chore(deps): bump the go group across 1 directory with 8 updates #162

dependabot · 2025-07-13T06:56:41Z

Bumps the go group with 6 updates in the / directory:

Package	From	To
github.com/fluxcd/flux2/v2	`2.6.3`	`2.6.4`
github.com/fluxcd/pkg/apis/meta	`1.13.0`	`1.15.0`
github.com/fluxcd/pkg/runtime	`0.62.0`	`0.66.0`
github.com/fluxcd/pkg/ssa	`0.48.0`	`0.51.0`
github.com/fluxcd/pkg/version	`0.8.0`	`0.9.0`
github.com/open-component-model/ocm-controller	`0.26.2`	`0.26.4`

Updates github.com/fluxcd/flux2/v2 from 2.6.3 to 2.6.4

Release notes

Sourced from github.com/fluxcd/flux2/v2's releases.

v2.6.4

Highlights

Flux v2.6.4 is a patch release that comes with various fixes. Users are encouraged to upgrade for the best experience.

Fixes:

Fix for SOPS decryption with US Government KMS keys failing with the error:
STS: AssumeRoleWithWebIdentity, https response error\n   StatusCode: 0, RequestID: ,
request send failed, Post\n \"https://sts.arn.amazonaws.com/\": dial tcp:
lookupts.arn.amazonaws.com on 10.100.0.10:53: no such host
Components changelog

kustomize-controller v1.6.1

CLI changed

[release/v2.6.x] Update toolkit components by @fluxcdbot in fluxcd/flux2#5444

Full Changelog: fluxcd/flux2@v2.6.3...v2.6.4

Commits

6bf37f6 Merge pull request #5444 from fluxcd/backport-5443-to-release/v2.6.x
8b21911 Update toolkit components
See full diff in compare view

Updates github.com/fluxcd/kustomize-controller/api from 1.6.0 to 1.6.1

Release notes

Sourced from github.com/fluxcd/kustomize-controller/api's releases.

v1.6.1

Changelog

v1.6.1 changelog

Container images

docker.io/fluxcd/kustomize-controller:v1.6.1

ghcr.io/fluxcd/kustomize-controller:v1.6.1

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/kustomize-controller/api's changelog.

1.6.1

Release date: 2025-07-08

This patch release fixes a bug introduced in v1.6.0 that causes SOPS decryption with US Government KMS keys to fail with the error:
STS: AssumeRoleWithWebIdentity, https response error\n   StatusCode: 0, RequestID: ,
request send failed, Post\n \"https://sts.arn.amazonaws.com/\": dial tcp:
lookupts.arn.amazonaws.com on 10.100.0.10:53: no such host
Fixes:

Fix regression in STS endpoint for SOPS decryption with AWS KMS in US Gov partition #1478

Commits

8ec4a6e Merge pull request #1482 from fluxcd/release-v1.6.1
84115f6 Release v1.6.1
2333a74 Add changelog entry for v1.6.1
9a203c8 Merge pull request #1480 from fluxcd/backport-1478-to-release/v1.6.x
127d696 Fix regression in STS endpoint for SOPS decryption with AWS KMS in US Gov par...
See full diff in compare view

Updates github.com/fluxcd/pkg/apis/meta from 1.13.0 to 1.15.0

Commits

9e79277 Merge pull request #968 from cappyzawa/feat/runtime-secrets-pointer-based-api
9ee2d52 runtime/secrets: migrate to Secret pointer-based APIs
e04986e Merge pull request #967 from fluxcd/bump-pkg
59d65f6 Prepare for release
607f4b2 Merge pull request #966 from fluxcd/update-deps-1.33.2
c895e9f Update dependencies to Kubernetes v1.33.2
6c8e4c1 Merge pull request #962 from dgunzy/fix/ignore-paths-diff
1649a3c Add ignorepaths to scan manifests to fix --ignore-paths flag
0749484 Merge pull request #965 from fluxcd/oci-insecure-transport
647e479 oci: Add insecure option to retry transport
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/runtime from 0.62.0 to 0.66.0

Commits

856b04d Merge pull request #970 from cappyzawa/add-client-based-secret-variants
14d994d runtime/secrets: separate API reading from Secret conversion
c929dfc runtime/secrets: add client-based API variants
9e79277 Merge pull request #968 from cappyzawa/feat/runtime-secrets-pointer-based-api
9ee2d52 runtime/secrets: migrate to Secret pointer-based APIs
e04986e Merge pull request #967 from fluxcd/bump-pkg
59d65f6 Prepare for release
607f4b2 Merge pull request #966 from fluxcd/update-deps-1.33.2
c895e9f Update dependencies to Kubernetes v1.33.2
6c8e4c1 Merge pull request #962 from dgunzy/fix/ignore-paths-diff
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/ssa from 0.48.0 to 0.51.0

Commits

9e79277 Merge pull request #968 from cappyzawa/feat/runtime-secrets-pointer-based-api
9ee2d52 runtime/secrets: migrate to Secret pointer-based APIs
e04986e Merge pull request #967 from fluxcd/bump-pkg
59d65f6 Prepare for release
607f4b2 Merge pull request #966 from fluxcd/update-deps-1.33.2
c895e9f Update dependencies to Kubernetes v1.33.2
6c8e4c1 Merge pull request #962 from dgunzy/fix/ignore-paths-diff
1649a3c Add ignorepaths to scan manifests to fix --ignore-paths flag
0749484 Merge pull request #965 from fluxcd/oci-insecure-transport
647e479 oci: Add insecure option to retry transport
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/version from 0.8.0 to 0.9.0

Commits

b83bd25 Merge pull request #817 from fluxcd/refactor-cache
a29e42f cache: Return ErrNotFound error from Get()
72d6f8c oci: Remove cache from auth and int tests code
061b9ac cache: Allow setting cache metrics prefix
a961051 Simplify the cache
9e2947d Merge pull request #829 from fluxcd/helm-v3.16.3
802b6e3 Update dependencies
19c00ad Merge pull request #828 from fluxcd/kustomize-v5.5
f9cbcaf Add doc to auth pkg
33f3829 Update dependencies
Additional commits viewable in compare view

Updates github.com/open-component-model/ocm-controller from 0.26.2 to 0.26.4

Release notes

Sourced from github.com/open-component-model/ocm-controller's releases.

v0.26.4

Release v0.26.4

fix: adjust the resource controller to use the descriptor version for defaulting instead of the component version (#690)

🧰 Maintenance

chore(deps): bump the go group across 1 directory with 3 updates (#689)

chore(deps): bump helm.sh/helm/v3 from 3.18.3 to 3.18.4 in the go_modules group (#688)

⬆️ Dependencies

chore(deps): bump the go group across 1 directory with 3 updates (#689)

chore(deps): bump helm.sh/helm/v3 from 3.18.3 to 3.18.4 in the go_modules group (#688)

v0.26.3

Release v0.26.3

fix: use the current component version for the default resource version (#684)

fix: default the resource version to component version (#679)

🧰 Maintenance

chore(deps): bump the go group with 6 updates (#682)

chore(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 in the go_modules group (#681)

chore(deps): bump the go group with 5 updates (#677)

chore(deps): bump the go group with 4 updates (#674)

⬆️ Dependencies

chore(deps): bump the go group with 6 updates (#682)

chore(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 in the go_modules group (#681)

chore(deps): bump the go group with 5 updates (#677)

chore(deps): bump the go group with 4 updates (#674)

Commits

5b122fa chore: release docs for v0.26.4 (#691)
b5bbb6d chore(deps): bump the go group across 1 directory with 3 updates (#689)
415ee58 fix: adjust the resource controller to use the descriptor version for default...
d5f2657 chore(deps): bump helm.sh/helm/v3 from 3.18.3 to 3.18.4 in the go_modules gro...
db4777f chore(deps): bump anchore/sbom-action from 0.20.1 to 0.20.2 in the ci group (...
a6a3e03 chore: release notes and version update for v0.26.3 (#685)
4a58167 fix: use the current component version for the default resource version (#684)
3929cc1 chore(deps): bump github/codeql-action from 3.29.1 to 3.29.2 in the ci group ...
d679059 chore(deps): bump the go group with 6 updates (#682)
ee3a135 chore(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 in ...
Additional commits viewable in compare view

Updates ocm.software/ocm from 0.25.0 to 0.26.0

Release notes

Sourced from ocm.software/ocm's releases.

v0.26.0

What's Changed

‼️ Breaking Changes

chore!: migrate to native cobra library by @Skarlso in open-component-model/ocm#1504

🐛 Bug Fixes

fix: git access tar methods by @frewilhelm in open-component-model/ocm#1454

fix(revert): make sure that ref is an option in the gitHub AccessMethod (#1406) by @jakobmoellerdev in open-component-model/ocm#1460

fix: allow spec compliant, but unusually ordered HELM Chart OCI Artifacts in HELM OCI Artifact downloader by @jakobmoellerdev in open-component-model/ocm#1470

fix: allow pre-v3.7.0 HELM Charts in HELM OCI Artifact downloader by @jakobmoellerdev in open-component-model/ocm#1476

fix: use the updated link checker fork by @Skarlso in open-component-model/ocm#1475

fix: make sure that helm downloader does not overwrite chart with provenance data by @jakobmoellerdev in open-component-model/ocm#1481

chore: fix correct filename for provenance file by @frewilhelm in open-component-model/ocm#1492

⬆️ Dependencies

chore(deps): bump the go group with 7 updates by @dependabot in open-component-model/ocm#1452

chore: pin cosign to commit to make sure we are security compliant by @frewilhelm in open-component-model/ocm#1459

chore(deps): bump the go group with 7 updates by @dependabot in open-component-model/ocm#1465

chore(deps): bump the go group with 5 updates by @dependabot in open-component-model/ocm#1487

chore(deps): bump distroless/static-debian12 from to by @dependabot in open-component-model/ocm#1486

chore(deps): bump the go group with 7 updates by @dependabot in open-component-model/ocm#1493

chore(deps): bump the go group with 10 updates by @dependabot in open-component-model/ocm#1502

chore(deps): bump the go group with 8 updates by @dependabot in open-component-model/ocm#1513

chore(deps): bump distroless/static-debian12 from to by @dependabot in open-component-model/ocm#1512

🧰 Maintenance

chore: bump VERSION to 0.26.0-dev by @ocmbot in open-component-model/ocm#1443

chore: GitHub actions add permissions by @frewilhelm in open-component-model/ocm#1449

chore: sanitize log by @frewilhelm in open-component-model/ocm#1450

chore: adjust GHA permissions by @frewilhelm in open-component-model/ocm#1451

chore: remove winget by @Skarlso in open-component-model/ocm#1463

chore: use ternary operator to avoid "skipped" integration test job by @jakobmoellerdev in open-component-model/ocm#1490

docs: ecrplugin readme by @ikhandamirov in open-component-model/ocm#1482

... (truncated)

Commits

4c74991 chore(deps): bump nosborn/github-action-markdown-cli from 3.4.0 to 3.5.0 in t...
7bc621f chore: update 'flake.nix' (#1514)
c27b5e1 chore(deps): bump distroless/static-debian12 from 188ddfb to 627d6c5 (#1512)
d74f4c6 chore(deps): bump the go group with 8 updates (#1513)
d2f8fdc chore: update 'flake.nix' (#1510)
ceea433 chore!: migrate to native cobra library (#1504)
073a4ed chore(deps): bump github/codeql-action from 3.28.19 to 3.29.0 in the ci group...
3360f79 chore: update 'flake.nix' (#1503)
ca24589 chore(deps): bump the go group with 10 updates (#1502)
c200647 chore: update 'flake.nix' (#1499)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/fluxcd/flux2/v2](https://github.com/fluxcd/flux2) | `2.6.3` | `2.6.4` | | [github.com/fluxcd/pkg/apis/meta](https://github.com/fluxcd/pkg) | `1.13.0` | `1.15.0` | | [github.com/fluxcd/pkg/runtime](https://github.com/fluxcd/pkg) | `0.62.0` | `0.66.0` | | [github.com/fluxcd/pkg/ssa](https://github.com/fluxcd/pkg) | `0.48.0` | `0.51.0` | | [github.com/fluxcd/pkg/version](https://github.com/fluxcd/pkg) | `0.8.0` | `0.9.0` | | [github.com/open-component-model/ocm-controller](https://github.com/open-component-model/ocm-controller) | `0.26.2` | `0.26.4` | Updates `github.com/fluxcd/flux2/v2` from 2.6.3 to 2.6.4 - [Release notes](https://github.com/fluxcd/flux2/releases) - [Changelog](https://github.com/fluxcd/flux2/blob/main/.goreleaser.yml) - [Commits](fluxcd/flux2@v2.6.3...v2.6.4) Updates `github.com/fluxcd/kustomize-controller/api` from 1.6.0 to 1.6.1 - [Release notes](https://github.com/fluxcd/kustomize-controller/releases) - [Changelog](https://github.com/fluxcd/kustomize-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/kustomize-controller@v1.6.0...v1.6.1) Updates `github.com/fluxcd/pkg/apis/meta` from 1.13.0 to 1.15.0 - [Commits](fluxcd/pkg@apis/meta/v1.13.0...apis/meta/v1.15.0) Updates `github.com/fluxcd/pkg/runtime` from 0.62.0 to 0.66.0 - [Commits](fluxcd/pkg@runtime/v0.62.0...runtime/v0.66.0) Updates `github.com/fluxcd/pkg/ssa` from 0.48.0 to 0.51.0 - [Commits](fluxcd/pkg@oci/v0.48.0...oci/v0.51.0) Updates `github.com/fluxcd/pkg/version` from 0.8.0 to 0.9.0 - [Commits](fluxcd/pkg@tar/v0.8.0...tar/v0.9.0) Updates `github.com/open-component-model/ocm-controller` from 0.26.2 to 0.26.4 - [Release notes](https://github.com/open-component-model/ocm-controller/releases) - [Changelog](https://github.com/open-component-model/ocm-controller/blob/main/.goreleaser.yaml) - [Commits](open-component-model/ocm-controller@v0.26.2...v0.26.4) Updates `ocm.software/ocm` from 0.25.0 to 0.26.0 - [Release notes](https://github.com/open-component-model/ocm/releases) - [Changelog](https://github.com/open-component-model/ocm/blob/main/RELEASE_PROCESS.md) - [Commits](open-component-model/ocm@v0.25...v0.26) --- updated-dependencies: - dependency-name: github.com/fluxcd/flux2/v2 dependency-version: 2.6.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/kustomize-controller/api dependency-version: 1.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/pkg/apis/meta dependency-version: 1.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/fluxcd/pkg/runtime dependency-version: 0.66.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/fluxcd/pkg/ssa dependency-version: 0.51.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/fluxcd/pkg/version dependency-version: 0.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/open-component-model/ocm-controller dependency-version: 0.26.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: ocm.software/ocm dependency-version: 0.26.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels Jul 13, 2025

dependabot bot requested a review from a team as a code owner July 13, 2025 06:56

dependabot bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels Jul 13, 2025

hilmarf enabled auto-merge (squash) July 14, 2025 07:59

hilmarf approved these changes Jul 14, 2025

View reviewed changes

hilmarf merged commit 70cf766 into main Jul 14, 2025
5 checks passed

hilmarf deleted the dependabot/go_modules/go-78c375c9a1 branch July 14, 2025 08:00

ocmbot bot added this to the 2025-Q3 milestone Jul 14, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the go group across 1 directory with 8 updates #162

chore(deps): bump the go group across 1 directory with 8 updates #162

Uh oh!

dependabot bot commented on behalf of github Jul 13, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

chore(deps): bump the go group across 1 directory with 8 updates #162

chore(deps): bump the go group across 1 directory with 8 updates #162

Uh oh!

Conversation

dependabot bot commented on behalf of github Jul 13, 2025

v2.6.4

Highlights

Components changelog

CLI changed

v1.6.1

Changelog

Container images

1.6.1

v0.26.4

Release v0.26.4

🧰 Maintenance

⬆️ Dependencies

v0.26.3

Release v0.26.3

🧰 Maintenance

⬆️ Dependencies

v0.26.0

What's Changed

‼️ Breaking Changes

🐛 Bug Fixes

⬆️ Dependencies

🧰 Maintenance

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants