flux2

v2.8.8 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 14d GitOps

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

ci-cd gitops gitops-toolkit helm kubernetes kustomize

Affected surfaces

deps

Summary

AI summary

Updates Components changelog, helm-controller, and source-controller across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Medium	Fix CVE-2026-45571 and CVE-2026-45570 via go-git v5.19.1 update (source-controller, image-automation-controller) Fix CVE-2026-45571 and CVE-2026-45570 via go-git v5.19.1 update (source-controller, image-automation-controller) Source: granite4.1:8b-q6_K@2026-05-20 Confidence: low	—
Feature	Medium	Support Helm semver build-metadata encoding in OCIRepository tags (source-controller) Support Helm semver build-metadata encoding in OCIRepository tags (source-controller) Source: granite4.1:8b-q6_K@2026-05-20 Confidence: high	—
Feature	Medium	Add support for GCP sovereign cloud artifact registries (source-controller, image-reflector-controller) Add support for GCP sovereign cloud artifact registries (source-controller, image-reflector-controller) Source: granite4.1:8b-q6_K@2026-05-20 Confidence: high	—
Dependency	Medium	Upgrade Kubernetes to 1.36.1 (source-controller, helm-controller) Upgrade Kubernetes to 1.36.1 (source-controller, helm-controller) Source: granite4.1:8b-q6_K@2026-05-20 Confidence: low	—
Dependency	Medium	Update fluxcd/pkg dependencies Update fluxcd/pkg dependencies Source: granite4.1:8b-q6_K@2026-05-20 Confidence: low	—
Bugfix
Bugfix	Medium	Fix unbounded memory growth caused by Kubernetes client transport retry wrapper (helm-controller) Fix unbounded memory growth caused by Kubernetes client transport retry wrapper (helm-controller) Source: granite4.1:8b-q6_K@2026-05-20 Confidence: high	—
Bugfix	Medium	Stop force-applying non-CRD objects placed under chart's `crds/` directory (helm-controller) Stop force-applying non-CRD objects placed under chart's `crds/` directory (helm-controller) Source: granite4.1:8b-q6_K@2026-05-20 Confidence: high	—
Bugfix	Medium	Fix Helm test action failing to find releases with names longer than 53 characters (helm-controller) Fix Helm test action failing to find releases with names longer than 53 characters (helm-controller) Source: granite4.1:8b-q6_K@2026-05-20 Confidence: high	—
Bugfix	Medium	Add configurable HTTP timeout for artifact fetching to prevent indefinite stalls (helm-controller) Add configurable HTTP timeout for artifact fetching to prevent indefinite stalls (helm-controller) Source: granite4.1:8b-q6_K@2026-05-20 Confidence: low	—
Refactor	Medium	Move Helm back to upstream v4.2.0 (source-controller, helm-controller) Move Helm back to upstream v4.2.0 (source-controller, helm-controller) Source: granite4.1:8b-q6_K@2026-05-20 Confidence: high	—
Refactor	Medium	Improve path handling in the source reconcilers (source-controller) Improve path handling in the source reconcilers (source-controller) Source: granite4.1:8b-q6_K@2026-05-20 Confidence: low	—

Full changelog

Highlights

Flux v2.8.8 is a patch release that includes CVE fixes via go-git v5.19.1 (source-controller, image-automation-controller), reliability fixes in helm-controller and source-controller, the move of Helm back to upstream v4.2.0, support for GCP sovereign cloud artifact registries, and dependency updates. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

Add a configurable HTTP timeout for artifact fetching, preventing fetches that could block indefinitely and stall reconciliations (helm-controller)
Fix unbounded memory growth caused by a Kubernetes client transport retry wrapper accumulating on every reconcile (helm-controller)
Stop force-applying non-CRD objects placed under a chart's crds/ directory (helm-controller)
Fix the Helm test action failing to find releases with names longer than 53 characters (helm-controller)
Improve path handling in the source reconcilers (source-controller)
Support Helm semver build-metadata encoding in OCIRepository tags (source-controller)

Improvements:

Update go-git to v5.19.1 which fixes CVE-2026-45571 and CVE-2026-45570 (source-controller, image-automation-controller)
Move Helm back to upstream v4.2.0 (source-controller, helm-controller)
Add support for GCP sovereign cloud artifact registries (source-controller, image-reflector-controller)
Upgrade Kubernetes to 1.36.1 (source-controller, helm-controller)
Update fluxcd/pkg dependencies

Components changelog

helm-controller v1.5.5
image-automation-controller v1.1.4
image-reflector-controller v1.1.2
source-controller v1.8.5

CLI changelog

Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5904

Full Changelog: https://github.com/fluxcd/flux2/compare/v2.8.7...v2.8.8

Security Fixes

go-git updated to v5.19.1 fixing CVE-2026-45571 and CVE-2026-45570 (source-controller, image-automation-controller)
CVE-2026-45570

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track flux2

Get notified when new releases ship.

About flux2

Open and extensible continuous delivery solution for Kubernetes. Powered by GitOps Toolkit.