chore(deps): bump the go group with 8 updates

[dependabot]

Bumps the go group with 8 updates:

Package	From	To
github.com/fluxcd/helm-controller/api	1.6.4	1.6.5
github.com/fluxcd/kustomize-controller/api	1.9.5	1.9.6
github.com/fluxcd/pkg/apis/event	0.29.0	0.30.0
github.com/fluxcd/pkg/runtime	0.114.0	0.115.0
github.com/fluxcd/source-controller/api	1.9.5	1.9.6
github.com/onsi/gomega	1.43.1	1.44.0
sigs.k8s.io/controller-runtime	0.25.1	0.25.2
sigs.k8s.io/kustomize/api	0.21.1	0.21.2

Updates github.com/fluxcd/helm-controller/api from 1.6.4 to 1.6.5

Release notes

Sourced from github.com/fluxcd/helm-controller/api's releases.

v1.6.5

Changelog

v1.6.5 changelog

Container images

• docker.io/fluxcd/helm-controller:v1.6.5
• ghcr.io/fluxcd/helm-controller:v1.6.5

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/helm-controller/api's changelog.

1.6.5

Release date: 2026-10-01

This patch release stops chart CRDs from being reapplied on every upgrade when server-side apply is enabled (the default): the default Create policy is meant to leave existing CRDs alone, but SSA's upsert semantics were updating them anyway, and they are now skipped as with client-side apply. It also recovers HelmReleases stranded with a drifted Ready=Unknown condition after a failed status patch, keeps HelmChart cleanup from getting stuck when the chart is already gone, and corrects the documented default CRD upgrade policy (.spec.upgrade.crds defaults to Create, not Skip).

Fixes:

• Fix updating CRDs on upgrades with the Create policy when using SSA #1589
• Recover from drifted Ready/Released status conditions #1580
• Ignore NotFound when deleting HelmChart #1574

Commits

• 37dce43 Merge pull request #1598 from fluxcd/release-v1.6.5
• 71049ef Release v1.6.5
• b50cd49 Add changelog entry for v1.6.5
• 2a9b34b Merge pull request #1590 from fluxcd/backport-1589-to-release/v1.6.x
• 195a9a6 Fix docs to reflect the correct default policy for CRDs
• bb4c66a Fix updating CRDs on upgrades with the Create policy when using SSA
• eaa97e0 Merge pull request #1582 from fluxcd/backport-1580-to-release/v1.6.x
• e5a4a62 Recover from drifted Ready/Released status conditions
• 0bd7233 Merge pull request #1579 from fluxcd/backport-1574-to-release/v1.6.x
• 258623d Ignore NotFound when deleting HelmChart
• See full diff in compare view

Updates github.com/fluxcd/kustomize-controller/api from 1.9.5 to 1.9.6

Release notes

Sourced from github.com/fluxcd/kustomize-controller/api's releases.

v1.9.6

Changelog

v1.9.6 changelog

Container images

• docker.io/fluxcd/kustomize-controller:v1.9.6
• ghcr.io/fluxcd/kustomize-controller:v1.9.6

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/kustomize-controller/api's changelog.

1.9.6

Release date: 2026-10-01

This patch release extends the SOPS decryption error redaction to spec.postBuild.substituteFrom values: when a substituted value is echoed back in a Kubernetes API validation error, it is now masked out of the Kustomization status conditions and events instead of leaking into them. It also adds the opt-in DisableCommitStatusEvent feature gate, which lets users disable the reconciliation success event that notification-controller turns into a Git commit status update.

Fixes:

• Extend SOPS redaction to postBuild substitutions #1741
• Update fluxcd/pkg dependencies #1761

Improvements:

• Add feature gate to disable commit status event #1755
• docs: Add reference to flux-schema #1738

Commits

• 060e0d8 Merge pull request #1766 from fluxcd/release-v1.9.6
• bbb2f3f Release v1.9.6
• 2e53937 Add changelog entry for v1.9.6
• 64f9daa Merge pull request #1762 from fluxcd/backport-1741-to-release/v1.9.x
• 4ec2ef5 Extend SOPS redaction to postBuild substitutions
• 80e51b5 Merge pull request #1761 from fluxcd/update-pkg-deps/release/v1.9.x
• 3753e85 Update fluxcd/pkg dependencies
• 00ed487 Merge pull request #1756 from fluxcd/backport-1755-to-release/v1.9.x
• f464fe3 Add feature gate to disable commit status event
• 9094276 Merge pull request #1753 from fluxcd/revert-1745
• Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/apis/event from 0.29.0 to 0.30.0

Commits

• 7a72e48 Merge pull request #927 from fluxcd/rfc-0010-feature-gate
• d1cd390 [RFC-0010] Introduce feature gate for enabling object-level workload identity
• a556f82 Merge pull request #926 from fluxcd/azure-int-tests
• d8a62c1 Enable scheduled Azure integration tests
• a7adfff Merge pull request #922 from fluxcd/dependabot/github_actions/ci-1bf90fd100
• b5058d4 build(deps): bump the ci group across 1 directory with 4 updates
• 8204f92 Merge pull request #925 from fluxcd/federation
• 4d58d6d [RFC-0010] Support cross-cloud object-level workload identity
• 284f566 Merge pull request #924 from fluxcd/wi-int-tests
• 0b6d5a6 [RFC-0010] Add integration tests for object-level workload identity
• Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/runtime from 0.114.0 to 0.115.0

Commits

• 45968bf Merge pull request #1307 from fluxcd/release-main
• 91dca68 Prepare for release
• f8ac38f Merge pull request #1302 from adri1197/core-v1-events
• 2e167bd Use core/v1 recorder to preserve full event messages
• 601155f Merge pull request #1304 from fluxcd/release-main
• 48576ed Prepare for release
• c5b1556 Merge pull request #1301 from fluxcd/auth-multi-audience
• f10f4a2 Support multiple audiences in OIDC and JWT
• See full diff in compare view

Updates github.com/fluxcd/source-controller/api from 1.9.5 to 1.9.6

Release notes

Sourced from github.com/fluxcd/source-controller/api's releases.

v1.9.6

Changelog

v1.9.6 changelog

Container images

• docker.io/fluxcd/source-controller:v1.9.6
• ghcr.io/fluxcd/source-controller:v1.9.6

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/source-controller/api's changelog.

1.9.6

Release date: 2026-10-01

This patch release normalizes Azure Blob listing ETags so that the listing digest stays consistent with the stored artifact revision and unchanged containers are no longer re-downloaded on every reconcile, and evicts stale Helm repository index entries from the cache so that repositories with frequently changing indexes no longer fail with "Cache is full".

Fixes:

• Normalize Azure listing ETags #2171
• Evict stale Helm index entries from cache #2152

Improvements:

• Replace MinIO server with in-process S3 mock in tests #2153
• Correct the shallow clone claim for commit plus branch in the GitRepository docs #2147

Commits

• 456fa32 Merge pull request #2174 from fluxcd/release-v1.9.6
• 6279cc8 Release v1.9.6
• 7119cd7 Add changelog entry for v1.9.6
• 7e75011 Merge pull request #2172 from fluxcd/backport-2171-to-release/v1.9.x
• 29336c8 Assert Azure listing and download ETags match
• 9c9f52d Normalize Azure listing ETags
• 52accad Merge pull request #2155 from fluxcd/backport-2152-to-release/v1.9.x
• 1d05fe1 Evict stale Helm index entries from cache
• 8c8a8b6 Merge pull request #2154 from fluxcd/backport-2153-to-release/v1.9.x
• 2cdf9ad Replace MinIO server with in-process S3 mock in tests
• Additional commits viewable in compare view

Updates github.com/onsi/gomega from 1.43.1 to 1.44.0

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.44.0

Fixes

• BeNumerically compares signed and unsigned integers by value: -1 no longer equals uint64(math.MaxUint64) and uint(5) is now greater than -3 (#925) [26e3c6b]
• BeNumerically("~") no longer overflows when computing the distance between extreme integers (#928) [1955764]
• BeNumerically("==", x, threshold) now honors the threshold for floats, as it already did for integers (#927) [10e2aca]
• HaveKeyWithValue succeeds if any key accepted by the key matcher has a matching value, rather than depending on map iteration order (#929) [ffc577a]
• HaveKey and HaveKeyWithValue treat key and value matcher errors like ContainElement does: a match wins, and an error is only reported when nothing matches (#926) [dc91598]
• MatchJSON no longer treats numbers too large for a float64 as equal to one another (#930) [9d619a5]
• MatchJSON compares integers beyond ±2^53 exactly, so neighboring large integers (e.g. IDs) no longer match; all other numbers are still compared as float64s (#931) [8ef1aa7, 630fe12]
• HaveExactElements reports missing or extra elements that start at index 0, and reports the first extra element's index rather than the last (#934) [af1b777]
• MatchYAML compares every document in a multi-document stream rather than only the first; empty documents (e.g. a leading or trailing ---) are ignored (#933) [2773796]
• MatchXML ignores namespace prefixes: elements and attributes are compared by namespace URI, and the URIs declared on each element must match whatever prefix they are bound to (#932) [c0dbd89, 2565350]

Changelog

Sourced from github.com/onsi/gomega's changelog.

1.44.0

Fixes

• BeNumerically compares signed and unsigned integers by value: -1 no longer equals uint64(math.MaxUint64) and uint(5) is now greater than -3 (#925) [26e3c6b]
• BeNumerically("~") no longer overflows when computing the distance between extreme integers (#928) [1955764]
• BeNumerically("==", x, threshold) now honors the threshold for floats, as it already did for integers (#927) [10e2aca]
• HaveKeyWithValue succeeds if any key accepted by the key matcher has a matching value, rather than depending on map iteration order (#929) [ffc577a]
• HaveKey and HaveKeyWithValue treat key and value matcher errors like ContainElement does: a match wins, and an error is only reported when nothing matches (#926) [dc91598]
• MatchJSON no longer treats numbers too large for a float64 as equal to one another (#930) [9d619a5]
• MatchJSON compares integers beyond ±2^53 exactly, so neighboring large integers (e.g. IDs) no longer match; all other numbers are still compared as float64s (#931) [8ef1aa7, 630fe12]
• HaveExactElements reports missing or extra elements that start at index 0, and reports the first extra element's index rather than the last (#934) [af1b777]
• MatchYAML compares every document in a multi-document stream rather than only the first; empty documents (e.g. a leading or trailing ---) are ignored (#933) [2773796]
• MatchXML ignores namespace prefixes: elements and attributes are compared by namespace URI, and the URIs declared on each element must match whatever prefix they are bound to (#932) [c0dbd89, 2565350]

Commits

• c933817 v1.44.0
• 37fa900 v1.44.0 (full)
• 509f2b0 changelog: entries for chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 in the ci group #925-#934
• 2565350 fix: MatchXML compares namespace declarations by URI, ignoring the prefix
• 630fe12 fix: MatchJSON only compares integers beyond 2^53 exactly
• c0dbd89 fix: MatchXML ignores namespace prefixes and declarations
• 2773796 fix: MatchYAML compares every document in a multi-document stream
• af1b777 fix: HaveExactElements reports missing/extra elements starting at index 0
• 8ef1aa7 fix: MatchJSON compares numbers exactly
• 9d619a5 fix: MatchJSON reports numbers that do not fit in a float64
• Additional commits viewable in compare view

Updates sigs.k8s.io/controller-runtime from 0.25.1 to 0.25.2

Release notes

Sourced from sigs.k8s.io/controller-runtime's releases.

v0.25.2

What's Changed

• [release-0.25] 🐛 Fix SubResourceCreateOptions.ApplyToSubResourceCreate by @​k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#3600
• [release-0.25] ✨ Add metrics handler options by @​k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#3603
• [release-0.25] 📖 Document that ReadYourWrite doesn't work correctly with > 1 Namespace by @​k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#3610
• [release-0.25] ✨ Add a metric for the readyourwite consistency wait duration by @​k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#3613

Full Changelog: kubernetes-sigs/controller-runtime@v0.25.1...v0.25.2

Commits

• 5d8467b Merge pull request #3613 from k8s-infra-cherrypick-robot/cherry-pick-3609-to-...
• 7b211af sparkles: Add a metric for the readyourwite consistency wait duration
• dc84738 Merge pull request #3610 from k8s-infra-cherrypick-robot/cherry-pick-3608-to-...
• c7eb492 book: Document that ReadYourWrite doesn't work correctly with > 1 Namespace
• d837464 Merge pull request #3603 from k8s-infra-cherrypick-robot/cherry-pick-3594-to-...
• 1b98304 sparkles: Add metrics handler options
• 8963baf Merge pull request #3600 from k8s-infra-cherrypick-robot/cherry-pick-3598-to-...
• ade6e0b Fix SubResourceCreateOptions.ApplyToSubResourceCreate
• See full diff in compare view

Updates sigs.k8s.io/kustomize/api from 0.21.1 to 0.21.2

Release notes

Sourced from sigs.k8s.io/kustomize/api's releases.

api/v0.21.2

#5831: Add labels to volumeClaimTemplates in StatefulSets if includeVolumeClaimTemplates is true #6029: Account for delimiters in structured data replacements #6056: kyaml: mark ValidatingAdmissionPolicy resources as cluster-scoped #6075: update go 1.25.7 #6078: bump go-git and x/crypt #6085: update otel lib to v1.40.0 #6087: Reject ambiguous resource paths with inner ".." to prevent silent misresolution #6134: drop 'go-spew' dependencies and update dependencies #6138: bump k8s.io/kube-openapi, drop github.com/mailru/easyjson #6167: fix: match image digests with any algorithm, not only sha256 #6184: fix: do not panic on an invalid image name regexp #6186: bump/go v1.26.5 #6187: update vuln dependencies at 2026/07 #6236: chore: bump stretch/testify pkg to remove old yaml dependencies #6237: fix: preserve Secret stringData during generator merge #6239: fix: add CronJob Image Volume support to images transformer #6242: fix: reject flag-like helmCharts releaseName and name values #6249: build(deps): bump go.yaml.in/yaml/v2 from 2.4.2 to 2.4.4 #6251: build(deps): bump github.com/go-errors/errors from 1.4.2 to 1.5.1 #6254: build(deps): bump github.com/google/gnostic-models from 0.7.0 to 0.7.1 #6255: build(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 #6256: build(deps): bump golang.org/x/sys from 0.45.0 to 0.47.0 #6267: build(deps): bump golang.org/x/sys from 0.47.0 to 0.48.0 #6273: bump go-git, kin-openapi and k8s.io #6274: build: use the golangci-lint v2 with release binary #6296: build: run Go tools with go tool #6305: Update kyaml to v0.21.2

cmd/config/v0.21.2

#6075: update go 1.25.7 #6078: bump go-git and x/crypt #6085: update otel lib to v1.40.0 #6134: drop 'go-spew' dependencies and update dependencies #6138: bump k8s.io/kube-openapi, drop github.com/mailru/easyjson #6186: bump/go v1.26.5 #6187: update vuln dependencies at 2026/07 #6236: chore: bump stretch/testify pkg to remove old yaml dependencies #6249: build(deps): bump go.yaml.in/yaml/v2 from 2.4.2 to 2.4.4 #6251: build(deps): bump github.com/go-errors/errors from 1.4.2 to 1.5.1 #6254: build(deps): bump github.com/google/gnostic-models from 0.7.0 to 0.7.1 #6255: build(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 #6256: build(deps): bump golang.org/x/sys from 0.45.0 to 0.47.0 #6267: build(deps): bump golang.org/x/sys from 0.47.0 to 0.48.0 #6273: bump go-git, kin-openapi and k8s.io #6274: build: use the golangci-lint v2 with release binary #6296: build: run Go tools with go tool #6305: Update kyaml to v0.21.2

kyaml/v0.21.2

... (truncated)

Commits

• 81a12fc Merge pull request #6306 from koba1t/pinToCmdConfig
• 2b5cd8a Update cmd/config to v0.21.2
• 8c2642d Merge pull request #6305 from koba1t/pinToKyaml
• 8143902 Update kyaml to v0.21.2
• 0ab6ccc Merge pull request #6296 from koba1t/chore/use-go-tool
• 984f0ba build: run Go tools with go tool
• f9d65e8 Merge pull request #6295 from koba1t/fix/lint-workspace-checksums
• fef11ce build: keep workspace checksums complete
• 8105231 build: fix staticcheck exclusion
• 078ab6c Merge pull request #6264 from PragalvaXFREZ/fix-inpututil-wrap-error-with-file
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml