Skip to content

chore(deps): Update testing-tools#1

Open
github-actions[bot] wants to merge 1 commit into
mainfrom
renovate/testing-tools
Open

chore(deps): Update testing-tools#1
github-actions[bot] wants to merge 1 commit into
mainfrom
renovate/testing-tools

Conversation

@github-actions

@github-actions github-actions Bot commented May 11, 2026 •
edited
Loading

Copy link
Copy Markdown

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
fluxcd/flux2 testing_tools minor v2.8.8 → v2.9.2
helm/helm testing_tools patch v4.2.0 → v4.2.3
helmfile/helmfile testing_tools minor v1.5.2 → v1.7.1
kubernetes-sigs/karpenter testing_tools minor v1.12.1 → v1.14.0
kubernetes-sigs/kwok testing_tools minor v0.7.0 → v0.8.0
kubernetes/kubernetes testing_tools patch v1.36.1 → v1.36.2
mikefarah/yq testing_tools patch v4.53.2 → v4.53.3
nvkind testing_tools digest 24c190e → c570504
tilt-dev/tilt testing_tools patch 0.37.3 → 0.37.5
zarf-dev/zarf testing_tools minor v0.77.0 → v0.81.1

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

fluxcd/flux2 (fluxcd/flux2)

v2.9.2

Compare Source

Highlights

Flux v2.9.2 is a patch release. The main fix addresses a regression introduced in
v2.9.1 where a Kustomization with openapi.path pointing to a URL failed to
reconcile with failed to read OpenAPI schema. This release also corrects several
CRD field descriptions that contained inaccurate or leaked content. Users are
encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

  • Fix a regression where a Kustomization with openapi.path pointing to a URL failed to reconcile with failed to read OpenAPI schema (kustomize-controller)
  • Fix the HelmChart CRD description for .status.url, which pointed users at BucketStatus.Artifact instead of HelmChartStatus.Artifact (source-controller)
  • Fix the ImageRepository CRD description for .status.observedExclusionList, which referred to spec.lastScanResult instead of status.lastScanResult (image-reflector-controller)
  • Fix the ImageUpdateAutomation CRD description for .status.observedSourceRevision, which had a stray Go struct declaration leaking into it (image-automation-controller)

Improvements:

  • Update fluxcd/pkg dependencies

Components changelog

CLI changelog

Full Changelog: fluxcd/flux2@v2.9.1...v2.9.2

v2.9.1

Compare Source

Highlights

Flux v2.9.1 is a patch release. The main fix, applied across all controllers, disables Flux variable substitution on the Flux CRDs by annotating them with kustomize.toolkit.fluxcd.io/substitute: disabled, so that Kustomizations with post-build substitution enabled no longer corrupt the CRD schemas when they contain ${...} sequences. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

  • Disable Flux variable substitution on all Flux CRDs, preventing post-build substitution from corrupting CRD schemas that contain ${...} sequences (all controllers)
  • Update SOPS dependency to fix .ini file decryption (kustomize-controller)
  • Fix a dry-run error where applying a resource with a strategic merge patch could fail with <resource> is invalid (kustomize-controller)
  • Fix a breaking change in the in-memory Kustomization build (Flux CLI)

Improvements:

  • Cache the registry authorization token during Notation verification, so it is fetched once per verification instead of once per request (source-controller)
  • Update fluxcd/pkg dependencies

Components changelog

CLI changelog

Full Changelog: fluxcd/flux2@v2.9.0...v2.9.1

v2.9.0

Compare Source

Highlights

Flux v2.9.0 is a feature release. Users are encouraged to upgrade for the best experience.

For a compressive overview of new features and API changes included in this release, please refer to the Announcing Flux 2.9 GA blog post.

Overview of the new features:

  • Flux CLI Plugin System with the Mirror and Schema plugins (flux plugin)
  • Server-Side Apply field ignore rules for fine-grained drift control (Kustomization)
  • SOPS decryption with the Age post-quantum cipher (Kustomization)
  • Kubernetes Workload Identity authentication for OpenBao and Vault (Kustomization)
  • Helm post-render strategies, including chart hooks support (HelmRelease)
  • Literal mode for Helm values references mirroring helm --set-literal (HelmRelease)
  • Allow empty kind in CEL health check expressions (Kustomization, HelmRelease)
  • Git commit signing and verification with SSH keys (GitRepository, ImageUpdateAutomation)
  • AWS CodeCommit authentication using Workload Identity (GitRepository)
  • Custom Sigstore trusted root for keyless verification in air-gapped environments (OCIRepository)
  • Path pattern directory discovery for monorepos (ArtifactGenerator)
  • Secret-less, OIDC-secured webhook Receivers (Receiver)

❤️ Big thanks to all the Flux contributors that helped us with this release!

Kubernetes compatibility

This release is compatible with the following Kubernetes versions:

Kubernetes version Minimum required
v1.34 >= 1.34.1
v1.35 >= 1.35.0
v1.36 >= 1.36.0

[!NOTE]
Note that the Flux project offers support only for the latest three minor versions of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors such as
ControlPlane that provide enterprise support for Flux.

OpenShift compatibility

Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using Flux Operator. The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage.

Upgrade procedure

⚠️ The Flux APIs image.toolkit.fluxcd.io/v1beta2 and notification.toolkit.fluxcd.io/v1beta2
have reached end-of-life and have been removed from the CRDs.

Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from older versions of Flux to v2.9.

Components changelog

CLI changelog

New Contributors

Full Changelog: fluxcd/flux2@v2.8.0...v2.9.0

helm/helm (helm/helm)

v4.2.3: Helm v4.2.3

Compare Source

Helm v4.2.3 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v4.2.3. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.4 and 3.21.4 are the next patch releases scheduled for August 12, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 43e8b7f (Terry Howe)

v4.2.2: Helm v4.2.2

Compare Source

Helm v4.2.2 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Revert: Fixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite #​32214

Installation and Upgrading

Download Helm v4.2.2. The common platform binaries are here:

This release was signed by @​gjenkins8 with key BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739, which can be found at https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.3 and 3.21.2 are the next patch releases scheduled for July 8, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • Revert "fix(kube): prevent spurious early exit in WaitForDelete during informer sync" b05881c (George Jenkins)

Full Changelog: helm/helm@v4.2.1...v4.2.2

v4.2.1: Helm v4.2.1

Compare Source

Helm v4.2.1 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Fixed data race detected by -race flag when concurrent goroutines (upgrade + rollback, install + uninstall) both call GetWaiterWithOptions on the same FailingKubeClient instance #​31925
  • Fixed helm command success messages writing to stderr instead of stdout. Now correctly outputing to stdout #​32056
  • Fixed Helm 4 emitting "unable to find exact version" when using version range constraints #​31757
  • Fixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite #​32081
  • Bumped golang.org/x/net to v0.55.0 to address GO-2026-5026 #​32153
  • Fixed SDK errors by upgrading dependencies: cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1 #​32128
  • Dependency updates

Installation and Upgrading

Download Helm v4.2.1. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @​scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.2 and 3.21.2 are the next patch releases scheduled for July 8, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • fix: protect FailingKubeClient.RecordedWaitOptions from data race (#​31925) d591a19 (Terry Howe)
  • fix: route registry client output to stdout instead of stderr (#​32056) 2a9fcae (Terry Howe)
  • chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1 ffa5bd6 (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 9f9dbaf (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 64a2891 (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 e54a4a2 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.36.1 to 4.36.2 acb762b (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.36.0 to 4.36.1 768586d (dependabot[bot])
  • fix(version): avoid false range detection on prerelease x/X eabfae5 (Benoit Tigeot)
  • fix(version): version range || can has no space e3fd51f (Benoit Tigeot)
  • feat: report in debug the version we select with version range arg 1e47395 (Benoit Tigeot)
  • fix: prevent warning when using version range constraints a33e239 (Benoit Tigeot)
  • fix(kube): always propagate context.Canceled in WaitForDelete fa06d44 (Terry Howe)
  • fix(kube): prevent spurious early exit in WaitForDelete during informer sync 360d483 (Terry Howe)
  • chore(deps): bump github.com/tetratelabs/wazero from 1.11.0 to 1.12.0 7651edf (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 b132e7e (dependabot[bot])
  • fix(deps): bump golang.org/x/net to v0.55.0 to address GO-2026-5026 eee491a (Terry Howe)
  • chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 3e3c575 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.5 to 4.36.0 c4ce2bb (dependabot[bot])
  • chore(deps): bump actions/stale from 10.2.0 to 10.3.0 3892dc2 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 c4bbb62 (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 a0d7f16 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 8a3de05 (dependabot[bot])
  • fix(upstream): upgrade to cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1 57a4803 (Matheus Pimenta)
  • chore(deps): bump github.com/fluxcd/cli-utils from 1.2.0 to 1.2.1 b33ae02 (dependabot[bot])

Full Changelog: helm/helm@v4.2.0...v4.2.1

helmfile/helmfile (helmfile/helmfile)

v1.7.1

Compare Source

What's Changed

New Contributors

Full Changelog: helmfile/helmfile@v1.7.0...v1.7.1

v1.7.0

Compare Source

What's Changed

New Contributors

Full Changelog: helmfile/helmfile@v1.6.0...v1.7.0

v1.6.0

Compare Source

Helmfile v1.6.0

This release introduces helmfile doctor — an AI-assisted diff analyzer that
reads your helmfile diff output and asks an LLM to summarize the changes and
flag risks before you apply them. We also ship parallel kubedog tracking
so resource convergence now happens alongside (not after) helm execution.

🩺 helmfile doctor: AI-assisted diff analysis

helmfile doctor runs helmfile diff, then sends the diff to any
OpenAI-compatible Chat Completions endpoint to produce a structured risk
report. It is designed to drop into a CI pipeline before helmfile apply so a
human reviewer (or a gate) gets a fast, opinionated second opinion on what is
about to change.

Quick start
# Configure via env (lowest precedence)...
export HELMFILE_LLM_API_KEY="sk-..."
export HELMFILE_LLM_MODEL="gpt-4o"

# ...or helmfile.yaml...
llm:
  baseURL: "https://api.openai.com/v1"
  apiKey: {{ env "OPENAI_API_KEY" }}
  model: "gpt-4o"

# ...or flags (highest precedence)
helmfile doctor --llm-model claude-3-5-sonnet
helmfile doctor

Example output:


# Helmfile Doctor Report

## Summary
Upgrades the checkout Deployment from v1.4 to v1.5 and raises the replica
count from 3 to 5. The database StatefulSet is unchanged.

## Risks

### 🔴 [HIGH] data-loss
The PVC `data-checkout-0` is marked for deletion ...
**Suggestion:** `kubectl get pvc data-checkout-0 -o yaml` before applying.

### 🟡 [MEDIUM] downtime
No PodDisruptionBudget found for the checkout Deployment ...
**Suggestion:** Add a PDB before scaling.

---
Model: gpt-4o | Duration: 8.2s | Secrets redacted: 3
How it works
  1. Runs helmfile diff (with --context defaulting to 3 so the model gets
    enough surrounding YAML to ground its analysis).
  2. Runs the diff through a defense-in-depth secret redactor (see below).
  3. Sends the redacted diff to the LLM with a system prompt that frames it as a
    senior Kubernetes/Helm reviewer and locks the output to a known JSON schema.
  4. Renders a markdown report (or --output json for programmatic consumption).
Risk model

The model evaluates the diff across six categories and three severity levels:

Category What it catches
data-loss PVCs, databases, stateful workloads deleted/recreated
security New privileges, host networking, plaintext secrets
breaking-change Renamed values, dropped labels, apiVersion downgrades
downtime Missing PDBs, rolling-update storms, missing readiness gates
performance Huge resource requests, removed HPA, expensive sidecars
best-practice Missing namespace, hardcoded images, misaligned labels

Severity drives the exit code, making doctor a CI gate:

  • 0 — success, or only low/medium risks, or LLM call failed (degraded mode).
  • 2 — at least one high risk and --force was not passed.
    (helm-diff's own "detected changes" exit-2 is intentionally swallowed —
    changes are doctor's whole job.)
  • 1 — other error (state load failure, helm-diff runtime failure, etc.).

Pass --force to keep the report but skip the high-risk gate.

Secret safety

Secrets are always redacted before any byte leaves the process — there is
no opt-out. This is enforced in two layers:

  1. --show-secrets is silently ignored; the diff config is wrapped so
    ShowSecrets() returns false, making helm-diff itself emit <REDACTED>.
  2. A built-in SecretRedactor then strips any residual secret-looking content
    (Secret resource data: blocks, sensitive key names like password /
    apiKey / token, free-form long base64, and JWT-shaped tokens). The
    redaction count is always shown in the report footer so you can spot
    unexpected leaks.

JSON output (--output json) exposes only post-redaction diffs — doctor never
echoes raw pre-redaction content through stdout or JSON.

Graceful degradation

When no LLM is configured (no HELMFILE_LLM_API_KEY / model / llm: block /
--llm-* flags), doctor degrades to a plain helmfile diff with
--show-secrets forced off — byte-for-byte identical behavior, just safer.

Configuration precedence
env (HELMFILE_LLM_*)  <  helmfile.yaml (llm:)  <  CLI flags (--llm-*)
Flag Purpose
--llm-base-url OpenAI-compatible endpoint URL
--llm-api-key API key (prefer helmfile.yaml + {{ env }} over the CLI)
--llm-model Model id (gpt-4o, claude-3-5-sonnet via gateway, ...)
--llm-timeout Per-request timeout (default 60s)

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@github-actions github-actions Bot changed the title chore(deps): Update dependency kyverno/chainsaw to v0.2.15 chore(deps): Update dependency kyverno/chainsaw to v0.2.15 - autoclosed May 12, 2026
@github-actions github-actions Bot closed this May 12, 2026
@github-actions
github-actions Bot deleted the renovate/testing-tools branch May 12, 2026 07:44
@github-actions github-actions Bot changed the title chore(deps): Update dependency kyverno/chainsaw to v0.2.15 - autoclosed chore(deps): Update testing-tools May 18, 2026
@github-actions github-actions Bot reopened this May 18, 2026
@github-actions
github-actions Bot force-pushed the renovate/testing-tools branch 2 times, most recently from 025ba32 to 2896937 Compare May 18, 2026 08:45
@github-actions github-actions Bot changed the title chore(deps): Update testing-tools chore(deps): Update testing-tools - autoclosed May 20, 2026
@github-actions github-actions Bot closed this May 20, 2026
@github-actions github-actions Bot changed the title chore(deps): Update testing-tools - autoclosed chore(deps): Update testing-tools May 25, 2026
@github-actions github-actions Bot reopened this May 25, 2026
@github-actions
github-actions Bot force-pushed the renovate/testing-tools branch 2 times, most recently from 2896937 to 35536ac Compare May 25, 2026 08:58
@github-actions
github-actions Bot force-pushed the renovate/testing-tools branch 2 times, most recently from 99f4c83 to 0d31283 Compare June 8, 2026 09:24
@github-actions
github-actions Bot force-pushed the renovate/testing-tools branch 3 times, most recently from 2bcf4c3 to 47cec8b Compare June 16, 2026 10:08
@github-actions
github-actions Bot force-pushed the renovate/testing-tools branch 3 times, most recently from 8953237 to 623f552 Compare June 26, 2026 08:30
@github-actions
github-actions Bot force-pushed the renovate/testing-tools branch 3 times, most recently from 55ff063 to 8cb5b28 Compare July 6, 2026 09:01
@github-actions
github-actions Bot force-pushed the renovate/testing-tools branch 2 times, most recently from 1a0556a to dd0f06f Compare July 13, 2026 08:17
@github-actions
github-actions Bot force-pushed the renovate/testing-tools branch 2 times, most recently from 80bb80b to 22f4481 Compare July 17, 2026 07:17
@github-actions
github-actions Bot force-pushed the renovate/testing-tools branch from 22f4481 to 0e1abc1 Compare July 21, 2026 07:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants