) Updates `k8s.io/apimachinery` from 0.35.1 to 0.35.2 - [Commits](kubernetes/apimachinery@v0.35.1...v0.35.2) Updates `k8s.io/cli-runtime` from 0.35.1 to 0.35.2 - [Commits](kubernetes/cli-runtime@v0.35.1...v0.35.2) Updates `k8s.io/client-go` from 0.35.1 to 0.35.2 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.35.1...v0.35.2) Updates `ocm.software/ocm` from 0.35.0 to 0.36.0 - [Release notes](https://github.com/open-component-model/ocm/releases) - [Changelog](https://github.com/open-component-model/ocm/blob/main/RELEASE_PROCESS.md) - [Commits](open-component-model/ocm@v0.35...v0.36) --- updated-dependencies: - dependency-name: github.com/fluxcd/cli-utils dependency-version: 0.37.2-flux.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/flux2/v2 dependency-version: 2.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/fluxcd/helm-controller/api dependency-version: 1.5.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/kustomize-controller/api dependency-version: 1.8.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/notification-controller/api dependency-version: 1.8.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: k8s.io/api dependency-version: 0.35.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: k8s.io/apiextensions-apiserver dependency-version: 0.35.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: k8s.io/apimachinery dependency-version: 0.35.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: k8s.io/cli-runtime dependency-version: 0.35.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: k8s.io/client-go dependency-version: 0.35.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: ocm.software/ocm dependency-version: 0.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels Mar 1, 2026

dependabot Bot requested a review from a team as a code owner March 1, 2026 06:22

dependabot Bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels Mar 1, 2026

dependabot Bot force-pushed the dependabot/go_modules/go-583d300a2f branch from 5303f7d to 184f11e Compare March 2, 2026 05:53

frewilhelm approved these changes Mar 2, 2026

View reviewed changes

frewilhelm merged commit 89a5b63 into main Mar 2, 2026
5 checks passed

dependabot Bot deleted the dependabot/go_modules/go-583d300a2f branch March 2, 2026 06:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the go group with 11 updates#223

chore(deps): bump the go group with 11 updates#223
frewilhelm merged 1 commit intomainfrom
dependabot/go_modules/go-583d300a2f

dependabot Bot commented on behalf of github Mar 1, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Mar 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.8.1

Highlights

Components changelog

CLI changelog

v2.8.0

Highlights

v1.5.1

Changelog

Container images

1.5.1

v1.8.1

Changelog

Container images

1.8.1

v1.8.1

Changelog

Container images

1.8.1

v0.36.0

What's Changed

‼️ Breaking Changes

🚀 Features

🐛 Bug Fixes

⬆️ Dependencies

🧰 Maintenance

New Contributors

v0.36.0-rc.2

What's Changed

‼️ Breaking Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Mar 1, 2026 •

edited

Loading