fix(github-release): update fluxcd/flux2 ( v2.9.3 → v2.9.4 )

[stimpy-bot]

This PR contains the following updates:

Package	Type	Update	Change
fluxcd/flux2		patch	2.9.3 → 2.9.4
fluxcd/flux2	Kustomization	patch	v2.9.3 → v2.9.4

---

Release Notes

fluxcd/flux2 (fluxcd/flux2)

v2.9.4

Compare Source

Highlights

Flux v2.9.4 is a patch release that ships various fixes to the Flux controllers, covering source-watcher tarball extraction and glob expansion limits, the refspecs accepted by ImageUpdateAutomation, the HTTP request limits of the notification-controller servers, and Helm repository index loading, OCI chart digest pinning, Bucket error handling and GCS static authentication in source-controller. On the CLI side, flux migrate -f now supports migrating repositories to Flux 2.9. Users are encouraged to upgrade for the best experience.

Note that this release contains CRD schema changes for ArtifactGenerator and ImageUpdateAutomation; both CRDs must be updated along with the controllers.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Confine tarball extraction and bound glob expansion (source-watcher)
• Disallow force-update and deletion via refspecs (image-automation-controller)
• Unify HTTP server request limits (notification-controller)
• Align Helm repository index loading with upstream Helm v4 (source-controller)
• Improve error handling in Bucket reconciliation (source-controller)
• Pin OCI chart verification by digest (source-controller)
• Limit GCS static authentication to service account keys (source-controller)
• Restrict the allow-webhooks network policy to the receiver port (flux CLI)

Improvements:

• Add support for migrating repositories to 2.9 in flux migrate -f (flux CLI)
• Update fluxcd/pkg dependencies, which align the ECR host detection with upstream (source-controller, image-reflector-controller, flux CLI)
• Update Bitbucket Cloud receiver guidance (notification-controller)

Components changelog

• source-controller v1.9.4
• source-watcher v2.2.3
• notification-controller v1.9.3
• image-reflector-controller v1.2.4
• image-automation-controller v1.2.4

CLI changelog

• [release/v2.9.x] Add support for 2.9 in migrate -f by @​fluxcdbot in #​6021
• Update fluxcd/pkg dependencies by @​fluxcdbot in #​6026
• [release/v2.9.x] fix: restrict allow-webhooks netpol to receiver port by @​fluxcdbot in #​6029
• Update toolkit components by @​fluxcdbot in #​6031

Full Changelog: fluxcd/flux2@v2.9.3...v2.9.4

---

Configuration

📅 Schedule: (in timezone America/Chicago)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Flux helmrelease diff

View diff

--- HelmRelease: flux-system/flux-instance FluxInstance: flux-system/flux

+++ HelmRelease: flux-system/flux-instance FluxInstance: flux-system/flux

@@ -7,13 +7,13 @@

   labels:
     app.kubernetes.io/name: flux-instance
     app.kubernetes.io/instance: flux-instance
     app.kubernetes.io/managed-by: Helm
 spec:
   distribution:
-    version: 2.9.3
+    version: 2.9.4
     registry: ghcr.io/fluxcd
     artifact: oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests:latest
   components:
   - source-controller
   - kustomize-controller
   - helm-controller

[github-actions]

Flux kustomization diff

View diff

--- kubernetes/apps/flux-system/flux-instance/app Kustomization: flux-system/flux-instance HelmRelease: flux-system/flux-instance

+++ kubernetes/apps/flux-system/flux-instance/app Kustomization: flux-system/flux-instance HelmRelease: flux-system/flux-instance

@@ -31,13 +31,13 @@

       components:
       - source-controller
       - kustomize-controller
       - helm-controller
       - notification-controller
       distribution:
-        version: 2.9.3
+        version: 2.9.4
       kustomize:
         patches:
         - patch: |
             - op: add
               path: /spec/decryption
               value: