chore(deps): bump the go group across 1 directory with 13 updates by dependabot[bot] · Pull Request #931 · open-component-model/ocm-controller

dependabot · 2026-05-24T15:04:46Z

Bumps the go group with 11 updates in the / directory:

Package	From	To
github.com/fluxcd/helm-controller/api	`1.5.4`	`1.5.5`
github.com/fluxcd/kustomize-controller/api	`1.8.4`	`1.8.5`
github.com/fluxcd/source-controller/api	`1.8.3`	`1.8.5`
github.com/google/go-containerregistry	`0.21.5`	`0.21.6`
github.com/onsi/gomega	`1.40.0`	`1.41.0`
go.podman.io/image/v5	`5.39.2`	`5.40.0`
helm.sh/helm/v3	`3.20.2`	`3.21.0`
k8s.io/api	`0.36.0`	`0.36.1`
k8s.io/apiextensions-apiserver	`0.36.0`	`0.36.1`
ocm.software/ocm	`0.41.0`	`0.42.0`
sigs.k8s.io/controller-runtime	`0.24.0`	`0.24.1`

Updates github.com/fluxcd/helm-controller/api from 1.5.4 to 1.5.5

Release notes

Sourced from github.com/fluxcd/helm-controller/api's releases.

v1.5.5

Changelog

v1.5.5 changelog

Container images

docker.io/fluxcd/helm-controller:v1.5.5

ghcr.io/fluxcd/helm-controller:v1.5.5

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/helm-controller/api's changelog.

1.5.5

Release date: 2026-05-20

This patch release fixes several reliability issues. HTTP artifact fetches could block indefinitely and stall reconciliations, the Kubernetes client transport accumulated a new retry wrapper on every reconcile causing unbounded memory growth, non-CRD objects placed under a chart's crds/ directory were force-applied, and the Helm test action failed to find releases with names longer than 53 characters. It also moves Helm back to upstream v4.2.0 (off the Flux fork) and updates Kubernetes and fluxcd/pkg dependencies.

Fixes:

Add configurable HTTP timeout for artifact fetching #1497

Move retryingRoundTripper wrapping to constructor #1487

Ignore non-CRD objects under crds/ #1496

Use ShortenName for release name in Test action #1498

Improvements:

Update Helm to v4.2.0 #1482

Upgrade k8s to 1.36.1, c-r to 0.24.1, cli-utils to 1.2.1 #1495

Update fluxcd/pkg dependencies #1483

Commits

e99b6c7 Merge pull request #1500 from fluxcd/release-v1.5.5
fda206c Release v1.5.5
628a880 Add changelog entry for v1.5.5
7cf31a4 Merge pull request #1498 from fluxcd/backport-1492-to-release/v1.5.x
946c981 Use ShortenName for release name in Test action
aabd7cb Merge pull request #1497 from fluxcd/backport-1464-to-release/v1.5.x
6e2c112 Add configurable HTTP timeout for artifact fetching
5e4ff0a Merge pull request #1496 from fluxcd/backport-1494-to-release/v1.5.x
6951115 Sanitize CreateReplace for non-CRDs
94853fc Merge pull request #1495 from fluxcd/upgrade-deps
Additional commits viewable in compare view

Updates github.com/fluxcd/kustomize-controller/api from 1.8.4 to 1.8.5

Release notes

Sourced from github.com/fluxcd/kustomize-controller/api's releases.

v1.8.5

Changelog

v1.8.5 changelog

Container images

docker.io/fluxcd/kustomize-controller:v1.8.5

ghcr.io/fluxcd/kustomize-controller:v1.8.5

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/kustomize-controller/api's changelog.

1.8.5

Release date: 2026-05-12

This patch release fixes a regression in the management of objects annotated with kustomize.toolkit.fluxcd.io/ssa: IfNotPresent where non-namespaced resources were being deleted and recreated on each reconciliation.

Fixes:

Fix management of skipped objects #1651

Improvements:

Update fluxcd/pkg dependencies #1648

Commits

b74fb3e Merge pull request #1654 from fluxcd/release-v1.8.5
0d9520f Release v1.8.5
0c3b99a Add changelog entry for v1.8.5
1d3ddcb Merge pull request #1652 from fluxcd/backport-1651-to-release/v1.8.x
897f431 Keep excluding 'ssa: Ignore' from deletion, but not 'ssa: IfNotPresent'
68d659b Keep ignoring the health of skipped objects
f94d2af Revert 'Fix skipped entries from SSA being stored in the inventory'
ce55c86 Refactor object deletion in the controller
3b5ad19 Merge pull request #1648 from fluxcd/update-pkg-deps/release/v1.8.x
b9727a8 Update fluxcd/pkg dependencies
See full diff in compare view

Updates github.com/fluxcd/source-controller/api from 1.8.3 to 1.8.5

Release notes

Sourced from github.com/fluxcd/source-controller/api's releases.

v1.8.5

Changelog

v1.8.5 changelog

Container images

docker.io/fluxcd/source-controller:v1.8.5

ghcr.io/fluxcd/source-controller:v1.8.5

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

v1.8.4

Changelog

v1.8.4 changelog

Container images

docker.io/fluxcd/source-controller:v1.8.4

ghcr.io/fluxcd/source-controller:v1.8.4

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/source-controller/api's changelog.

1.8.5

Release date: 2026-05-20

This patch release hardens path handling in the source reconcilers and updates go-git to v5.19.1, which fixes CVE-2026-45571 (crafted repositories may modify the main and submodule .git directories) and CVE-2026-45570 (improper single-quote escaping in the SSH transport). It also fixes Helm chart resolution for OCI tags that encode semver build metadata, updates Helm to v4.2.0 to align with helm-controller, and adds support for GCP sovereign cloud artifact registries via the fluxcd/pkg update.

Fixes:

Improve path handling in source reconcilers #2055

Support Helm semver encoding in OCI repositories #2051

Improvements:

Update Helm to v4.2.0 #2049

Upgrade k8s to 1.36.1, c-r to 0.24.1, cli-utils to 1.2.1 #2052

Update fluxcd/pkg dependencies #2056

1.8.4

Release date: 2026-05-12

This patch release comes with dependency updates, including go-git v5.19.0 which fixes CVE-2026-45022.

Improvements:

Update fluxcd/pkg dependencies #2045

Commits

e9faef4 Merge pull request #2058 from fluxcd/release-v1.8.5
35aac36 Release v1.8.5
06a570c Add changelog entry for v1.8.5
372d3f3 Merge pull request #2056 from fluxcd/update-pkg-deps/release/v1.8.x
e8c664f Update fluxcd/pkg dependencies
10643c9 Merge pull request #2055 from fluxcd/backport-2054-to-release/v1.8.x
153b7ab Resolve sparse checkout paths with SecureJoin
3dcb00c Resolve bucket object paths with SecureJoin
493e0bb Merge pull request #2052 from fluxcd/upgrade-deps
0fab7d8 Upgrade k8s to 1.36.1, c-r to 0.24.1, cli-utils to 1.2.1
Additional commits viewable in compare view

Updates github.com/google/go-containerregistry from 0.21.5 to 0.21.6

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.21.6

What's Changed

fix: update dependencies to use new azure sdk components by @gaganhr94 in google/go-containerregistry#2262

transport: restore resp.Body in retryError so CheckError can parse it by @alliasgher in google/go-containerregistry#2264

pkg/registry: return 202 Accepted for PATCH chunk uploads by @alliasgher in google/go-containerregistry#2265

Follow OCI distribution spec for artifactType and annotations by @malt3 in google/go-containerregistry#2269

actions: attach Codecov token to coverage tests on main by @Subserial in google/go-containerregistry#2270

remote: use DeleteScope (with "delete" action) for manifest deletion by @alliasgher in google/go-containerregistry#2266

remote: limit concurrent layer pulls by @gnix0 in google/go-containerregistry#2271

pkg/registry: reject corrupt disk blobs by @gnix0 in google/go-containerregistry#2272

mutate: close layer readers during export by @gnix0 in google/go-containerregistry#2277

crane/flatten: preserve image media type when flattening by @alliasgher in google/go-containerregistry#2267

build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 in the actions group across 1 directory by @dependabot[bot] in google/go-containerregistry#2273

build(deps): bump go.opentelemetry.io/otel from 1.36.0 to 1.41.0 by @dependabot[bot] in google/go-containerregistry#2278

build(deps): bump the go-deps group across 3 directories with 6 updates by @dependabot[bot] in google/go-containerregistry#2280

Replace go-homedir with os.UserHomeDir by @jammie-jelly in google/go-containerregistry#2282

pkg/name: only treat .localhost as non-HTTPS, not .local by @blackwell-systems in google/go-containerregistry#2281

transport: block unspecified IPs (0.0.0.0, ::) in validateRealmURL by @marwan9696 in google/go-containerregistry#2285

test(mutate): add Extract round-trip test for filesystem object preservation by @blackwell-systems in google/go-containerregistry#2283

experiments: remove deprecated support for estargz by @thaJeztah in google/go-containerregistry#2288

build(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 in the actions group by @dependabot[bot] in google/go-containerregistry#2289

fix: limit HTTP response body reads to prevent OOM by @evilgensec in google/go-containerregistry#2296

build(deps): bump the go-deps group across 3 directories with 6 updates by @dependabot[bot] in google/go-containerregistry#2297

transport: block redirects from token server to private/link-local addresses (SSRF fix) by @evilgensec in google/go-containerregistry#2292

pkg/v1/mutate: preserve relative symlinks that stay within rootfs in Extract by @anishesg in google/go-containerregistry#2279

validate: skip non-layer layers by @imjasonh in google/go-containerregistry#2298

remote: validate foreign layer URLs to prevent SSRF (fixes #2259) by @evilgensec in google/go-containerregistry#2293

remote: block SSRF via private-IP Location headers in blob uploads by @adilburaksen in google/go-containerregistry#2295

fix(mutate): preserve config blob and layers for non-Docker OCI artifacts by @blackwell-systems in google/go-containerregistry#2286

fix: preserve per-occurrence layer identity in mutate.Image.Layers() by @iahsanGill in google/go-containerregistry#2299

transport: retry HTTP 429 (Too Many Requests) by @iahsanGill in google/go-containerregistry#2301

transport: allow bearer realm at same host:port as registry by @iahsanGill in google/go-containerregistry#2302

Update go version to 1.26.3 by @Subserial in google/go-containerregistry#2300

New Contributors

@gaganhr94 made their first contribution in google/go-containerregistry#2262

@alliasgher made their first contribution in google/go-containerregistry#2264

@malt3 made their first contribution in google/go-containerregistry#2269

@gnix0 made their first contribution in google/go-containerregistry#2271

@blackwell-systems made their first contribution in google/go-containerregistry#2281

@marwan9696 made their first contribution in google/go-containerregistry#2285

@anishesg made their first contribution in google/go-containerregistry#2279

@adilburaksen made their first contribution in google/go-containerregistry#2295

@iahsanGill made their first contribution in google/go-containerregistry#2299

Full Changelog: google/go-containerregistry@v0.21.5...v0.21.6

Commits

53f7e39 Update go version to 1.26.3 (#2300)
bf87c3b transport: allow bearer realm at same host:port as registry (#2302)
c55facd transport: retry HTTP 429 (Too Many Requests) (#2301)
68a569e fix: preserve per-occurrence layer identity in Layers() (#2299)
35b354b fix(mutate): preserve config blob and layers for non-Docker OCI artifacts (#2...
e5983f2 remote: block SSRF via private-IP Location headers in blob uploads (#2295)
6dad820 remote: validate foreign layer URLs to prevent SSRF (fixes #2259) (#2293)
78bdf1b validate: skip non-layer layers (#2298)
c29d91c pkg/v1/mutate: preserve relative symlinks that stay within rootfs in Extract ...
a70d75a transport: block redirects from token server to private/link-local addresses ...
Additional commits viewable in compare view

Updates github.com/onsi/gomega from 1.40.0 to 1.41.0

Changelog

Sourced from github.com/onsi/gomega's changelog.

1.41.0

Features

Add BeASlice and BeAnArray matchers

Fixes

Object formatting now detects pointer cycles to avoid runaway formatting output.

Commits

af2bccb v1.41.0
73e81f6 v1.41.0 (full)
e35a84f feat: devcontainer configuration with local pkgsite and GH pages
f12e5e1 fix(format): detect pointer cycles to avoid runaway formatting output
e14831f Add optionalDescription docs to AsyncAssertion and Assertion interfaces
344b94d Add BeASlice and BeAnArray matchers
See full diff in compare view

Updates go.podman.io/image/v5 from 5.39.2 to 5.40.0

Commits

3c2fa91 Bump to c/image v5.40
f871d19 Bump to c/storage v1.63.0 in c/image, c/image to v5.40
550f62f Bump c/storage to v1.63.0
4fa1864 Merge pull request #816 from alexlarsson/fix-composefs-verity
32704ef Merge pull request #855 from containers/renovate/github.com-docker-cli-29.x
98ff31a Merge pull request #853 from mheon/containers_conf_documentation_removals
3e16145 Update module github.com/docker/cli to v29.5.1+incompatible
206fff3 Manpage: remove slirp4netns/boltdb references
3592bda Merge pull request #852 from containers/renovate/github.com-onsi-gomega-1.x
f04d9c8 Update module github.com/onsi/gomega to v1.41.0
Additional commits viewable in compare view

Updates helm.sh/helm/v3 from 3.20.2 to 3.21.0

Release notes

Sourced from helm.sh/helm/v3's releases.

Helm v3.21.0 is a feature release. Users are encouraged to upgrade for the best experience.

[!WARNING] Helm v3 is approaching end-of-life. Please update to Helm v4.

The community keeps growing, and we'd love to see you there!

Join the discussion in Kubernetes Slack:

for questions and just to hang out

for discussing PRs, code, and bugs

Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom

Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

Kubernetes client libraries to v1.36

notable changes here

Installation and Upgrading

Download Helm v3.21.0. The common platform binaries are here:

MacOS amd64 (checksum / 8bc0c1f85f8738cc3cda4a2cc73047145bcdcb1f4d9cdcc29073037bfb22fa2e)

MacOS arm64 (checksum / 68bfbdc022c543a2a022597b20298216877e98abe6e4a345d3ecf114d79cae5f)

Linux amd64 (checksum / 0093eb572e3d2380f094df162ddb525e219249de88957afe24cfbb19632acd36)

Linux arm (checksum / d310ac387324538a37192e8e13628eb1def2596bbac6b6481ae20d8d5e3532bd)

Linux arm64 (checksum / 8de5a0c9a47431e59fd560e91e0779c8cf9316c383da7efb84128a4c339ecb2d)

Linux i386 (checksum / fc85f14c9ce7e6a48a2b19a97edbc5529ed7aa2bc10f3d2c241e1c2ef12ccd22)

Linux ppc64le (checksum / e2dced0f903acda417f879012c7e09ca461000e26a04e8f7a1cfe0dcf495f62c)

Linux s390x (checksum / a176d7460a615b8df5b1a58ecf09fcc731c7733ca4cf10116cf198575b0371b5)

Linux riscv64 (checksum / 4935c95c55bc5c3357143698a87185e17a39de9b6148dfd6cce0fc11859dbfeb)

Windows amd64 (checksum / 3ea6b8383e6c0b7ce45d06a5746313b8e9225edd88d42f4f64582ff3792d7b55)

Windows arm64 (checksum / 90d8c87e07267e6c71e678c9e33dd11cc121789c823ccc380de9d1dd521c8cba)

This release was signed by @gjenkins8 with key BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739, which can be found at https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

3.21.1 will contain only bug fixes.

3.22.0 is the next feature release for Kubernetes v1.37

Changelog

[v3] Bump to version v3.21 e0878d41b711792be60777fd65ad23a101e6b85f (George Jenkins)

fix: upgrade opentelemetry packages to patch CVEs 13d5fc4ae0e7222e1af8796ff4fa467b52208471 (Terry Howe)

fix: Chart dot-name path bug 2552884e3bc1b763c3901c5ea7240b59ef6791f1 (George Jenkins)

fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow ec05dd5f0481c2de3a41a554adf3c52a6a2a9bb6 (Terry Howe)

add image index test b0dfec5af4d7f642d8dea3b9058856541fe5017c (Pedro Tôrres)

... (truncated)

Commits

e0878d4 [v3] Bump to version v3.21
4d4902c Merge pull request #32041 from TerryHowe/fix/upgrade-otel-cves
13d5fc4 fix: upgrade opentelemetry packages to patch CVEs
a60cb79 Merge commit from fork
d3bc853 Merge pull request #32026 from gjenkins8/gjenkins/code_action_pin_v3
2552884 fix: Chart dot-name path bug
ec05dd5 fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow
6d809b2 Merge pull request #31883 from t0rr3sp3dr0/pedrotorres/backport-31776-to-v3
b0dfec5 add image index test
e629995 fix pulling charts from OCI indices
Additional commits viewable in compare view

Updates k8s.io/api from 0.36.0 to 0.36.1

Commits

25001c8 Update dependencies to v0.36.1 tag
See full diff in compare view

Updates k8s.io/apiextensions-apiserver from 0.36.0 to 0.36.1

Commits

5b822b1 Update dependencies to v0.36.1 tag
See full diff in compare view

Updates k8s.io/apimachinery from 0.36.0 to 0.36.1

Commits

7af103a Update dependencies to v0.36.1 tag
See full diff in compare view

Updates k8s.io/client-go from 0.36.0 to 0.36.1

Commits

55ef15a Update dependencies to v0.36.1 tag
See full diff in compare view

Updates ocm.software/ocm from 0.41.0 to 0.42.0

Release notes

Sourced from ocm.software/ocm's releases.

v0.42.0

What's Changed

🐛 Bug Fixes

fix: migrate to the website location by @frewilhelm in open-component-model/ocm#1931

⬆️ Dependencies

chore(deps): bump github.com/jackc/pgx/v5 to v5.9.0 by @piotrjanik in open-component-model/ocm#1936

chore(deps): bump github.com/jackc/pgx/v5 from 5.9.0 to 5.9.2 by @dependabot[bot] in open-component-model/ocm#1938

chore(deps): bump the go group across 1 directory with 25 updates by @dependabot[bot] in open-component-model/ocm#1933

🧰 Maintenance

chore: bump VERSION to 0.42.0-dev by @ocmbot[bot] in open-component-model/ocm#1928

chore: sync contributing guide by @frewilhelm in open-component-model/ocm#1932

chore: fix permissions for called workflow by @frewilhelm in open-component-model/ocm#1934

chore: fix pr title for cherry pick commit by @Skarlso in open-component-model/ocm#1941

Full Changelog: open-component-model/ocm@v0.41...v0.42.0

v0.42.0-rc.1

What's Changed

🐛 Bug Fixes

fix: migrate to the website location by @frewilhelm in open-component-model/ocm#1931

⬆️ Dependencies

chore(deps): bump github.com/jackc/pgx/v5 to v5.9.0 by @piotrjanik in open-component-model/ocm#1936

chore(deps): bump github.com/jackc/pgx/v5 from 5.9.0 to 5.9.2 by @dependabot[bot] in open-component-model/ocm#1938

chore(deps): bump the go group across 1 directory with 25 updates by @dependabot[bot] in open-component-model/ocm#1933

🧰 Maintenance

chore: bump VERSION to 0.42.0-dev by @ocmbot[bot] in open-component-model/ocm#1928

chore: sync contributing guide by @frewilhelm in open-component-model/ocm#1932

chore: fix permissions for called workflow by @frewilhelm in open-component-model/ocm#1934

chore: fix pr title for cherry pick commit by @Skarlso in open-component-model/ocm#1941

Full Changelog: open-component-model/ocm@v0.41...v0.42.0

Commits

09ed037 chore: fix pr title for cherry pick commit (#1941)
5483af8 chore(deps): bump the go group across 1 directory with 25 updates (#1933)
129f7be chore(deps): bump github.com/jackc/pgx/v5 from 5.9.0 to 5.9.2 (#1938)
a461ecf chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 in the ci group ...
ac692e1 chore: fix permissions for called workflow (#1934)
8fefc86 chore(deps): bump github.com/jackc/pgx/v5 to v5.9.0 (#1936)
175a97a chore: sync contributing guide (#1932)
812557b fix: migrate to the website location (#1931)
659d415 chore(deps): bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 in the ci ...
012e58d chore: bump VERSION to 0.42.0-dev (#1928)
See full diff in compare view

Updates sigs.k8s.io/controller-runtime from 0.24.0 to 0.24.1

Release notes

Sourced from sigs.k8s.io/controller-runtime's releases.

v0.24.1

What's Changed

[release-0.24] 🐛 Fix regression in Apply typed error handling by @k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#3516

Full Changelog: kubernetes-sigs/controller-runtime@v0.24.0...v0.24.1

Commits

3be3f1b Merge pull request #3516 from k8s-infra-cherrypick-robot/cherry-pick-3515-to-...
0f7b33d Fix regression in Apply typed error handling
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/fluxcd/helm-controller/api](https://github.com/fluxcd/helm-controller) | `1.5.4` | `1.5.5` | | [github.com/fluxcd/kustomize-controller/api](https://github.com/fluxcd/kustomize-controller) | `1.8.4` | `1.8.5` | | [github.com/fluxcd/source-controller/api](https://github.com/fluxcd/source-controller) | `1.8.3` | `1.8.5` | | [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) | `0.21.5` | `0.21.6` | | [github.com/onsi/gomega](https://github.com/onsi/gomega) | `1.40.0` | `1.41.0` | | [go.podman.io/image/v5](https://github.com/containers/container-libs) | `5.39.2` | `5.40.0` | | [helm.sh/helm/v3](https://github.com/helm/helm) | `3.20.2` | `3.21.0` | | [k8s.io/api](https://github.com/kubernetes/api) | `0.36.0` | `0.36.1` | | [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) | `0.36.0` | `0.36.1` | | [ocm.software/ocm](https://github.com/open-component-model/ocm) | `0.41.0` | `0.42.0` | | [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime) | `0.24.0` | `0.24.1` | Updates `github.com/fluxcd/helm-controller/api` from 1.5.4 to 1.5.5 - [Release notes](https://github.com/fluxcd/helm-controller/releases) - [Changelog](https://github.com/fluxcd/helm-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/helm-controller@v1.5.4...v1.5.5) Updates `github.com/fluxcd/kustomize-controller/api` from 1.8.4 to 1.8.5 - [Release notes](https://github.com/fluxcd/kustomize-controller/releases) - [Changelog](https://github.com/fluxcd/kustomize-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/kustomize-controller@v1.8.4...v1.8.5) Updates `github.com/fluxcd/source-controller/api` from 1.8.3 to 1.8.5 - [Release notes](https://github.com/fluxcd/source-controller/releases) - [Changelog](https://github.com/fluxcd/source-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/source-controller@v1.8.3...v1.8.5) Updates `github.com/google/go-containerregistry` from 0.21.5 to 0.21.6 - [Release notes](https://github.com/google/go-containerregistry/releases) - [Commits](google/go-containerregistry@v0.21.5...v0.21.6) Updates `github.com/onsi/gomega` from 1.40.0 to 1.41.0 - [Release notes](https://github.com/onsi/gomega/releases) - [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md) - [Commits](onsi/gomega@v1.40.0...v1.41.0) Updates `go.podman.io/image/v5` from 5.39.2 to 5.40.0 - [Release notes](https://github.com/containers/container-libs/releases) - [Commits](containers/container-libs@image/v5.39.2...image/v5.40.0) Updates `helm.sh/helm/v3` from 3.20.2 to 3.21.0 - [Release notes](https://github.com/helm/helm/releases) - [Commits](helm/helm@v3.20.2...v3.21.0) Updates `k8s.io/api` from 0.36.0 to 0.36.1 - [Commits](kubernetes/api@v0.36.0...v0.36.1) Updates `k8s.io/apiextensions-apiserver` from 0.36.0 to 0.36.1 - [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases) - [Commits](kubernetes/apiextensions-apiserver@v0.36.0...v0.36.1) Updates `k8s.io/apimachinery` from 0.36.0 to 0.36.1 - [Commits](kubernetes/apimachinery@v0.36.0...v0.36.1) Updates `k8s.io/client-go` from 0.36.0 to 0.36.1 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.36.0...v0.36.1) Updates `ocm.software/ocm` from 0.41.0 to 0.42.0 - [Release notes](https://github.com/open-component-model/ocm/releases) - [Changelog](https://github.com/open-component-model/ocm/blob/main/RELEASE_PROCESS.md) - [Commits](open-component-model/ocm@v0.41...v0.42) Updates `sigs.k8s.io/controller-runtime` from 0.24.0 to 0.24.1 - [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases) - [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md) - [Commits](kubernetes-sigs/controller-runtime@v0.24.0...v0.24.1) --- updated-dependencies: - dependency-name: github.com/fluxcd/helm-controller/api dependency-version: 1.5.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/kustomize-controller/api dependency-version: 1.8.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/source-controller/api dependency-version: 1.8.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/google/go-containerregistry dependency-version: 0.21.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/onsi/gomega dependency-version: 1.41.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: go.podman.io/image/v5 dependency-version: 5.40.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: helm.sh/helm/v3 dependency-version: 3.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: k8s.io/api dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: k8s.io/apiextensions-apiserver dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: k8s.io/apimachinery dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: k8s.io/client-go dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: ocm.software/ocm dependency-version: 0.42.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: sigs.k8s.io/controller-runtime dependency-version: 0.24.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go ... Signed-off-by: dependabot[bot] <support@github.com>

matthiasbruns · 2026-05-26T05:05:49Z

@dependabot rebase

dependabot · 2026-05-26T05:08:18Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels May 24, 2026

dependabot Bot requested a review from a team as a code owner May 24, 2026 15:04

dependabot Bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels May 24, 2026

dependabot Bot closed this May 26, 2026

dependabot Bot deleted the dependabot/go_modules/go-65e5347654 branch May 26, 2026 05:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the go group across 1 directory with 13 updates#931

chore(deps): bump the go group across 1 directory with 13 updates#931
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-65e5347654

dependabot Bot commented on behalf of github May 24, 2026 •

edited

Loading

Uh oh!

matthiasbruns commented May 26, 2026

Uh oh!

dependabot Bot commented on behalf of github May 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github May 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.5.5

Changelog

Container images

1.5.5

v1.8.5

Changelog

Container images

1.8.5

v1.8.5

Changelog

Container images

v1.8.4

Changelog

Container images

1.8.5

1.8.4

v0.21.6

What's Changed

New Contributors

1.41.0

Features

Fixes

Notable Changes

Installation and Upgrading

What's Next

Changelog

v0.42.0

What's Changed

🐛 Bug Fixes

⬆️ Dependencies

🧰 Maintenance

v0.42.0-rc.1

What's Changed

🐛 Bug Fixes

⬆️ Dependencies

🧰 Maintenance

v0.24.1

What's Changed

Uh oh!

matthiasbruns commented May 26, 2026

Uh oh!

dependabot Bot commented on behalf of github May 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github May 24, 2026 •

edited

Loading