# Flux changelog

> Open and extensible continuous delivery for Kubernetes.

- Vendor: Flux project
- Category: Infrastructure & DevOps
- License: Apache-2.0
- Language: Go
- Official site: https://fluxcd.io
- Tracked by: What's New (https://whatsnew.fyi/product/flux)
- Harvested from: GitHub (fluxcd/flux2)
- Entries below: 13 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: release facts (products, versions, dates, links, CVE ids and flags) are open data under CC BY 4.0, from the API at https://whatsnew.fyi/api/v1 or the nightly dataset at https://github.com/whatsnew-fyi/dataset. The summaries, labels and curation are © What's New: quote freely with attribution and a link back; wholesale republication of them is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v2.9.6

- Date: 2026-10-01
- Version: v2.9.6
- Original notes: https://github.com/fluxcd/flux2/releases/tag/v2.9.6
- Permalink: https://whatsnew.fyi/product/flux/releases/v2.9.6

- **fixed** — Stop reapplying chart CRDs on upgrades when using server-side apply with the default Create policy
- **fixed** — Recover HelmReleases stranded with a drifted Ready=Unknown condition after a failed status patch
- **fixed** — Ignore NotFound when deleting the HelmChart
- **fixed** — Normalize Azure Blob listing ETags so unchanged containers are not re-downloaded on every reconcile
- **fixed** — Evict stale Helm repository index entries from the cache to avoid Cache is full errors
- **fixed** — Extend SOPS decryption error redaction to spec.postBuild.substituteFrom values
- **added** — Add the opt-in DisableCommitStatusEvent feature gate

##### Highlights

Flux v2.9.6 is a patch release that stops helm-controller from reapplying chart CRDs on every upgrade when server-side apply is enabled, and recovers HelmReleases left with a drifted `Ready=Unknown` condition after a failed status patch. source-controller normalizes Azure Blob listing ETags so unchanged containers are no longer re-downloaded on every reconcile, and evicts stale Helm repository index entries from the cache so repositories with frequently changing indexes no longer fail with "Cache is full". kustomize-controller extends SOPS decryption error redaction to `spec.postBuild.substituteFrom` values, so substituted secrets echoed back in API validation errors are masked out of status conditions and events, and adds the opt-in `DisableCommitStatusEvent` feature gate. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:
- Stop reapplying chart CRDs on upgrades when using server-side apply with the default `Create` policy (helm-controller)
- Recover HelmReleases stranded with a drifted `Ready=Unknown` condition after a failed status patch (helm-controller)
- Ignore `NotFound` when deleting the HelmChart (helm-controller)
- Normalize Azure Blob listing ETags so unchanged containers are not re-downloaded on every reconcile (source-controller)
- Evict stale Helm repository index entries from the cache to avoid "Cache is full" errors (source-controller)
- Extend SOPS decryption error redaction to `spec.postBuild.substituteFrom` values (kustomize-controller)

Improvements:
- Add the opt-in `DisableCommitStatusEvent` feature gate (kustomize-controller)

##### Components changelog

- source-controller [v1.9.6](https://github.com/fluxcd/source-controller/blob/v1.9.6/CHANGELOG.md)
- kustomize-controller [v1.9.6](https://github.com/fluxcd/kustomize-controller/blob/v1.9.6/CHANGELOG.md)
- helm-controller [v1.6.5](https://github.com/fluxcd/helm-controller/blob/v1.6.5/CHANGELOG.md)

##### CLI changelog

* [release/v2.9.x] Format reproducible created timestamp in UTC by @fluxcdbot in https://github.com/fluxcd/flux2/pull/6081
* Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/6097

**Full Changelog**: https://github.com/fluxcd/flux2/compare/v2.9.5...v2.9.6

### v2.9.5

- Date: 2026-08-31
- Version: v2.9.5
- Original notes: https://github.com/fluxcd/flux2/releases/tag/v2.9.5
- Permalink: https://whatsnew.fyi/product/flux/releases/v2.9.5

- **changed** — Move helm-controller and source-controller back to upstream Helm v4.2.4, dropping the Flux fork
- **fixed** — Validate kubeconfigs from .spec.kubeConfig Secrets, rejecting local file references in certificate-authority, tokenFile, client-certificate and client-key; credentials and certificates must be embedded inline in helm-controller and kustomize-controller
- **fixed** — Purge temporary directories at startup in kustomize-controller
- **fixed** — Fix panic on negative-length substring expressions in post-build substitution in kustomize-controller and flux CLI
- **changed** — Update fluxcd/pkg dependencies, bringing Kubernetes to 1.36.4 across all controllers and the CLI

##### Highlights

Flux v2.9.5 is a patch release that moves helm-controller and source-controller back to upstream Helm, now at v4.2.4, dropping the temporary Flux fork. It hardens the handling of kubeconfig Secrets in helm-controller and kustomize-controller, which now reject kubeconfigs referencing files on the local filesystem and require credentials and certificates to be embedded inline. It also stops kustomize-controller from leaving behind the temporary directories of a previous process that exited without running its cleanup, and fixes a crash in post-build substitution where a substring expression with a negative length, e.g. `${VAR:2:-1}`, panicked instead of counting back from the end of the string like Bash does. Across all controllers and the CLI, the fluxcd/pkg dependencies have been updated, bringing Kubernetes to 1.36.4. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:
- Validate kubeconfigs from `.spec.kubeConfig` Secrets, rejecting local file references in `certificate-authority`, `tokenFile`, `client-certificate` and `client-key`; credentials and certificates must be embedded inline (helm-controller, kustomize-controller)
- Purge temporary directories at startup (kustomize-controller)
- Fix panic on negative-length substring expressions in post-build substitution (kustomize-controller, flux CLI)

Improvements:
- Move back to upstream Helm v4.2.4, dropping the Flux fork (helm-controller, source-controller)
- Update fluxcd/pkg dependencies, which bring Kubernetes to 1.36.4 (all controllers, flux CLI)

##### Components changelog

- source-controller [v1.9.5](https://github.com/fluxcd/source-controller/blob/v1.9.5/CHANGELOG.md)
- source-watcher [v2.2.4](https://github.com/fluxcd/source-watcher/blob/v2.2.4/CHANGELOG.md)
- kustomize-controller [v1.9.5](https://github.com/fluxcd/kustomize-controller/blob/v1.9.5/CHANGELOG.md)
- helm-controller [v1.6.4](https://github.com/fluxcd/helm-controller/blob/v1.6.4/CHANGELOG.md)
- notification-controller [v1.9.4](https://github.com/fluxcd/notification-controller/blob/v1.9.4/CHANGELOG.md)
- image-reflector-controller [v1.2.5](https://github.com/fluxcd/image-reflector-controller/blob/v1.2.5/CHANGELOG.md)
- image-automation-controller [v1.2.5](https://github.com/fluxcd/image-automation-controller/blob/v1.2.5/CHANGELOG.md)

##### CLI changelog

* Update fluxcd/pkg dependencies by @fluxcdbot in https://github.com/fluxcd/flux2/pull/6046
* Update fluxcd/pkg dependencies by @fluxcdbot in https://github.com/fluxcd/flux2/pull/6048
* Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/6049

**Full Changelog**: https://github.com/fluxcd/flux2/compare/v2.9.4...v2.9.5

### v2.9.4

- Date: 2026-08-07
- Version: v2.9.4
- Original notes: https://github.com/fluxcd/flux2/releases/tag/v2.9.4
- Permalink: https://whatsnew.fyi/product/flux/releases/v2.9.4

- **fixed** — Confine tarball extraction and bound glob expansion in source-watcher
- **fixed** — Disallow force-update and deletion via refspecs in image-automation-controller
- **fixed** — Unify HTTP server request limits in notification-controller
- **fixed** — Align Helm repository index loading with upstream Helm v4 in source-controller
- **fixed** — Improve error handling in Bucket reconciliation in source-controller
- **fixed** — Pin OCI chart verification by digest in source-controller
- **fixed** — Limit GCS static authentication to service account keys in source-controller
- **fixed** — Restrict the allow-webhooks network policy to the receiver port in flux CLI
- **added** — Add support for migrating repositories to 2.9 in flux migrate -f
- **changed** — Update fluxcd/pkg dependencies to align ECR host detection with upstream

##### Highlights

Flux v2.9.4 is a patch release that ships various fixes to the Flux controllers, covering source-watcher tarball extraction and glob expansion limits, the refspecs accepted by `ImageUpdateAutomation`, the HTTP request limits of the notification-controller servers, and Helm repository index loading, OCI chart digest pinning, `Bucket` error handling and GCS static authentication in source-controller. On the CLI side, `flux migrate -f` now supports migrating repositories to Flux 2.9. Users are encouraged to upgrade for the best experience.

Note that this release contains CRD schema changes for `ArtifactGenerator` and `ImageUpdateAutomation`; both CRDs must be updated along with the controllers.

ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:
- Confine tarball extraction and bound glob expansion (source-watcher)
- Disallow force-update and deletion via refspecs (image-automation-controller)
- Unify HTTP server request limits (notification-controller)
- Align Helm repository index loading with upstream Helm v4 (source-controller)
- Improve error handling in `Bucket` reconciliation (source-controller)
- Pin OCI chart verification by digest (source-controller)
- Limit GCS static authentication to service account keys (source-controller)
- Restrict the `allow-webhooks` network policy to the receiver port (flux CLI)

Improvements:
- Add support for migrating repositories to 2.9 in `flux migrate -f` (flux CLI)
- Update fluxcd/pkg dependencies, which align the ECR host detection with upstream (source-controller, image-reflector-controller, flux CLI)
- Update Bitbucket Cloud receiver guidance (notification-controller)

##### Components changelog

- source-controller [v1.9.4](https://github.com/fluxcd/source-controller/blob/v1.9.4/CHANGELOG.md)
- source-watcher [v2.2.3](https://github.com/fluxcd/source-watcher/blob/v2.2.3/CHANGELOG.md)
- notification-controller [v1.9.3](https://github.com/fluxcd/notification-controller/blob/v1.9.3/CHANGELOG.md)
- image-reflector-controller [v1.2.4](https://github.com/fluxcd/image-reflector-controller/blob/v1.2.4/CHANGELOG.md)
- image-automation-controller [v1.2.4](https://github.com/fluxcd/image-automation-controller/blob/v1.2.4/CHANGELOG.md)

##### CLI changelog

* [release/v2.9.x] Add support for 2.9 in `migrate -f` by @fluxcdbot in https://github.com/fluxcd/flux2/pull/6021
* Update fluxcd/pkg dependencies by @fluxcdbot in https://github.com/fluxcd/flux2/pull/6026
* [release/v2.9.x] fix: restrict `allow-webhooks` netpol to receiver port by @fluxcdbot in https://github.com/fluxcd/flux2/pull/6029
* Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/6031

**Full Changelog**: https://github.com/fluxcd/flux2/compare/v2.9.3...v2.9.4

### v2.9.3

- Date: 2026-07-23
- Version: v2.9.3
- Original notes: https://github.com/fluxcd/flux2/releases/tag/v2.9.3
- Permalink: https://whatsnew.fyi/product/flux/releases/v2.9.3

- **fixed** — Fix empty lines vanishing from rendered chart manifests
- **fixed** — Fix HasBeenTested for all corner cases where a release could be marked as tested although its Helm test hooks never ran
- **fixed** — Fix spec.images entry setting only some image fields discarding the remaining fields already declared for the same image in kustomization.yaml
- **changed** — Update fluxcd/pkg dependencies
- **added** — Include source-watcher in the OCI flux-manifests artifact

##### Highlights

Flux v2.9.3 is a patch release. It fixes empty lines vanishing from rendered Helm chart manifests, HelmReleases being marked as tested when their Helm test hooks never ran, and `spec.images` entries that set only some image fields discarding the remaining fields already declared for the same image in the `kustomization.yaml`. The latter affects both kustomize-controller and the `flux build|diff kustomization` commands. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:
- Fix empty lines vanishing from rendered chart manifests (helm-controller)
- Fix `HasBeenTested` for all corner cases, where a release could be marked as tested although its Helm test hooks never ran (helm-controller)
- Fix a `spec.images` entry setting only some of the image fields discarding the remaining fields already declared for the same image in the `kustomization.yaml` at `spec.path`, e.g. overriding only `newName` produced an untagged image reference (kustomize-controller, flux CLI)

Improvements:
- Update fluxcd/pkg dependencies
- Include source-watcher in the OCI flux-manifests artifact

##### Components changelog

- kustomize-controller [v1.9.4](https://github.com/fluxcd/kustomize-controller/blob/v1.9.4/CHANGELOG.md)
- helm-controller [v1.6.3](https://github.com/fluxcd/helm-controller/blob/v1.6.3/CHANGELOG.md)

##### CLI changelog

* [release/v2.9.x] Include source-watcher to oci flux-manifests by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5996
* Update fluxcd/pkg dependencies by @fluxcdbot in https://github.com/fluxcd/flux2/pull/6006
* Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/6011

**Full Changelog**: https://github.com/fluxcd/flux2/compare/v2.9.2...v2.9.3

### v2.9.2

- Date: 2026-07-13
- Version: v2.9.2
- Original notes: https://github.com/fluxcd/flux2/releases/tag/v2.9.2
- Permalink: https://whatsnew.fyi/product/flux/releases/v2.9.2

- **fixed** — Fix a regression where a Kustomization with openapi.path pointing to a URL failed to reconcile with failed to read OpenAPI schema
- **fixed** — Fix the HelmChart CRD description for .status.url, which pointed users at BucketStatus.Artifact instead of HelmChartStatus.Artifact
- **fixed** — Fix the ImageRepository CRD description for .status.observedExclusionList, which referred to spec.lastScanResult instead of status.lastScanResult
- **fixed** — Fix the ImageUpdateAutomation CRD description for .status.observedSourceRevision, which had a stray Go struct declaration leaking into it
- **changed** — Update fluxcd/pkg dependencies

##### Highlights

Flux v2.9.2 is a patch release. The main fix addresses a regression introduced in
v2.9.1 where a Kustomization with `openapi.path` pointing to a URL failed to
reconcile with `failed to read OpenAPI schema`. This release also corrects several
CRD field descriptions that contained inaccurate or leaked content. Users are
encouraged to upgrade for the best experience.

ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:
- Fix a regression where a Kustomization with `openapi.path` pointing to a URL failed to reconcile with `failed to read OpenAPI schema` (kustomize-controller)
- Fix the `HelmChart` CRD description for `.status.url`, which pointed users at `BucketStatus.Artifact` instead of `HelmChartStatus.Artifact` (source-controller)
- Fix the `ImageRepository` CRD description for `.status.observedExclusionList`, which referred to `spec.lastScanResult` instead of `status.lastScanResult` (image-reflector-controller)
- Fix the `ImageUpdateAutomation` CRD description for `.status.observedSourceRevision`, which had a stray Go struct declaration leaking into it (image-automation-controller)

Improvements:
- Update fluxcd/pkg dependencies

##### Components changelog

- source-controller [v1.9.3](https://github.com/fluxcd/source-controller/blob/v1.9.3/CHANGELOG.md)
- kustomize-controller [v1.9.3](https://github.com/fluxcd/kustomize-controller/blob/v1.9.3/CHANGELOG.md)
- helm-controller [v1.6.2](https://github.com/fluxcd/helm-controller/blob/v1.6.2/CHANGELOG.md)
- notification-controller [v1.9.2](https://github.com/fluxcd/notification-controller/blob/v1.9.2/CHANGELOG.md)
- image-reflector-controller [v1.2.3](https://github.com/fluxcd/image-reflector-controller/blob/v1.2.3/CHANGELOG.md)
- image-automation-controller [v1.2.3](https://github.com/fluxcd/image-automation-controller/blob/v1.2.3/CHANGELOG.md)
- source-watcher [v2.2.2](https://github.com/fluxcd/source-watcher/blob/v2.2.2/CHANGELOG.md)

##### CLI changelog

* Update fluxcd/pkg dependencies by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5984
* Update fluxcd/pkg dependencies by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5990
* Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5994

**Full Changelog**: https://github.com/fluxcd/flux2/compare/v2.9.1...v2.9.2

### v2.9.1

- Date: 2026-07-07
- Version: v2.9.1
- Original notes: https://github.com/fluxcd/flux2/releases/tag/v2.9.1
- Permalink: https://whatsnew.fyi/product/flux/releases/v2.9.1

- **fixed** — Disable Flux variable substitution on all Flux CRDs by annotating them with kustomize.toolkit.fluxcd.io/substitute: disabled to prevent post-build substitution from corrupting CRD schemas that contain ${...} sequences
- **fixed** — Update SOPS dependency to fix .ini file decryption in kustomize-controller
- **fixed** — Fix a dry-run error where applying a resource with a strategic merge patch could fail with is invalid in kustomize-controller
- **fixed** — Fix a breaking change in the in-memory Kustomization build in Flux CLI
- **changed** — Cache the registry authorization token during Notation verification so it is fetched once per verification instead of once per request in source-controller
- **changed** — Update fluxcd/pkg dependencies

##### Highlights

Flux v2.9.1 is a patch release. The main fix, applied across all controllers, disables Flux variable substitution on the Flux CRDs by annotating them with `kustomize.toolkit.fluxcd.io/substitute: disabled`, so that Kustomizations with post-build substitution enabled no longer corrupt the CRD schemas when they contain `${...}` sequences. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:
- Disable Flux variable substitution on all Flux CRDs, preventing post-build substitution from corrupting CRD schemas that contain `${...}` sequences (all controllers)
- Update SOPS dependency to fix `.ini` file decryption (kustomize-controller)
- Fix a dry-run error where applying a resource with a strategic merge patch could fail with `<resource> is invalid` (kustomize-controller)
- Fix a breaking change in the in-memory Kustomization build (Flux CLI)

Improvements:
- Cache the registry authorization token during Notation verification, so it is fetched once per verification instead of once per request (source-controller)
- Update fluxcd/pkg dependencies

##### Components changelog

- source-controller [v1.9.2](https://github.com/fluxcd/source-controller/blob/v1.9.2/CHANGELOG.md)
- kustomize-controller [v1.9.2](https://github.com/fluxcd/kustomize-controller/blob/v1.9.2/CHANGELOG.md)
- helm-controller [v1.6.2](https://github.com/fluxcd/helm-controller/blob/v1.6.2/CHANGELOG.md)
- notification-controller [v1.9.2](https://github.com/fluxcd/notification-controller/blob/v1.9.2/CHANGELOG.md)
- image-reflector-controller [v1.2.2](https://github.com/fluxcd/image-reflector-controller/blob/v1.2.2/CHANGELOG.md)
- image-automation-controller [v1.2.2](https://github.com/fluxcd/image-automation-controller/blob/v1.2.2/CHANGELOG.md)
- source-watcher [v2.2.2](https://github.com/fluxcd/source-watcher/blob/v2.2.2/CHANGELOG.md)

##### CLI changelog

* [release/v2.9.x] Fix breaking change in-memory kustomization build by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5971
* Update fluxcd/pkg dependencies by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5977
* Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5979

**Full Changelog**: https://github.com/fluxcd/flux2/compare/v2.9.0...v2.9.1

### v2.9.0

- Date: 2026-06-30
- Version: v2.9.0
- Original notes: https://github.com/fluxcd/flux2/releases/tag/v2.9.0
- Permalink: https://whatsnew.fyi/product/flux/releases/v2.9.0

- **added** — Flux CLI Plugin System with the Mirror and Schema plugins via flux plugin command
- **added** — Server-Side Apply field ignore rules for fine-grained drift control in Kustomization
- **added** — SOPS decryption with the Age post-quantum cipher in Kustomization
- **added** — Kubernetes Workload Identity authentication for OpenBao and Vault in Kustomization
- **added** — Helm post-render strategies including chart hooks support in HelmRelease
- **added** — Literal mode for Helm values references mirroring helm --set-literal in HelmRelease
- **added** — Allow empty kind in CEL health check expressions in Kustomization and HelmRelease
- **added** — Git commit signing and verification with SSH keys in GitRepository and ImageUpdateAutomation
- **added** — AWS CodeCommit authentication using Workload Identity in GitRepository
- **added** — Custom Sigstore trusted root for keyless verification in air-gapped environments in OCIRepository
- **added** — Path pattern directory discovery for monorepos in ArtifactGenerator
- **added** — Secret-less OIDC-secured webhook Receivers
- **added** — Add --resolve-symlinks flag to build and push artifact commands
- **added** — Add --show-source to flux get ks and flux get hr
- **added** — Add flux create secret receiver command
- **added** — Add --in-memory-build to flux build ks and flux diff ks
- **fixed** — Fix resume exit code
- **fixed** — Validate --source flag in create kustomization command
- **fixed** — Handle multiple symlinks to same target in build artifact
- **removed** — Remove image.toolkit.fluxcd.io/v1beta2 and notification.toolkit.fluxcd.io/v1beta2 APIs

##### Highlights

Flux v2.9.0 is a feature release. Users are encouraged to upgrade for the best experience.

For a compressive overview of new features and API changes included in this release, please refer to the [Announcing Flux 2.9 GA blog post](https://fluxcd.io/blog/2026/06/flux-v2.9.0/).

Overview of the new features:

- Flux CLI Plugin System with the Mirror and Schema plugins (`flux plugin`)
- Server-Side Apply field ignore rules for fine-grained drift control (`Kustomization`)
- SOPS decryption with the Age post-quantum cipher (`Kustomization`)
- Kubernetes Workload Identity authentication for OpenBao and Vault (`Kustomization`)
- Helm post-render strategies, including chart hooks support (`HelmRelease`)
- Literal mode for Helm values references mirroring `helm --set-literal` (`HelmRelease`)
- Allow empty kind in CEL health check expressions (`Kustomization`, `HelmRelease`)
- Git commit signing and verification with SSH keys (`GitRepository`, `ImageUpdateAutomation`)
- AWS CodeCommit authentication using Workload Identity (`GitRepository`)
- Custom Sigstore trusted root for keyless verification in air-gapped environments (`OCIRepository`)
- Path pattern directory discovery for monorepos (`ArtifactGenerator`)
- Secret-less, OIDC-secured webhook Receivers (`Receiver`)

❤️ Big thanks to all the Flux contributors that helped us with this release!

###### Kubernetes compatibility

This release is compatible with the following Kubernetes versions:

| Kubernetes version | Minimum required |
|--------------------|------------------|
| `v1.34`            | `>= 1.34.1`      |
| `v1.35`            | `>= 1.35.0`      |
| `v1.36`            | `>= 1.36.0`      |

> [!NOTE]
> Note that the Flux project offers support only for the latest three minor versions of Kubernetes.
> Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors such as
> [ControlPlane](https://control-plane.io/enterprise-for-flux-cd/) that provide enterprise support for Flux.

###### OpenShift compatibility

Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using [Flux Operator](https://operatorhub.io/operator/flux-operator). The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage.

##### Upgrade procedure

:warning: The Flux APIs `image.toolkit.fluxcd.io/v1beta2` and `notification.toolkit.fluxcd.io/v1beta2`
have reached end-of-life and have been removed from the CRDs.

Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from older versions of Flux to v2.9.

##### Components changelog

- source-controller [v1.9.1](https://github.com/fluxcd/source-controller/blob/v1.9.1/CHANGELOG.md)
- kustomize-controller [v1.9.1](https://github.com/fluxcd/kustomize-controller/blob/v1.9.1/CHANGELOG.md)
- notification-controller [v1.9.1](https://github.com/fluxcd/notification-controller/blob/v1.9.1/CHANGELOG.md)
- helm-controller [v1.6.1](https://github.com/fluxcd/helm-controller/blob/v1.6.1/CHANGELOG.md)
- image-reflector-controller [v1.2.1](https://github.com/fluxcd/image-reflector-controller/blob/v1.2.1/CHANGELOG.md)
- image-automation-controller [v1.2.1](https://github.com/fluxcd/image-automation-controller/blob/v1.2.1/CHANGELOG.md)
- source-watcher [v2.2.1](https://github.com/fluxcd/source-watcher/blob/v2.2.1/CHANGELOG.md)

##### CLI changelog

* Add backport label for Flux 2.8 by @matheuscscp in https://github.com/fluxcd/flux2/pull/5732
* Remove no longer needed workaround for Flux 2.8 by @matheuscscp in https://github.com/fluxcd/flux2/pull/5733
* Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5740
* Add missing things to release notes template by @matheuscscp i

_[Truncated at 4000 characters — full notes: https://github.com/fluxcd/flux2/releases/tag/v2.9.0]_

### v2.8.8

- Date: 2026-05-20
- Version: v2.8.8
- Original notes: https://github.com/fluxcd/flux2/releases/tag/v2.8.8
- Permalink: https://whatsnew.fyi/product/flux/releases/v2.8.8

- **security** — Update go-git to v5.19.1 to fix CVE-2026-45571 and CVE-2026-45570
- **fixed** — Add configurable HTTP timeout for artifact fetching to prevent indefinite blocks in helm-controller
- **fixed** — Fix unbounded memory growth caused by Kubernetes client transport retry wrapper accumulating on every reconcile in helm-controller
- **fixed** — Stop force-applying non-CRD objects placed under a chart's crds/ directory in helm-controller
- **fixed** — Fix Helm test action failing to find releases with names longer than 53 characters in helm-controller
- **fixed** — Improve path handling in source reconcilers in source-controller
- **fixed** — Support Helm semver build-metadata encoding in OCIRepository tags in source-controller
- **changed** — Move Helm back to upstream v4.2.0
- **added** — Add support for GCP sovereign cloud artifact registries in source-controller and image-reflector-controller
- **changed** — Upgrade Kubernetes to 1.36.1

##### Highlights

Flux v2.8.8 is a patch release that includes CVE fixes via go-git v5.19.1 (source-controller, image-automation-controller), reliability fixes in helm-controller and source-controller, the move of Helm back to upstream v4.2.0, support for GCP sovereign cloud artifact registries, and dependency updates. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:
- Add a configurable HTTP timeout for artifact fetching, preventing fetches that could block indefinitely and stall reconciliations (helm-controller)
- Fix unbounded memory growth caused by a Kubernetes client transport retry wrapper accumulating on every reconcile (helm-controller)
- Stop force-applying non-CRD objects placed under a chart's `crds/` directory (helm-controller)
- Fix the Helm test action failing to find releases with names longer than 53 characters (helm-controller)
- Improve path handling in the source reconcilers (source-controller)
- Support Helm semver build-metadata encoding in OCIRepository tags (source-controller)

Improvements:
- Update go-git to v5.19.1 which fixes [CVE-2026-45571](https://github.com/advisories/GHSA-crhj-59gh-8x96) and [CVE-2026-45570](https://github.com/advisories/GHSA-m7cr-m3pv-hgrp) (source-controller, image-automation-controller)
- Move Helm back to upstream v4.2.0 (source-controller, helm-controller)
- Add support for GCP sovereign cloud artifact registries (source-controller, image-reflector-controller)
- Upgrade Kubernetes to 1.36.1 (source-controller, helm-controller)
- Update fluxcd/pkg dependencies

##### Components changelog

- helm-controller [v1.5.5](https://github.com/fluxcd/helm-controller/blob/v1.5.5/CHANGELOG.md)
- image-automation-controller [v1.1.4](https://github.com/fluxcd/image-automation-controller/blob/v1.1.4/CHANGELOG.md)
- image-reflector-controller [v1.1.2](https://github.com/fluxcd/image-reflector-controller/blob/v1.1.2/CHANGELOG.md)
- source-controller [v1.8.5](https://github.com/fluxcd/source-controller/blob/v1.8.5/CHANGELOG.md)

##### CLI changelog
* Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5904

**Full Changelog**: https://github.com/fluxcd/flux2/compare/v2.8.7...v2.8.8

### v2.8.7

- Date: 2026-05-12
- Version: v2.8.7
- Original notes: https://github.com/fluxcd/flux2/releases/tag/v2.8.7
- Permalink: https://whatsnew.fyi/product/flux/releases/v2.8.7

- **fixed** — Fix management of objects annotated with kustomize.toolkit.fluxcd.io/ssa: IfNotPresent where non-namespaced resources were being deleted and recreated on each reconciliation
- **security** — Update go-git to v5.19.0 which fixes CVE-2026-45022
- **changed** — Update fluxcd/pkg dependencies

##### Highlights

Flux v2.8.7 is a patch release that includes a bug fix in kustomize-controller, a CVE fix in source-controller and image-automation-controller via go-git v5.19.0, and dependency updates. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:
- Fix management of objects annotated with `kustomize.toolkit.fluxcd.io/ssa: IfNotPresent` where non-namespaced resources were being deleted and recreated on each reconciliation (kustomize-controller)

Improvements:
- Update go-git to v5.19.0 which fixes [CVE-2026-45022](https://github.com/advisories/GHSA-389r-gv7p-r3rp) (source-controller, image-automation-controller)
- Update fluxcd/pkg dependencies (source-controller, kustomize-controller, image-automation-controller)

##### Components changelog

- helm-controller [v1.5.4](https://github.com/fluxcd/helm-controller/blob/v1.5.4/CHANGELOG.md)
- image-automation-controller [v1.1.3](https://github.com/fluxcd/image-automation-controller/blob/v1.1.3/CHANGELOG.md)
- kustomize-controller [v1.8.5](https://github.com/fluxcd/kustomize-controller/blob/v1.8.5/CHANGELOG.md)
- notification-controller [v1.8.4](https://github.com/fluxcd/notification-controller/blob/v1.8.4/CHANGELOG.md)
- source-controller [v1.8.4](https://github.com/fluxcd/source-controller/blob/v1.8.4/CHANGELOG.md)

##### CLI changelog
* Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5891


**Full Changelog**: https://github.com/fluxcd/flux2/compare/v2.8.6...v2.8.7

### v2.8.6

- Date: 2026-04-21
- Version: v2.8.6
- Original notes: https://github.com/fluxcd/flux2/releases/tag/v2.8.6
- Permalink: https://whatsnew.fyi/product/flux/releases/v2.8.6

- **fixed** — Fix a post-renderer conflict between overlapping hooks and templates in helm-controller
- **fixed** — Ignore force replace when server-side apply is enabled in helm-controller
- **fixed** — Fix a regression where generic providers would not forward commit status events in notification-controller
- **added** — Introduce the MigrateAPIVersion feature gate for migrating the API version of resources in managed field entries in kustomize-controller
- **changed** — Update go-git to v5.18.0 bringing performance improvements for Git operations in source-controller and image-automation-controller
- **changed** — Require the audience field on the GCR Receiver secret for tighter verification in notification-controller

##### Highlights

Flux v2.8.6 is a patch release that includes bug fixes and improvements across helm-controller, image-automation-controller, kustomize-controller, notification-controller, and source-controller. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:
- Fix a post-renderer conflict between overlapping hooks and templates (helm-controller)
- Ignore force replace when server-side apply is enabled (helm-controller)
- Fix a regression where generic providers would not forward commit status events (notification-controller)
- Require the `audience` field on the GCR Receiver secret for tighter verification — will become mandatory in Flux v2.9 (notification-controller)

Improvements:
- Introduce the `MigrateAPIVersion` feature gate for migrating the API version of resources in managed field entries (kustomize-controller)
- Update go-git to v5.18.0 bringing performance improvements for Git operations (source-controller, image-automation-controller)

##### Components changelog

- helm-controller [v1.5.4](https://github.com/fluxcd/helm-controller/blob/v1.5.4/CHANGELOG.md)
- image-automation-controller [v1.1.2](https://github.com/fluxcd/image-automation-controller/blob/v1.1.2/CHANGELOG.md)
- kustomize-controller [v1.8.4](https://github.com/fluxcd/kustomize-controller/blob/v1.8.4/CHANGELOG.md)
- notification-controller [v1.8.4](https://github.com/fluxcd/notification-controller/blob/v1.8.4/CHANGELOG.md)
- source-controller [v1.8.3](https://github.com/fluxcd/source-controller/blob/v1.8.3/CHANGELOG.md)

##### CLI changelog
* Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5857


**Full Changelog**: https://github.com/fluxcd/flux2/compare/v2.8.5...v2.8.6

### v2.8.5

- Date: 2026-04-07
- Version: v2.8.5
- Original notes: https://github.com/fluxcd/flux2/releases/tag/v2.8.5
- Permalink: https://whatsnew.fyi/product/flux/releases/v2.8.5

- **fixed** — Fix a race condition where a cancelled reconciliation could leave stale data in the cache, causing Kustomizations to get stuck
- **fixed** — Fix Azure Blob prefix option not being passed to the storage client
- **changed** — Improve error message for encrypted SSH keys without password
- **added** — Add optional email and audience fields to the GCR Receiver for tighter verification
- **added** — Add provider manifest example for Azure Event Hub managed identity authentication

##### Highlights

Flux v2.8.5 is a patch release that includes bug fixes and improvements across kustomize-controller, source-controller, and notification-controller. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

- Fix a race condition where a cancelled reconciliation could leave stale data in the cache, causing Kustomizations to get stuck (kustomize-controller)
- Fix Azure Blob prefix option not being passed to the storage client (source-controller)

Improvements:

- Improve error message for encrypted SSH keys without password (source-controller)
- Add optional `email` and `audience` fields to the GCR Receiver for tighter verification (notification-controller)
- Add provider manifest example for Azure Event Hub managed identity authentication (notification-controller)

##### Components changelog

- kustomize-controller [v1.8.3](https://github.com/fluxcd/kustomize-controller/blob/v1.8.3/CHANGELOG.md)
- source-controller [v1.8.2](https://github.com/fluxcd/source-controller/blob/v1.8.2/CHANGELOG.md)
- notification-controller [v1.8.3](https://github.com/fluxcd/notification-controller/blob/v1.8.3/CHANGELOG.md)

##### CLI changelog
* Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5822


**Full Changelog**: https://github.com/fluxcd/flux2/compare/v2.8.4...v2.8.5

### v2.8.4

- Date: 2026-04-07
- Version: v2.8.4
- Original notes: https://github.com/fluxcd/flux2/releases/tag/v2.8.4
- Permalink: https://whatsnew.fyi/product/flux/releases/v2.8.4

- **fixed** — Fix `flux build ks` and `flux diff ks` on Windows
- **fixed** — Fix `--source` flag validation in `create kustomization` command

##### Highlights

Flux v2.8.4 is a patch release that includes fixes for the Flux CLI. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

- Fix `flux build ks` and `flux diff ks` on Windows
- Fix `--source` flag validation in `create kustomization` command

##### CLI changelog
* Update fluxcd/pkg dependencies by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5796
* [release/v2.8.x] fix: validate --source flag in create kustomization command by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5799


**Full Changelog**: https://github.com/fluxcd/flux2/compare/v2.8.3...v2.8.4

### v2.8.3

- Date: 2026-03-16
- Version: v2.8.3
- Original notes: https://github.com/fluxcd/flux2/releases/tag/v2.8.3
- Permalink: https://whatsnew.fyi/product/flux/releases/v2.8.3

- **fixed** — Fix templating errors for charts that include --- in the content, e.g. YAML separators, embedded scripts, CAs inside ConfigMaps in helm-controller

##### Highlights

Flux v2.8.3 is a patch release that fixes a regression in helm-controller. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

- Fix templating errors for charts that include `---` in the content, e.g. YAML separators, embedded scripts, CAs inside ConfigMaps (helm-controller)

##### Components changelog

- helm-controller [v1.5.3](https://github.com/fluxcd/helm-controller/blob/v1.5.3/CHANGELOG.md)

##### CLI changelog
* [release/v2.8.x] Add target branch name to update branch by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5774
* Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5779


**Full Changelog**: https://github.com/fluxcd/flux2/compare/v2.8.2...v2.8.3