v2.8.7
Changed 1
- Update fluxcd/pkg dependencies
Fixed 1
- Fix management of objects annotated with kustomize.toolkit.fluxcd.io/ssa: IfNotPresent where non-namespaced resources were being deleted and recreated on each reconciliation
Security 1
- Update go-git to v5.19.0 which fixes CVE-2026-45022
Highlights
Flux v2.8.7 is a patch release that includes a bug fix in kustomize-controller, a CVE fix in source-controller and image-automation-controller via go-git v5.19.0, and dependency updates. Users are encouraged to upgrade for the best experience.
ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.
Fixes:
- Fix management of objects annotated with
kustomize.toolkit.fluxcd.io/ssa: IfNotPresentwhere non-namespaced resources were being deleted and recreated on each reconciliation (kustomize-controller)
Improvements:
- Update go-git to v5.19.0 which fixes CVE-2026-45022 (source-controller, image-automation-controller)
- Update fluxcd/pkg dependencies (source-controller, kustomize-controller, image-automation-controller)
Components changelog
- helm-controller v1.5.4
- image-automation-controller v1.1.3
- kustomize-controller v1.8.5
- notification-controller v1.8.4
- source-controller v1.8.4
CLI changelog
- Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5891
Full Changelog: https://github.com/fluxcd/flux2/compare/v2.8.6...v2.8.7