chore(deps): bump the go group across 1 directory with 6 updates #161

dependabot · 2025-07-09T08:06:59Z

Bumps the go group with 5 updates in the / directory:

Package	From	To
github.com/fluxcd/flux2/v2	`2.6.3`	`2.6.4`
github.com/fluxcd/pkg/runtime	`0.62.0`	`0.63.0`
github.com/fluxcd/pkg/ssa	`0.48.0`	`0.50.1`
github.com/open-component-model/ocm-controller	`0.26.2`	`0.26.3`
ocm.software/ocm	`0.25.0`	`0.26.0`

Updates github.com/fluxcd/flux2/v2 from 2.6.3 to 2.6.4

Release notes

Sourced from github.com/fluxcd/flux2/v2's releases.

v2.6.4

Highlights

Flux v2.6.4 is a patch release that comes with various fixes. Users are encouraged to upgrade for the best experience.

Fixes:

Fix for SOPS decryption with US Government KMS keys failing with the error:
STS: AssumeRoleWithWebIdentity, https response error\n   StatusCode: 0, RequestID: ,
request send failed, Post\n \"https://sts.arn.amazonaws.com/\": dial tcp:
lookupts.arn.amazonaws.com on 10.100.0.10:53: no such host
Components changelog

kustomize-controller v1.6.1

CLI changed

[release/v2.6.x] Update toolkit components by @fluxcdbot in fluxcd/flux2#5444

Full Changelog: fluxcd/flux2@v2.6.3...v2.6.4

Commits

6bf37f6 Merge pull request #5444 from fluxcd/backport-5443-to-release/v2.6.x
8b21911 Update toolkit components
See full diff in compare view

Updates github.com/fluxcd/kustomize-controller/api from 1.6.0 to 1.6.1

Release notes

Sourced from github.com/fluxcd/kustomize-controller/api's releases.

v1.6.1

Changelog

v1.6.1 changelog

Container images

docker.io/fluxcd/kustomize-controller:v1.6.1

ghcr.io/fluxcd/kustomize-controller:v1.6.1

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/kustomize-controller/api's changelog.

1.6.1

Release date: 2025-07-08

This patch release fixes a bug introduced in v1.6.0 that causes SOPS decryption with US Government KMS keys to fail with the error:
STS: AssumeRoleWithWebIdentity, https response error\n   StatusCode: 0, RequestID: ,
request send failed, Post\n \"https://sts.arn.amazonaws.com/\": dial tcp:
lookupts.arn.amazonaws.com on 10.100.0.10:53: no such host
Fixes:

Fix regression in STS endpoint for SOPS decryption with AWS KMS in US Gov partition #1478

Commits

8ec4a6e Merge pull request #1482 from fluxcd/release-v1.6.1
84115f6 Release v1.6.1
2333a74 Add changelog entry for v1.6.1
9a203c8 Merge pull request #1480 from fluxcd/backport-1478-to-release/v1.6.x
127d696 Fix regression in STS endpoint for SOPS decryption with AWS KMS in US Gov par...
See full diff in compare view

Updates github.com/fluxcd/pkg/runtime from 0.62.0 to 0.63.0

Commits

d07717f Merge pull request #961 from cappyzawa/fix/runtime-secrets-logger-from-context
ec70e5a runtime/secrets: use context-based logger retrieval
3671c3a Merge pull request #958 from cappyzawa/update-kustomize-v5.7.0
692aef1 kustomize: Update kustomize to v5.7.0
21cbf19 Merge pull request #952 from dgunzy/fix-invalid-cabundle-crd-reconciliation
703cbca fix(ssa): remove invalid CABundle from CRD patches
See full diff in compare view

Updates github.com/fluxcd/pkg/ssa from 0.48.0 to 0.50.1

Commits

5319111 Merge pull request #964 from fluxcd/fix-ssa-wait
1a2d666 ssa: Fix waiting for classes in ApplyAllStaged
534b608 Merge pull request #963 from fluxcd/ssa-staged
69c9e52 Add test for non-cluster-admin service account deploying CR+CRB
2f61fd6 ssa: Add ClusterRole and Classes to ApplyAllStaged
14aaf93 ssa: Move ClusterRole up in kind order
24b87dc ssa: Add IsClusterRole and IsClassDefinition
c94a1a4 ssa: Remove deprecated SetNativeKindsDefaults
d07717f Merge pull request #961 from cappyzawa/fix/runtime-secrets-logger-from-context
ec70e5a runtime/secrets: use context-based logger retrieval
Additional commits viewable in compare view

Updates github.com/open-component-model/ocm-controller from 0.26.2 to 0.26.3

Release notes

Sourced from github.com/open-component-model/ocm-controller's releases.

v0.26.3

Release v0.26.3

fix: use the current component version for the default resource version (#684)

fix: default the resource version to component version (#679)

🧰 Maintenance

chore(deps): bump the go group with 6 updates (#682)

chore(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 in the go_modules group (#681)

chore(deps): bump the go group with 5 updates (#677)

chore(deps): bump the go group with 4 updates (#674)

⬆️ Dependencies

chore(deps): bump the go group with 6 updates (#682)

chore(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 in the go_modules group (#681)

chore(deps): bump the go group with 5 updates (#677)

chore(deps): bump the go group with 4 updates (#674)

Commits

a6a3e03 chore: release notes and version update for v0.26.3 (#685)
4a58167 fix: use the current component version for the default resource version (#684)
3929cc1 chore(deps): bump github/codeql-action from 3.29.1 to 3.29.2 in the ci group ...
d679059 chore(deps): bump the go group with 6 updates (#682)
ee3a135 chore(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 in ...
5109421 chore(deps): bump github/codeql-action from 3.29.0 to 3.29.1 in the ci group ...
1cae687 fix: default the resource version to component version (#679)
57f7cb4 chore(deps): bump sigstore/cosign-installer from 3.9.0 to 3.9.1 in the ci gro...
cbebc82 chore(deps): bump the go group with 5 updates (#677)
6ffdb74 chore(deps): bump sigstore/cosign-installer from 3.8.2 to 3.9.0 in the ci gro...
Additional commits viewable in compare view

Updates ocm.software/ocm from 0.25.0 to 0.26.0

Release notes

Sourced from ocm.software/ocm's releases.

v0.26.0

What's Changed

‼️ Breaking Changes

chore!: migrate to native cobra library by @Skarlso in open-component-model/ocm#1504

🐛 Bug Fixes

fix: git access tar methods by @frewilhelm in open-component-model/ocm#1454

fix(revert): make sure that ref is an option in the gitHub AccessMethod (#1406) by @jakobmoellerdev in open-component-model/ocm#1460

fix: allow spec compliant, but unusually ordered HELM Chart OCI Artifacts in HELM OCI Artifact downloader by @jakobmoellerdev in open-component-model/ocm#1470

fix: allow pre-v3.7.0 HELM Charts in HELM OCI Artifact downloader by @jakobmoellerdev in open-component-model/ocm#1476

fix: use the updated link checker fork by @Skarlso in open-component-model/ocm#1475

fix: make sure that helm downloader does not overwrite chart with provenance data by @jakobmoellerdev in open-component-model/ocm#1481

chore: fix correct filename for provenance file by @frewilhelm in open-component-model/ocm#1492

⬆️ Dependencies

chore(deps): bump the go group with 7 updates by @dependabot in open-component-model/ocm#1452

chore: pin cosign to commit to make sure we are security compliant by @frewilhelm in open-component-model/ocm#1459

chore(deps): bump the go group with 7 updates by @dependabot in open-component-model/ocm#1465

chore(deps): bump the go group with 5 updates by @dependabot in open-component-model/ocm#1487

chore(deps): bump distroless/static-debian12 from to by @dependabot in open-component-model/ocm#1486

chore(deps): bump the go group with 7 updates by @dependabot in open-component-model/ocm#1493

chore(deps): bump the go group with 10 updates by @dependabot in open-component-model/ocm#1502

chore(deps): bump the go group with 8 updates by @dependabot in open-component-model/ocm#1513

chore(deps): bump distroless/static-debian12 from to by @dependabot in open-component-model/ocm#1512

🧰 Maintenance

chore: bump VERSION to 0.26.0-dev by @ocmbot in open-component-model/ocm#1443

chore: GitHub actions add permissions by @frewilhelm in open-component-model/ocm#1449

chore: sanitize log by @frewilhelm in open-component-model/ocm#1450

chore: adjust GHA permissions by @frewilhelm in open-component-model/ocm#1451

chore: remove winget by @Skarlso in open-component-model/ocm#1463

chore: use ternary operator to avoid "skipped" integration test job by @jakobmoellerdev in open-component-model/ocm#1490

docs: ecrplugin readme by @ikhandamirov in open-component-model/ocm#1482

... (truncated)

Commits

4c74991 chore(deps): bump nosborn/github-action-markdown-cli from 3.4.0 to 3.5.0 in t...
7bc621f chore: update 'flake.nix' (#1514)
c27b5e1 chore(deps): bump distroless/static-debian12 from 188ddfb to 627d6c5 (#1512)
d74f4c6 chore(deps): bump the go group with 8 updates (#1513)
d2f8fdc chore: update 'flake.nix' (#1510)
ceea433 chore!: migrate to native cobra library (#1504)
073a4ed chore(deps): bump github/codeql-action from 3.28.19 to 3.29.0 in the ci group...
3360f79 chore: update 'flake.nix' (#1503)
ca24589 chore(deps): bump the go group with 10 updates (#1502)
c200647 chore: update 'flake.nix' (#1499)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/fluxcd/flux2/v2](https://github.com/fluxcd/flux2) | `2.6.3` | `2.6.4` | | [github.com/fluxcd/pkg/runtime](https://github.com/fluxcd/pkg) | `0.62.0` | `0.63.0` | | [github.com/fluxcd/pkg/ssa](https://github.com/fluxcd/pkg) | `0.48.0` | `0.50.1` | | [github.com/open-component-model/ocm-controller](https://github.com/open-component-model/ocm-controller) | `0.26.2` | `0.26.3` | | [ocm.software/ocm](https://github.com/open-component-model/ocm) | `0.25.0` | `0.26.0` | Updates `github.com/fluxcd/flux2/v2` from 2.6.3 to 2.6.4 - [Release notes](https://github.com/fluxcd/flux2/releases) - [Changelog](https://github.com/fluxcd/flux2/blob/main/.goreleaser.yml) - [Commits](fluxcd/flux2@v2.6.3...v2.6.4) Updates `github.com/fluxcd/kustomize-controller/api` from 1.6.0 to 1.6.1 - [Release notes](https://github.com/fluxcd/kustomize-controller/releases) - [Changelog](https://github.com/fluxcd/kustomize-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/kustomize-controller@v1.6.0...v1.6.1) Updates `github.com/fluxcd/pkg/runtime` from 0.62.0 to 0.63.0 - [Commits](fluxcd/pkg@runtime/v0.62.0...runtime/v0.63.0) Updates `github.com/fluxcd/pkg/ssa` from 0.48.0 to 0.50.1 - [Commits](fluxcd/pkg@oci/v0.48.0...ssa/v0.50.1) Updates `github.com/open-component-model/ocm-controller` from 0.26.2 to 0.26.3 - [Release notes](https://github.com/open-component-model/ocm-controller/releases) - [Changelog](https://github.com/open-component-model/ocm-controller/blob/main/.goreleaser.yaml) - [Commits](open-component-model/ocm-controller@v0.26.2...v0.26.3) Updates `ocm.software/ocm` from 0.25.0 to 0.26.0 - [Release notes](https://github.com/open-component-model/ocm/releases) - [Changelog](https://github.com/open-component-model/ocm/blob/main/RELEASE_PROCESS.md) - [Commits](open-component-model/ocm@v0.25...v0.26) --- updated-dependencies: - dependency-name: github.com/fluxcd/flux2/v2 dependency-version: 2.6.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/kustomize-controller/api dependency-version: 1.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/pkg/runtime dependency-version: 0.63.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/fluxcd/pkg/ssa dependency-version: 0.50.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/open-component-model/ocm-controller dependency-version: 0.26.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: ocm.software/ocm dependency-version: 0.26.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot · 2025-07-13T06:56:16Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels Jul 9, 2025

dependabot bot requested a review from a team as a code owner July 9, 2025 08:07

dependabot bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels Jul 9, 2025

dependabot bot closed this Jul 13, 2025

dependabot bot deleted the dependabot/go_modules/go-bbbf66cfc3 branch July 13, 2025 06:56

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the go group across 1 directory with 6 updates #161

chore(deps): bump the go group across 1 directory with 6 updates #161

Uh oh!

dependabot bot commented on behalf of github Jul 9, 2025 •

edited

Loading

Uh oh!

dependabot bot commented on behalf of github Jul 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chore(deps): bump the go group across 1 directory with 6 updates #161

chore(deps): bump the go group across 1 directory with 6 updates #161

Uh oh!

Conversation

dependabot bot commented on behalf of github Jul 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.6.4

Highlights

Components changelog

CLI changed

v1.6.1

Changelog

Container images

1.6.1

v0.26.3

Release v0.26.3

🧰 Maintenance

⬆️ Dependencies

v0.26.0

What's Changed

‼️ Breaking Changes

🐛 Bug Fixes

⬆️ Dependencies

🧰 Maintenance

Uh oh!

dependabot bot commented on behalf of github Jul 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot bot commented on behalf of github Jul 9, 2025 •

edited

Loading