chore(deps): bump the go group with 5 updates

[dependabot]

Bumps the go group with 5 updates:

Package	From	To
github.com/fluxcd/helm-controller/api	1.4.5	1.5.0
github.com/fluxcd/kustomize-controller/api	1.7.3	1.8.0
github.com/fluxcd/pkg/runtime	0.101.0	0.102.0
github.com/fluxcd/source-controller/api	1.7.4	1.8.0
github.com/google/go-containerregistry	0.20.7	0.21.0

Updates github.com/fluxcd/helm-controller/api from 1.4.5 to 1.5.0

Release notes

Sourced from github.com/fluxcd/helm-controller/api's releases.

v1.5.0

Changelog

v1.5.0 changelog

Container images

• docker.io/fluxcd/helm-controller:v1.5.0
• ghcr.io/fluxcd/helm-controller:v1.5.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/helm-controller/api's changelog.

1.5.0

Release date: 2026-02-20

This minor release comes with Helm v4 support, server-side apply for Helm releases, and various bug fixes and improvements.

⚠️ The v2beta2 APIs were removed. Before upgrading the CRDs, Flux users must run flux migrate to migrate the cluster storage off v2beta2.

HelmRelease

The controller now uses Helm v4, and, with this change, new default behaviors are being introduced (breaking changes) to keep Flux and Helm aligned:

• Apply method is now defaulting to server-side apply for new HelmReleases.
• Health checks now default to using kstatus for assessing readiness and failures of applied resources.

Those defaults can be changed back to Helm v3's defaults by setting the feature gate UseHelm3Defaults. Alternatively, fine-tuning the apply and health check methods is also possible on a per-HelmRelease basis by using the following fields:

• .spec.install.serverSideApply (boolean, default defined by UseHelm3Defaults)
• .spec.upgrade.serverSideApply (enabled, disabled or auto, defaults to auto)
• .spec.rollback.serverSideApply (enabled, disabled or auto, defaults to auto)
• .spec.waitStrategy.name (poller or legacy, default defined by UseHelm3Defaults)

Note that Helm persists the apply method in the release storage, hence why the auto value is an option for upgrade and rollback actions. When set to auto, the controller will reuse the apply method used in the last successful release revision as recorded in the Helm storage, defaulting to client-side apply. This means that existing HelmReleases will continue to use client-side apply until their .spec is updated with .spec.{upgrade|rollback}.serverSideApply: enabled.

The poller health check strategy uses kstatus to check the status of applied resources, while the legacy strategy uses Helm v3's built-in health checking behavior.

The controller now can be configured to cancel in-progress health checks when a new reconciliation request is received, reducing the mean time to recovery (MTTR) in case of failed deployments. This feature is enabled by the CancelHealthCheckOnNewRevision feature gate. Note that enabling this feature gate will not cancel apply operations, and will only cancel health checks for managed resources. Waiting for Helm hooks and tests will not be cancelled. Note also that this feature is only available with the poller health check strategy.

... (truncated)

Commits

• c618784 Merge pull request #1413 from fluxcd/release-v1.5.0
• fdd7bea Release v1.5.0
• 1362c5f Add changelog entry for v1.5.0
• 695af92 Upgrade source-controller API to v1.8.0
• 3b6abe1 Merge pull request #1412 from fluxcd/fix-postrenderers-digest
• 93299f1 Fix postRenderers not causing new upgrade when applied during ongoing upgrade
• a5e62ed Merge pull request #1411 from fluxcd/fix-1409
• be82255 Fix controller not reconciling conditions for in-sync release
• 58abe06 Merge pull request #1410 from fluxcd/update-pkg-deps/main
• 18409a4 Pass context to runtime.KubeConfig()
• Additional commits viewable in compare view

Updates github.com/fluxcd/kustomize-controller/api from 1.7.3 to 1.8.0

Release notes

Sourced from github.com/fluxcd/kustomize-controller/api's releases.

v1.8.0

Changelog

v1.8.0 changelog

Container images

• docker.io/fluxcd/kustomize-controller:v1.8.0
• ghcr.io/fluxcd/kustomize-controller:v1.8.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/kustomize-controller/api's changelog.

1.8.0

Release date: 2026-02-17

This minor release comes with various bug fixes and improvements.

⚠️ The v1beta2 APIs were removed. Before upgrading the CRDs, Flux users must run flux migrate to migrate the cluster storage off v1beta2.

Kustomization

The controller now cancels in-progress health checks when a new reconciliation request is received, reducing the mean time to recovery (MTTR) in case of failed deployments. This is available through the CancelHealthCheckOnNewRevision feature gate, that previously worked only for new source revisions but now also works for any watch events that trigger a new reconciliation.

A custom SSA stage has been introduced, allowing Role and RoleBinding objects to be applied in the same call even when the impersonated ServiceAccount does not have a ClusterRoleBinding for cluster-admin. This can be specified with the flag --custom-apply-stage-kinds=rbac.authorization.k8s.io/Role.

Health checks now handle Jobs with TTL set to zero seconds that are deleted before or during health checking.

A DirectSourceFetch feature gate has been added to bypass cache for source objects, enabling immediate consistency for source object reads.

General updates

In addition, the Kubernetes dependencies have been updated to v1.35.0, Kustomize has been updated to v5.8.1 and the controller is now built with Go 1.26.

Fixes:

• Fix decryptor copy of auth.Option slices (avoid overrides) #1570

Improvements:

• Reduce the mean time to recovery (MTTR) in case of failed deployments #1536
• Introduce custom SSA stage #1571
• Handle Jobs with TTL in health checks #1578
• Add DirectSourceFetch feature gate to bypass cache for source objects #1586
• Remove deprecated APIs in group kustomize.toolkit.fluxcd.io/v1beta2 #1584

... (truncated)

Commits

• 40b3758 Merge pull request #1590 from fluxcd/release-v1.8.0
• 95af198 Release v1.8.0
• 51968a9 Add changelog entry for v1.8.0
• 28f721c Upgrade source-controller API to v1.8.0
• 57504a2 Merge pull request #1589 from fluxcd/update-pkg-deps/main
• 173bd8c Update fluxcd/pkg dependencies
• 0f3acff Merge pull request #1588 from fluxcd/cmd-bump
• 418da71 Introduce workflow for bumping fluxcd/pkg deps
• 4f41773 Merge pull request #1586 from dipti-pai/direct-source-fetch
• f146806 Add DirectSourceFetch feature gate to bypass cache for source objects
• Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/runtime from 0.101.0 to 0.102.0

Commits

• 197b0fd Merge pull request #1120 from fluxcd/release-main
• 7c22edb Fix release preview workflow
• cf1b387 Prepare for release
• 21b9098 Merge pull request #1118 from alvaroaleman/disable-clientside
• efbb0c9 Kubeconfig: Disable clientside ratelimtier if flowcontrol is supported
• See full diff in compare view

Updates github.com/fluxcd/source-controller/api from 1.7.4 to 1.8.0

Release notes

Sourced from github.com/fluxcd/source-controller/api's releases.

v1.8.0

Changelog

v1.8.0 changelog

Container images

• docker.io/fluxcd/source-controller:v1.8.0
• ghcr.io/fluxcd/source-controller:v1.8.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/source-controller/api's changelog.

1.8.0

Release date: 2026-02-17

This minor release comes with Helm v4 support, cosign v3 verification, and various improvements.

⚠️ The v1beta2 APIs were removed. Before upgrading the CRDs, Flux users must run flux migrate to migrate the cluster storage off v1beta2.

HelmChart

The HelmChart controller now uses Helm v4. The HelmRepository type oci has been moved to maintenance mode, users should migrate to OCIRepository.

CRD validation for v1 has been aligned with v1beta2 so that invalid specs are rejected at admission time.

OCIRepository

The OCIRepository controller now supports verifying artifacts signed with both cosign v2 and cosign v3.

GitRepository

The github provider now supports looking up the GitHub App installation ID automatically, removing the need to configure it manually.

General updates

In addition, the Kubernetes dependencies have been updated to v1.35.0 and the controller is now built with Go 1.26.

Improvements:

• Upgrade Helm to v4 #1953 #1958 #1980
• Discover cosign v3 NewBundleFormat for verification #1961
• Introduce support for looking up GH app installation ID #1963
• Remove deprecated APIs in group source.toolkit.fluxcd.io/v1beta2 #1983
• Docs: Move HelmRepository type oci to maintenance mode #1985
• sourcev1: align CRD validation with v1beta2 #1944
• Various dependency updates

... (truncated)

Commits

• 7fbbcd6 Merge pull request #1988 from fluxcd/release-v1.8.0
• 7664502 Release v1.8.0
• d812004 Add changelog entry for v1.8.0
• a73fcfc Merge pull request #1987 from fluxcd/update-pkg-deps/main
• c32dfc1 Update fluxcd/pkg dependencies
• 2bbbffc Merge pull request #1986 from fluxcd/cmd-bump
• 94ca3b5 Introduce workflow for bumping fluxcd/pkg deps
• 9f6d639 Merge pull request #1985 from fluxcd/hr-oci-maintenance
• 79727ec Docs: Move HelmRepository type oci to maintenance mode
• e3fb3e7 Merge pull request #1984 from fluxcd/go-1.26
• Additional commits viewable in compare view

Updates github.com/google/go-containerregistry from 0.20.7 to 0.21.0

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.21.0

This release updates the minimum Go version to 1.25.6.

What's Changed

• fix(mutate): don't skip dir replacements via whiteout in export by @​r4f4 in google/go-containerregistry#2191
• Improve performance of v1.NewHash by @​bmoylan in google/go-containerregistry#2194
• Bump the actions group across 1 directory with 4 updates by @​dependabot[bot] in google/go-containerregistry#2207
• Bump the root-deps group across 1 directory with 7 updates by @​dependabot[bot] in google/go-containerregistry#2195
• Fix error messages in crane_test.go by @​jammie-jelly in google/go-containerregistry#2189
• Bump go version across packages to 1.25.6 by @​Subserial in google/go-containerregistry#2211
• Join go.mod dependency updates by @​Subserial in google/go-containerregistry#2212
• Bump the go-deps group across 3 directories with 3 updates by @​dependabot[bot] in google/go-containerregistry#2213
• Disable taint gosec lints by @​Subserial in google/go-containerregistry#2215
• Update go version used in goreleaser by @​Subserial in google/go-containerregistry#2216

New Contributors

• @​r4f4 made their first contribution in google/go-containerregistry#2191
• @​jammie-jelly made their first contribution in google/go-containerregistry#2189

Full Changelog: google/go-containerregistry@v0.20.7...v0.21.0

Commits

• 8e2d6a6 Update go version used in goreleaser (#2216)
• b58334f Disable taint gosec lints (#2215)
• 88b39ed Bump the go-deps group across 3 directories with 3 updates (#2213)
• 102ac75 join go.mod dependency updates (#2212)
• d5817d5 Bump go version across packages to 1.25.6 (#2211)
• 23f0632 Fix error messages in crane_test.go (#2189)
• 438abde Bump the root-deps group across 1 directory with 7 updates (#2195)
• b6eadd8 Bump the actions group across 1 directory with 4 updates (#2207)
• 93aa273 Improve performance of v1.NewHash (#2194)
• 795787c mutate: don't skip dir replacements via whiteout in export (#2191)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions