chore(deps): bump the go group with 12 updates by dependabot[bot] · Pull Request #251 · open-component-model/ocm-e2e-framework

dependabot · 2026-05-17T06:23:43Z

Bumps the go group with 12 updates:

Package	From	To
code.gitea.io/sdk/gitea	`0.25.0`	`0.25.1`
github.com/fluxcd/cli-utils	`1.2.0`	`1.2.1`
github.com/fluxcd/flux2/v2	`2.8.6`	`2.8.7`
github.com/fluxcd/image-automation-controller/api	`1.1.2`	`1.1.3`
github.com/fluxcd/kustomize-controller/api	`1.8.4`	`1.8.5`
github.com/fluxcd/source-controller/api	`1.8.3`	`1.8.4`
k8s.io/api	`0.36.0`	`0.36.1`
k8s.io/apiextensions-apiserver	`0.36.0`	`0.36.1`
k8s.io/apimachinery	`0.36.0`	`0.36.1`
k8s.io/cli-runtime	`0.36.0`	`0.36.1`
k8s.io/client-go	`0.36.0`	`0.36.1`
sigs.k8s.io/controller-runtime	`0.24.0`	`0.24.1`

Updates code.gitea.io/sdk/gitea from 0.25.0 to 0.25.1

Updates github.com/fluxcd/cli-utils from 1.2.0 to 1.2.1

Release notes

Sourced from github.com/fluxcd/cli-utils's releases.

v1.2.1

What's Changed

Fix erroring out on supported RBAC names with underscores by @vocarista in fluxcd/cli-utils#34

Upgrade controller-runtime to v0.24.1 by @matheuscscp in fluxcd/cli-utils#35

New Contributors

@vocarista made their first contribution in fluxcd/cli-utils#34

Full Changelog: fluxcd/cli-utils@v1.2.0...v1.2.1

Commits

967855f Merge pull request #35 from fluxcd/update-controller-runtime-v0.24.1
f05e590 Upgrade controller-runtime to v0.24.1
0aaa266 Merge pull request #34 from vocarista/bug/kustomize-controller/491
116b2dc Add support for RBAC names with underscores
See full diff in compare view

Updates github.com/fluxcd/flux2/v2 from 2.8.6 to 2.8.7

Release notes

Sourced from github.com/fluxcd/flux2/v2's releases.

v2.8.7

Highlights

Flux v2.8.7 is a patch release that includes a bug fix in kustomize-controller, a CVE fix in source-controller and image-automation-controller via go-git v5.19.0, and dependency updates. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

Fix management of objects annotated with kustomize.toolkit.fluxcd.io/ssa: IfNotPresent where non-namespaced resources were being deleted and recreated on each reconciliation (kustomize-controller)

Improvements:

Update go-git to v5.19.0 which fixes CVE-2026-45022 (source-controller, image-automation-controller)

Update fluxcd/pkg dependencies (source-controller, kustomize-controller, image-automation-controller)

Components changelog

helm-controller v1.5.4

image-automation-controller v1.1.3

kustomize-controller v1.8.5

notification-controller v1.8.4

source-controller v1.8.4

CLI changelog

Update toolkit components by @fluxcdbot in fluxcd/flux2#5891

Full Changelog: fluxcd/flux2@v2.8.6...v2.8.7

Commits

54e4ba3 Merge pull request #5891 from fluxcd/update-components-release/v2.8.x
d2fbb16 Update toolkit components
66533d7 Merge pull request #5882 from fluxcd/backport-5881-to-release/v2.8.x
7ac3623 include source-watcher in install manifests
See full diff in compare view

Updates github.com/fluxcd/image-automation-controller/api from 1.1.2 to 1.1.3

Release notes

Sourced from github.com/fluxcd/image-automation-controller/api's releases.

v1.1.3

Changelog

v1.1.3 changelog

Container images

docker.io/fluxcd/image-automation-controller:v1.1.3

ghcr.io/fluxcd/image-automation-controller:v1.1.3

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/image-automation-controller/api's changelog.

1.1.3

Release date: 2026-05-12

This patch release comes with dependency updates, including go-git v5.19.0 which fixes CVE-2026-45022.

Improvements:

Update fluxcd/pkg dependencies #1029

Commits

203b7a4 Merge pull request #1030 from fluxcd/release-v1.1.3
8ecd2a8 Release v1.1.3
b79b0da Add changelog entry for v1.1.3
464247a Merge pull request #1029 from fluxcd/update-pkg-deps/release/v1.1.x
30952d7 Update fluxcd/pkg dependencies
See full diff in compare view

Updates github.com/fluxcd/kustomize-controller/api from 1.8.4 to 1.8.5

Release notes

Sourced from github.com/fluxcd/kustomize-controller/api's releases.

v1.8.5

Changelog

v1.8.5 changelog

Container images

docker.io/fluxcd/kustomize-controller:v1.8.5

ghcr.io/fluxcd/kustomize-controller:v1.8.5

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/kustomize-controller/api's changelog.

1.8.5

Release date: 2026-05-12

This patch release fixes a regression in the management of objects annotated with kustomize.toolkit.fluxcd.io/ssa: IfNotPresent where non-namespaced resources were being deleted and recreated on each reconciliation.

Fixes:

Fix management of skipped objects #1651

Improvements:

Update fluxcd/pkg dependencies #1648

Commits

b74fb3e Merge pull request #1654 from fluxcd/release-v1.8.5
0d9520f Release v1.8.5
0c3b99a Add changelog entry for v1.8.5
1d3ddcb Merge pull request #1652 from fluxcd/backport-1651-to-release/v1.8.x
897f431 Keep excluding 'ssa: Ignore' from deletion, but not 'ssa: IfNotPresent'
68d659b Keep ignoring the health of skipped objects
f94d2af Revert 'Fix skipped entries from SSA being stored in the inventory'
ce55c86 Refactor object deletion in the controller
3b5ad19 Merge pull request #1648 from fluxcd/update-pkg-deps/release/v1.8.x
b9727a8 Update fluxcd/pkg dependencies
See full diff in compare view

Updates github.com/fluxcd/source-controller/api from 1.8.3 to 1.8.4

Release notes

Sourced from github.com/fluxcd/source-controller/api's releases.

v1.8.4

Changelog

v1.8.4 changelog

Container images

docker.io/fluxcd/source-controller:v1.8.4

ghcr.io/fluxcd/source-controller:v1.8.4

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/source-controller/api's changelog.

1.8.4

Release date: 2026-05-12

This patch release comes with dependency updates, including go-git v5.19.0 which fixes CVE-2026-45022.

Improvements:

Update fluxcd/pkg dependencies #2045

Commits

5b75cc5 Merge pull request #2046 from fluxcd/release-v1.8.4
96f99db Release v1.8.4
2219346 Add changelog entry for v1.8.4
3c855c4 Merge pull request #2045 from fluxcd/update-pkg-deps/release/v1.8.x
9640cab Update fluxcd/pkg dependencies
See full diff in compare view

Updates k8s.io/api from 0.36.0 to 0.36.1

Commits

25001c8 Update dependencies to v0.36.1 tag
See full diff in compare view

Updates k8s.io/apiextensions-apiserver from 0.36.0 to 0.36.1

Commits

5b822b1 Update dependencies to v0.36.1 tag
See full diff in compare view

Updates k8s.io/apimachinery from 0.36.0 to 0.36.1

Commits

7af103a Update dependencies to v0.36.1 tag
See full diff in compare view

Updates k8s.io/cli-runtime from 0.36.0 to 0.36.1

Commits

62458b5 Update dependencies to v0.36.1 tag
See full diff in compare view

Updates k8s.io/client-go from 0.36.0 to 0.36.1

Commits

55ef15a Update dependencies to v0.36.1 tag
See full diff in compare view

Updates sigs.k8s.io/controller-runtime from 0.24.0 to 0.24.1

Release notes

Sourced from sigs.k8s.io/controller-runtime's releases.

v0.24.1

What's Changed

[release-0.24] 🐛 Fix regression in Apply typed error handling by @k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#3516

Full Changelog: kubernetes-sigs/controller-runtime@v0.24.0...v0.24.1

Commits

3be3f1b Merge pull request #3516 from k8s-infra-cherrypick-robot/cherry-pick-3515-to-...
0f7b33d Fix regression in Apply typed error handling
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go group with 12 updates: | Package | From | To | | --- | --- | --- | | code.gitea.io/sdk/gitea | `0.25.0` | `0.25.1` | | [github.com/fluxcd/cli-utils](https://github.com/fluxcd/cli-utils) | `1.2.0` | `1.2.1` | | [github.com/fluxcd/flux2/v2](https://github.com/fluxcd/flux2) | `2.8.6` | `2.8.7` | | [github.com/fluxcd/image-automation-controller/api](https://github.com/fluxcd/image-automation-controller) | `1.1.2` | `1.1.3` | | [github.com/fluxcd/kustomize-controller/api](https://github.com/fluxcd/kustomize-controller) | `1.8.4` | `1.8.5` | | [github.com/fluxcd/source-controller/api](https://github.com/fluxcd/source-controller) | `1.8.3` | `1.8.4` | | [k8s.io/api](https://github.com/kubernetes/api) | `0.36.0` | `0.36.1` | | [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) | `0.36.0` | `0.36.1` | | [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.36.0` | `0.36.1` | | [k8s.io/cli-runtime](https://github.com/kubernetes/cli-runtime) | `0.36.0` | `0.36.1` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.36.0` | `0.36.1` | | [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime) | `0.24.0` | `0.24.1` | Updates `code.gitea.io/sdk/gitea` from 0.25.0 to 0.25.1 Updates `github.com/fluxcd/cli-utils` from 1.2.0 to 1.2.1 - [Release notes](https://github.com/fluxcd/cli-utils/releases) - [Commits](fluxcd/cli-utils@v1.2.0...v1.2.1) Updates `github.com/fluxcd/flux2/v2` from 2.8.6 to 2.8.7 - [Release notes](https://github.com/fluxcd/flux2/releases) - [Commits](fluxcd/flux2@v2.8.6...v2.8.7) Updates `github.com/fluxcd/image-automation-controller/api` from 1.1.2 to 1.1.3 - [Release notes](https://github.com/fluxcd/image-automation-controller/releases) - [Changelog](https://github.com/fluxcd/image-automation-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/image-automation-controller@v1.1.2...v1.1.3) Updates `github.com/fluxcd/kustomize-controller/api` from 1.8.4 to 1.8.5 - [Release notes](https://github.com/fluxcd/kustomize-controller/releases) - [Changelog](https://github.com/fluxcd/kustomize-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/kustomize-controller@v1.8.4...v1.8.5) Updates `github.com/fluxcd/source-controller/api` from 1.8.3 to 1.8.4 - [Release notes](https://github.com/fluxcd/source-controller/releases) - [Changelog](https://github.com/fluxcd/source-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/source-controller@v1.8.3...v1.8.4) Updates `k8s.io/api` from 0.36.0 to 0.36.1 - [Commits](kubernetes/api@v0.36.0...v0.36.1) Updates `k8s.io/apiextensions-apiserver` from 0.36.0 to 0.36.1 - [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases) - [Commits](kubernetes/apiextensions-apiserver@v0.36.0...v0.36.1) Updates `k8s.io/apimachinery` from 0.36.0 to 0.36.1 - [Commits](kubernetes/apimachinery@v0.36.0...v0.36.1) Updates `k8s.io/cli-runtime` from 0.36.0 to 0.36.1 - [Commits](kubernetes/cli-runtime@v0.36.0...v0.36.1) Updates `k8s.io/client-go` from 0.36.0 to 0.36.1 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.36.0...v0.36.1) Updates `sigs.k8s.io/controller-runtime` from 0.24.0 to 0.24.1 - [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases) - [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md) - [Commits](kubernetes-sigs/controller-runtime@v0.24.0...v0.24.1) --- updated-dependencies: - dependency-name: code.gitea.io/sdk/gitea dependency-version: 0.25.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/cli-utils dependency-version: 1.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/flux2/v2 dependency-version: 2.8.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/image-automation-controller/api dependency-version: 1.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/kustomize-controller/api dependency-version: 1.8.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/source-controller/api dependency-version: 1.8.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: k8s.io/api dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: k8s.io/apiextensions-apiserver dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: k8s.io/apimachinery dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: k8s.io/cli-runtime dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: k8s.io/client-go dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: sigs.k8s.io/controller-runtime dependency-version: 0.24.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels May 17, 2026

dependabot Bot requested a review from a team as a code owner May 17, 2026 06:23

dependabot Bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels May 17, 2026

matthiasbruns approved these changes May 18, 2026

View reviewed changes

matthiasbruns merged commit c3a1548 into main May 18, 2026
5 checks passed

dependabot Bot deleted the dependabot/go_modules/go-d52b9b2efa branch May 18, 2026 05:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the go group with 12 updates#251

chore(deps): bump the go group with 12 updates#251
matthiasbruns merged 1 commit into
mainfrom
dependabot/go_modules/go-d52b9b2efa

dependabot Bot commented on behalf of github May 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github May 17, 2026

v1.2.1

What's Changed

New Contributors

v2.8.7

Highlights

Components changelog

CLI changelog

v1.1.3

Changelog

Container images

1.1.3

v1.8.5

Changelog

Container images

1.8.5

v1.8.4

Changelog

Container images

1.8.4

v0.24.1

What's Changed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant