github.com/fluxcd/source-controller

Changelog

v1.9.4 changelog

Container images

• docker.io/fluxcd/source-controller:v1.9.4
• ghcr.io/fluxcd/source-controller:v1.9.4

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

Release date: 2026-08-07

This patch release aligns Helm repository index loading with upstream Helm v4 by skipping empty entries, improves the error handling in the Bucket reconciler for optional fields in Azure responses, resolves OCI Helm charts by digest so that verification and download operate on the same content, and limits GCS static authentication to secrets holding service account keys. It also updates the fluxcd/pkg dependencies, which align the ECR host detection with upstream.

Fixes:

• Align index loading with upstream Helm v4 #2121
• Improve error handling in Bucket reconciliation #2123
• Pin OCI chart verification by digest #2125
• Limit GCS static authentication to service account keys #2130

Improvements:

• Update fluxcd/pkg dependencies #2131

Changelog

v1.9.3 changelog

Container images

• docker.io/fluxcd/source-controller:v1.9.3
• ghcr.io/fluxcd/source-controller:v1.9.3

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

Release date: 2026-07-13

This patch release fixes the HelmChart CRD description for .status.url, which was copy-pasted from Bucket and pointed users at BucketStatus.Artifact instead of HelmChartStatus.Artifact.

Improvements:

• Fix HelmChartStatus.URL doc-comment referencing BucketStatus #2110

Changelog

v1.9.2 changelog

Container images

• docker.io/fluxcd/source-controller:v1.9.2
• ghcr.io/fluxcd/source-controller:v1.9.2

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

Release date: 2026-07-07

This patch release disables Flux variable substitution on the source-controller CRDs by annotating them with kustomize.toolkit.fluxcd.io/substitute: disabled, so that Kustomizations with post-build substitution enabled no longer corrupt the CRD schemas when they contain ${...} sequences. It also caches the registry authorization token during Notation verification, so the token is fetched once per verification instead of once per request, reducing token-endpoint traffic against the registry.

Fixes:

• Disable variable substitution in CRDs #2103

Improvements:

• Cache registry token during Notation verification #2105

Changelog

v1.9.1 changelog

Container images

• docker.io/fluxcd/source-controller:v1.9.1
• ghcr.io/fluxcd/source-controller:v1.9.1

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

Release date: 2026-06-30

This patch release updates Kubernetes to 1.36.2 and the fluxcd/pkg dependencies, adds kubectl categories to the source-controller CRDs and documents the controller's command-line options.

Improvements:

• Add categories to source-controller CRDs #2090
• Document controller options #2094
• Update fluxcd/pkg dependencies #2092

Changelog

v1.9.0 changelog

Container images

• docker.io/fluxcd/source-controller:v1.9.0
• ghcr.io/fluxcd/source-controller:v1.9.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

Release date: 2026-06-17

This minor release comes with new authentication and verification features for the source APIs, along with various improvements, fixes and dependency updates.

GitRepository

The GitRepository controller now supports AWS CodeCommit as a Git provider, allowing authentication to CodeCommit repositories.

Git commit and tag verification now supports SSH signatures in addition to OpenPGP, so commits and tags signed with SSH keys can be verified via .spec.verify.

OCIRepository

The OCIRepository controller now supports configuring a custom Sigstore trusted root for keyless signature verification, via a Secret referenced in the verification configuration.

OCI artifacts are now resolved and stored strictly by their content digest.

Fixes:

• cosign: fix v3 bundle verify on http and private CA registries and pass TLS to Rekor #2061
• Close OCI blob reader and wrap errors consistently across controllers #2066
• Remove unimplemented field from HelmChart CRD #2080

Improvements:

• AWS CodeCommit support #2035
• Add git commit/tag SSH signature verification #2077
• Add custom Sigstore trusted root support #2003
• Ensure OCI artifacts are handled strictly by digest #2075
• build: target host architecture for local builds and envtest #2076
• Various dependency updates #2067 #2071 #2072 #2073 #2078 #2079 #2081

Release date: 2026-05-20

This patch release hardens path handling in the source reconcilers and updates go-git to v5.19.1, which fixes CVE-2026-45571 (crafted repositories may modify the main and submodule .git directories) and CVE-2026-45570 (improper single-quote escaping in the SSH transport). It also fixes Helm chart resolution for OCI tags that encode semver build metadata, updates Helm to v4.2.0 to align with helm-controller, and adds support for GCP sovereign cloud artifact registries via the fluxcd/pkg update.

Fixes:

• Improve path handling in source reconcilers #2055
• Support Helm semver encoding in OCI repositories #2051

Improvements:

• Update Helm to v4.2.0 #2049
• Upgrade k8s to 1.36.1, c-r to 0.24.1, cli-utils to 1.2.1 #2052
• Update fluxcd/pkg dependencies #2056

Release date: 2026-05-12

This patch release comes with dependency updates, including go-git v5.19.0 which fixes CVE-2026-45022.

Improvements:

• Update fluxcd/pkg dependencies #2045

Release date: 2026-04-21

This patch release updates go-git to v5.18.0, which includes performance improvements for Git operations, and comes with dependency updates.

Improvements:

• Update go-git to v5.18.0 (includes perf improvements) #2031 #2036

Release date: 2026-04-07

This patch release fixes the Azure Blob prefix option not being passed to the storage client, and improves the error message when using encrypted SSH keys without a password.

Fixes:

• Fix azure blob prefix option not passed #2014

Improvements:

• Improve error message for encrypted SSH keys without password #2013

Release date: 2026-03-12

This patch release fixes Azure Container Registry authentication by using the ACR-specific auth scope instead of the generic registry scope.

Improvements:

• Remove no longer needed workaround for Flux 2.8 #1993
• Update fluxcd/pkg dependencies #2001 #2005

Release date: 2026-02-17

This minor release comes with Helm v4 support, cosign v3 verification, and various improvements.

⚠️ The v1beta2 APIs were removed. Before upgrading the CRDs, Flux users must run flux migrate to migrate the cluster storage off v1beta2.

HelmChart

The HelmChart controller now uses Helm v4. The HelmRepository type oci has been moved to maintenance mode, users should migrate to OCIRepository.

CRD validation for v1 has been aligned with v1beta2 so that invalid specs are rejected at admission time.

OCIRepository

The OCIRepository controller now supports verifying artifacts signed with both cosign v2 and cosign v3.

GitRepository

The github provider now supports looking up the GitHub App installation ID automatically, removing the need to configure it manually.

General updates

In addition, the Kubernetes dependencies have been updated to v1.35.0 and the controller is now built with Go 1.26.

Improvements:

• Upgrade Helm to v4 #1953 #1958 #1980
• Discover cosign v3 NewBundleFormat for verification #1961
• Introduce support for looking up GH app installation ID #1963
• Remove deprecated APIs in group source.toolkit.fluxcd.io/v1beta2 #1983
• Docs: Move HelmRepository type oci to maintenance mode #1985
• sourcev1: align CRD validation with v1beta2 #1944
• Various dependency updates #1967 #1972 #1981 #1984 #1986 #1987

Release date: 2025-11-19

This patch release fixes Azure Workload Identity in Azure China Cloud.

Improvements:

• Upgrade k8s to 1.34.2, c-r to 0.22.4 and helm to 3.19.2 #1938
• Upgrade Helm to 3.19.1 #1934

Release date: 2025-10-28

This patch release fixes support for SOCKS5 proxy in the controller APIs.

Fixes:

• Restore SOCKS5 proxy support #1916

Release date: 2025-10-08

This patch release comes with various dependency updates.

The controller is now built with Go 1.25.2 which includes fixes for vulnerabilities in the Go stdlib: CVE-2025-58183, CVE-2025-58188 and many others. The full list of security fixes can be found here.

Improvements:

• Update dependencies to Kubernetes v1.34.1 and Go 1.25.2 #1908

Release date: 2025-10-06

This patch release comes with a fix for TLS certs handling in the HelmChart reconciler when auth credentials are not specified.

Fixes:

• Fix HelmChart reconciler appending login options when they do not exist #1904

Improvements:

• ci: Fix release workflow #1897
• Point to OCIRepository in HelmRepository docs #1893

Release date: 2025-09-15

This minor release comes with new features, improvements and bug fixes.

ExternalArtifact

A new ExternalArtifact API has been added to the source.toolkit.fluxcd.io group. This API enables advanced source composition and decomposition patterns implemented by the source-watcher controller.

GitRepository

GitRepository controller now includes fixes for stalling issues and improved error handling. Multi-tenant workload identity support has been added for Azure repositories when the ObjectLevelWorkloadIdentity feature gate is enabled. TLS configuration support has been added for GitHub App authentication.

Bucket

Bucket controller now supports multi-tenant workload identity for AWS, Azure and GCP providers when the ObjectLevelWorkloadIdentity feature gate is enabled. A default service account flag has been added for lockdown scenarios.

General updates

The controller now supports system certificate pools for improved CA compatibility, and TLS ServerName pinning has been removed from TLS configuration for better flexibility. A --default-service-account=<sa name> flag was introduced for workload identity multi-tenancy lockdown.

In addition, the Kubernetes dependencies have been updated to v1.34, Helm has been updated to v3.19 and various other controller dependencies have been updated to their latest version. The controller is now built with Go 1.25.

Fixes:

• Fix GitRepository controller stalling when it shouldn't #1865

Improvements:

• [RFC-0010] Add multi-tenant workload identity support for GCP Bucket #1862
• [RFC-0010] Add multi-tenant workload identity support for AWS Bucket #1868
• [RFC-0010] Add multi-tenant workload identity support for Azure GitRepository #1871
• [RFC-0010] Add default-service-account for lockdown #1872
• [RFC-0010] Add multi-tenant workload identity support for Azure Blob Storage #1875
• [RFC-0012] Add ExternalArtifact API documentation #1881
• [RFC-0012] Refactor controller to use fluxcd/pkg/artifact #1883
• Migrate OCIRepository controller to runtime/secrets #1851
• Migrate Bucket controller to runtime/secrets #1852
• Add TLS config for GitHub App authentication #1860
• Remove ServerName pinning from TLS config #1870
• Extract storage operations to a dedicated package #1864
• Remove deprecated APIs in group source.toolkit.fluxcd.io/v1beta1 #1861
• Migrate tests from gotest to gomega #1876
• Update dependencies #1888 #1880 #1878 #1876 #1874 #1850 #1844

Release date: 2025-06-27

This patch release comes with a fix for rsa-sha2-512 and rsa-sha2-256 algorithms not being prioritized for ssh-rsa host keys.

Fixes:

• Fix: Prioritize sha2-512 and sha2-256 for ssh-rsa host keys #1839

Release date: 2025-06-13

This patch release comes with a fix for the knownhosts: key mismatch error in the GitRepository API when using SSH authentication, and a fix for authentication with public ECR repositories in the OCIRepository API.

Fix:

• Fix authentication for public ECR #1825
• Fix knownhosts key mismatch regression bug #1829