chore(deps): bump the go group across 1 directory with 19 updates

Bumps the go group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| cuelang.org/go | `0.14.1` | `0.15.0` |
| [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin) | `0.4.1` | `0.6.0` |
| [github.com/fluxcd/helm-controller/api](https://github.com/fluxcd/helm-controller) | `1.3.0` | `1.4.3` |
| [github.com/fluxcd/kustomize-controller/api](https://github.com/fluxcd/kustomize-controller) | `1.6.1` | `1.7.2` |
| [github.com/fluxcd/pkg/apis/event](https://github.com/fluxcd/pkg) | `0.18.0` | `0.20.0` |
| [github.com/fluxcd/pkg/http/fetch](https://github.com/fluxcd/pkg) | `0.17.0` | `0.20.0` |
| [github.com/fluxcd/pkg/kustomize](https://github.com/fluxcd/pkg) | `1.19.0` | `1.23.0` |
| [github.com/fluxcd/pkg/runtime](https://github.com/fluxcd/pkg) | `0.79.0` | `0.89.0` |
| [github.com/fluxcd/source-controller/api](https://github.com/fluxcd/source-controller) | `1.6.2` | `1.7.3` |
| [github.com/mikefarah/yq/v4](https://github.com/mikefarah/yq) | `4.47.2` | `4.48.2` |
| [helm.sh/helm/v3](https://github.com/helm/helm) | `3.19.0` | `3.19.2` |
| [k8s.io/api](https://github.com/kubernetes/api) | `0.34.1` | `0.34.2` |
| [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) | `0.34.1` | `0.34.2` |
| [sigs.k8s.io/kustomize/api](https://github.com/kubernetes-sigs/kustomize) | `0.20.1` | `0.21.0` |



Updates `cuelang.org/go` from 0.14.1 to 0.15.0

Updates `github.com/cyphar/filepath-securejoin` from 0.4.1 to 0.6.0
- [Release notes](https://github.com/cyphar/filepath-securejoin/releases)
- [Changelog](https://github.com/cyphar/filepath-securejoin/blob/main/CHANGELOG.md)
- [Commits](cyphar/filepath-securejoin@v0.4.1...v0.6.0)

Updates `github.com/fluxcd/helm-controller/api` from 1.3.0 to 1.4.3
- [Release notes](https://github.com/fluxcd/helm-controller/releases)
- [Changelog](https://github.com/fluxcd/helm-controller/blob/main/CHANGELOG.md)
- [Commits](fluxcd/helm-controller@v1.3.0...v1.4.3)

Updates `github.com/fluxcd/kustomize-controller/api` from 1.6.1 to 1.7.2
- [Release notes](https://github.com/fluxcd/kustomize-controller/releases)
- [Changelog](https://github.com/fluxcd/kustomize-controller/blob/main/CHANGELOG.md)
- [Commits](fluxcd/kustomize-controller@v1.6.1...v1.7.2)

Updates `github.com/fluxcd/pkg/apis/event` from 0.18.0 to 0.20.0
- [Commits](fluxcd/pkg@git/v0.18.0...git/v0.20.0)

Updates `github.com/fluxcd/pkg/apis/meta` from 1.18.0 to 1.22.0
- [Commits](fluxcd/pkg@apis/meta/v1.18.0...apis/meta/v1.22.0)

Updates `github.com/fluxcd/pkg/http/fetch` from 0.17.0 to 0.20.0
- [Commits](fluxcd/pkg@git/v0.17.0...git/v0.20.0)

Updates `github.com/fluxcd/pkg/kustomize` from 1.19.0 to 1.23.0
- [Commits](fluxcd/pkg@apis/meta/v1.19.0...kustomize/v1.23.0)

Updates `github.com/fluxcd/pkg/runtime` from 0.79.0 to 0.89.0
- [Commits](fluxcd/pkg@runtime/v0.79.0...runtime/v0.89.0)

Updates `github.com/fluxcd/pkg/tar` from 0.13.0 to 0.15.0
- [Commits](fluxcd/pkg@git/v0.13.0...git/v0.15.0)

Updates `github.com/fluxcd/source-controller/api` from 1.6.2 to 1.7.3
- [Release notes](https://github.com/fluxcd/source-controller/releases)
- [Changelog](https://github.com/fluxcd/source-controller/blob/main/CHANGELOG.md)
- [Commits](fluxcd/source-controller@v1.6.2...v1.7.3)

Updates `github.com/mikefarah/yq/v4` from 4.47.2 to 4.48.2
- [Release notes](https://github.com/mikefarah/yq/releases)
- [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt)
- [Commits](mikefarah/yq@v4.47.2...v4.48.2)

Updates `helm.sh/helm/v3` from 3.19.0 to 3.19.2
- [Release notes](https://github.com/helm/helm/releases)
- [Commits](helm/helm@v3.19.0...v3.19.2)

Updates `k8s.io/api` from 0.34.1 to 0.34.2
- [Commits](kubernetes/api@v0.34.1...v0.34.2)

Updates `k8s.io/apiextensions-apiserver` from 0.34.1 to 0.34.2
- [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases)
- [Commits](kubernetes/apiextensions-apiserver@v0.34.1...v0.34.2)

Updates `k8s.io/apimachinery` from 0.34.1 to 0.34.2
- [Commits](kubernetes/apimachinery@v0.34.1...v0.34.2)

Updates `k8s.io/client-go` from 0.34.1 to 0.34.2
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.34.1...v0.34.2)

Updates `sigs.k8s.io/controller-runtime` from 0.22.1 to 0.22.2
- [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases)
- [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md)
- [Commits](kubernetes-sigs/controller-runtime@v0.22.1...v0.22.2)

Updates `sigs.k8s.io/kustomize/api` from 0.20.1 to 0.21.0
- [Release notes](https://github.com/kubernetes-sigs/kustomize/releases)
- [Commits](kubernetes-sigs/kustomize@api/v0.20.1...api/v0.21.0)

---
updated-dependencies:
- dependency-name: cuelang.org/go
  dependency-version: 0.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/cyphar/filepath-securejoin
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/fluxcd/helm-controller/api
  dependency-version: 1.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/fluxcd/kustomize-controller/api
  dependency-version: 1.7.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/fluxcd/pkg/apis/event
  dependency-version: 0.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/fluxcd/pkg/apis/meta
  dependency-version: 1.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/fluxcd/pkg/http/fetch
  dependency-version: 0.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/fluxcd/pkg/kustomize
  dependency-version: 1.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/fluxcd/pkg/runtime
  dependency-version: 0.89.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/fluxcd/pkg/tar
  dependency-version: 0.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/fluxcd/source-controller/api
  dependency-version: 1.7.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/mikefarah/yq/v4
  dependency-version: 4.48.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: helm.sh/helm/v3
  dependency-version: 3.19.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: k8s.io/api
  dependency-version: 0.34.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: k8s.io/apiextensions-apiserver
  dependency-version: 0.34.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.34.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: k8s.io/client-go
  dependency-version: 0.34.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: sigs.k8s.io/controller-runtime
  dependency-version: 0.22.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: sigs.k8s.io/kustomize/api
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
...

Signed-off-by: dependabot[bot] <[email protected]>

Author: dependabot[bot]

go.mod

@@ -6,26 +6,26 @@ go 1.25.4
 replace github.com/opencontainers/go-digest => github.com/opencontainers/go-digest v1.0.1-0.20220411205349-bde1400a84be
 
 require (
-	cuelang.org/go v0.14.1
+	cuelang.org/go v0.15.0
 	github.com/Masterminds/semver/v3 v3.4.0
 	github.com/containers/image/v5 v5.36.2
-	github.com/cyphar/filepath-securejoin v0.4.1
+	github.com/cyphar/filepath-securejoin v0.6.0
 	github.com/distribution/distribution/v3 v3.0.0
-	github.com/fluxcd/helm-controller/api v1.3.0
-	github.com/fluxcd/kustomize-controller/api v1.6.1
-	github.com/fluxcd/pkg/apis/event v0.18.0
-	github.com/fluxcd/pkg/apis/meta v1.18.0
-	github.com/fluxcd/pkg/http/fetch v0.17.0
-	github.com/fluxcd/pkg/kustomize v1.19.0
-	github.com/fluxcd/pkg/runtime v0.79.0
-	github.com/fluxcd/pkg/tar v0.13.0
-	github.com/fluxcd/source-controller/api v1.6.2
+	github.com/fluxcd/helm-controller/api v1.4.3
+	github.com/fluxcd/kustomize-controller/api v1.7.2
+	github.com/fluxcd/pkg/apis/event v0.20.0
+	github.com/fluxcd/pkg/apis/meta v1.22.0
+	github.com/fluxcd/pkg/http/fetch v0.20.0
+	github.com/fluxcd/pkg/kustomize v1.23.0
+	github.com/fluxcd/pkg/runtime v0.89.0
+	github.com/fluxcd/pkg/tar v0.15.0
+	github.com/fluxcd/source-controller/api v1.7.3
 	github.com/go-logr/logr v1.4.3
 	github.com/google/go-containerregistry v0.20.6
 	github.com/mandelsoft/logging v0.0.0-20240618075559-fdca28a87b0a
 	github.com/mandelsoft/spiff v1.7.0-beta-7
 	github.com/mandelsoft/vfs v0.4.4
-	github.com/mikefarah/yq/v4 v4.47.2
+	github.com/mikefarah/yq/v4 v4.48.2
 	github.com/mitchellh/hashstructure v1.1.0
 	github.com/mitchellh/hashstructure/v2 v2.0.2
 	github.com/onsi/gomega v1.38.2
@@ -39,15 +39,15 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0
 	gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473
 	gopkg.in/yaml.v3 v3.0.1
-	helm.sh/helm/v3 v3.19.0
-	k8s.io/api v0.34.1
-	k8s.io/apiextensions-apiserver v0.34.1
-	k8s.io/apimachinery v0.34.1
-	k8s.io/client-go v0.34.1
+	helm.sh/helm/v3 v3.19.2
+	k8s.io/api v0.34.2
+	k8s.io/apiextensions-apiserver v0.34.2
+	k8s.io/apimachinery v0.34.2
+	k8s.io/client-go v0.34.2
 	ocm.software/ocm v0.32.0
-	sigs.k8s.io/controller-runtime v0.22.1
+	sigs.k8s.io/controller-runtime v0.22.2
 	sigs.k8s.io/e2e-framework v0.6.0
-	sigs.k8s.io/kustomize/api v0.20.1
+	sigs.k8s.io/kustomize/api v0.21.0
 	sigs.k8s.io/yaml v1.6.0
 )
 
@@ -185,10 +185,10 @@ require (
 	github.com/fluxcd/image-automation-controller/api v0.41.2 // indirect
 	github.com/fluxcd/image-reflector-controller/api v0.35.2 // indirect
 	github.com/fluxcd/notification-controller/api v1.6.0 // indirect
-	github.com/fluxcd/pkg/apis/acl v0.7.0 // indirect
-	github.com/fluxcd/pkg/apis/kustomize v1.11.0 // indirect
-	github.com/fluxcd/pkg/envsubst v1.4.0 // indirect
-	github.com/fluxcd/pkg/sourceignore v0.13.0 // indirect
+	github.com/fluxcd/pkg/apis/acl v0.9.0 // indirect
+	github.com/fluxcd/pkg/apis/kustomize v1.13.0 // indirect
+	github.com/fluxcd/pkg/envsubst v1.5.0 // indirect
+	github.com/fluxcd/pkg/sourceignore v0.15.0 // indirect
 	github.com/fluxcd/pkg/ssa v0.58.0 // indirect
 	github.com/fluxcd/pkg/version v0.9.0 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
@@ -200,7 +200,7 @@ require (
 	github.com/go-fed/httpsig v1.1.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.6.2 // indirect
-	github.com/go-git/go-git/v5 v5.16.2 // indirect
+	github.com/go-git/go-git/v5 v5.16.3 // indirect
 	github.com/go-ini/ini v1.67.0 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
@@ -324,7 +324,7 @@ require (
 	github.com/prometheus/common v0.67.1 // indirect
 	github.com/prometheus/otlptranslator v1.0.0 // indirect
 	github.com/prometheus/procfs v0.17.0 // indirect
-	github.com/protocolbuffers/txtpbfmt v0.0.0-20250627152318-f293424e46b5 // indirect
+	github.com/protocolbuffers/txtpbfmt v0.0.0-20251016062345-16587c79cd91 // indirect
 	github.com/redis/go-redis/extra/rediscmd/v9 v9.5.3 // indirect
 	github.com/redis/go-redis/extra/redisotel/v9 v9.5.3 // indirect
 	github.com/redis/go-redis/v9 v9.14.0 // indirect
@@ -336,7 +336,7 @@ require (
 	github.com/sassoftware/relic v7.2.1+incompatible // indirect
 	github.com/secure-systems-lab/go-securesystemslib v0.9.1 // indirect
 	github.com/segmentio/ksuid v1.0.4 // indirect
-	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
+	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
 	github.com/sigstore/cosign/v2 v2.6.0 // indirect
 	github.com/sigstore/fulcio v1.7.1 // indirect
@@ -412,16 +412,17 @@ require (
 	go.uber.org/zap v1.27.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.43.0 // indirect
+	go.yaml.in/yaml/v4 v4.0.0-rc.3 // indirect
+	golang.org/x/crypto v0.44.0 // indirect
 	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
-	golang.org/x/mod v0.28.0 // indirect
-	golang.org/x/net v0.46.0 // indirect
-	golang.org/x/oauth2 v0.31.0 // indirect
-	golang.org/x/sync v0.17.0 // indirect
-	golang.org/x/sys v0.37.0 // indirect
-	golang.org/x/term v0.36.0 // indirect
-	golang.org/x/text v0.30.0 // indirect
-	golang.org/x/time v0.12.0 // indirect
+	golang.org/x/mod v0.29.0 // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/oauth2 v0.32.0 // indirect
+	golang.org/x/sync v0.18.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/term v0.37.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
+	golang.org/x/time v0.13.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
 	google.golang.org/api v0.248.0 // indirect
 	google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect
@@ -435,14 +436,14 @@ require (
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	k8s.io/cli-runtime v0.34.1 // indirect
-	k8s.io/component-base v0.34.1 // indirect
+	k8s.io/component-base v0.34.2 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
 	k8s.io/kubectl v0.34.0 // indirect
-	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
+	k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d // indirect
 	oras.land/oras-go/v2 v2.6.0 // indirect
-	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
-	sigs.k8s.io/kustomize/kyaml v0.20.1 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/kustomize/kyaml v0.21.0 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/release-utils v0.12.1 // indirect
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect