github.com/rancher/fleet

What's Changed

• Update module helm.sh/helm/v4 to v4.3.0 (main) by @renovate-rancher[bot] in #5801
• Bump Fleet version in installation documentation by @rancherbot in #5817
• Log warning when helmRepoURLRegex strips credentials from a non-matching chart URL by @aisensiy in #5794
• agentmanagement: Add ClusterRegistration tests by @0xavi0 in #5724
• Support OCI build metadata in Helm chart versions by @0xavi0 in #5808
• feat(fleet-controller): skip config re-apply and callbacks for unmodified reloads by @d3flex in #5452
• Set latest GitHub release by semver by @thardeck in #5823
• Fix controller runtime logger setup by @thardeck in #5825
• fix(agent): add jitter to cluster status ticker to prevent thundering… by @himabindugit in #5466
• fix(manageagent) reconcile agent when agentPullSecret is modified by @d3flex in #5816

New Contributors

• @aisensiy made their first contribution in #5794
• @himabindugit made their first contribution in #5466

Full Changelog: v0.17.0-alpha.4...v0.17.0-alpha.5

What's Changed

• Update module github.com/gobwas/glob to v1 (main) by @renovate-rancher[bot] in #5722
• Compute rancher/charts base branch for testing Fleet in Rancher by @weyfonk in #5648
• Add initial Renovate configuration by @renovate-rancher[bot] in #5731
• Update module github.com/prometheus/client_model to v0.6.3 (main) by @renovate-rancher[bot] in #5726
• Update module github.com/prometheus/common to v0.71.0 (main) by @renovate-rancher[bot] in #5728
• Update Go toolchain (main) by @renovate-rancher[bot] in #5725
• Update GitHub Actions (main) by @renovate-rancher[bot] in #5732
• Update module github.com/klauspost/compress to v1.20.0 (main) by @renovate-rancher[bot] in #5735
• Pin Renovate Vault workflow to v1.0.10 by @thardeck in #5737
• Load shared Renovate preset once by @thardeck in #5741
• Update module golang.org/x/crypto to v0.56.0 [SECURITY] (main) by @renovate-rancher[bot] in #5742
• Update module golang.org/x/sync to v0.23.0 (main) by @renovate-rancher[bot] in #5733
• Update module golang.org/x/mod to v0.40.0 [SECURITY] (main) by @renovate-rancher[bot] in #5743
• Update module github.com/rancher/fleet/pkg/apis to v0.16.1 (main) by @renovate-rancher[bot] in #5739
• Update dependency rancher/cli to v2.15.1 (main) by @renovate-rancher[bot] in #5760
• Update dependency rancherlabs/slsactl to v0.1.39 (main) by @renovate-rancher[bot] in #5761
• Update module github.com/google/go-containerregistry to v0.22.1 (main) by @renovate-rancher[bot] in #5764
• Update module github.com/moby/moby/api to v1.56.0 (main) by @renovate-rancher[bot] in #5772
• Update dependency goreleaser/goreleaser to v2.18.0 (main) by @renovate-rancher[bot] in #5765
• Update go module directive to v1.27.0 (main) by @renovate-rancher[bot] in #5771
• Confine webhook-triggered Spec mutation to verified requests by @thardeck in #5781
• Constrain Helm values file paths by @thardeck in #5775
• The following local Renovate rules should be obsolete by @thardeck in #5791
• gate downstream resource cloning by service account RBAC by @p-se in #5787
• Update Kubernetes dependencies (main) by @renovate-rancher[bot] in #5721
• Update dependency goreleaser/goreleaser to v2.18.1 (main) by @renovate-rancher[bot] in #5783
• Use GitHub's dedicated self-repository syntax by @thardeck in #5798
• Update golang.org/x dependencies (main) by @renovate-rancher[bot] in #5797
• Automate signed Fleet module tags during release by @thardeck in #5802
• Update module github.com/onsi/ginkgo/v2 to v2.32.2 (main) by @renovate-rancher[bot] in #5796
• Handle existing module tag refs by @thardeck in #5803
• Create unsigned module tags by @thardeck in #5807

Full Changelog: v0.17.0-alpha.3...v0.17.0-alpha.4

What's Changed

• Deploy charts that define CRDs and use lookup by @0xavi0 in #5689
• Validate diff.comparePatches fields early by @0xavi0 in #5669
• Output all linting issues on PRs by @weyfonk in #5716
• fix(agent): apply pod-security labels from namespaceLabels again by @p-se in #5687
• Remove --import flag from Rancher cluster creation by @weyfonk in #5719
• agentmanagement tests - cluster registration token by @0xavi0 in #5538
• Update module github.com/onsi/gomega to v1.43.0 (main) by @renovate-rancher[bot] in #5718
• Update module github.com/google/go-containerregistry to v0.22.0 (main) by @renovate-rancher[bot] in #5700

Full Changelog: v0.17.0-alpha.2...v0.17.0-alpha.3

What's Changed

• Apply all bundles before returning errors by @thardeck in #5446
• Enable automerge for eligible Renovate updates by @thardeck in #5646
• Update module github.com/stretchr/testify to v1.12.1 (main) by @renovate-rancher[bot] in #5644
• Free disk space before the multi-cluster e2e job by @p-se in #5645
• Fix bootstrap mock generation paths by @weyfonk in #5652
• Use default prHourlyLimit again by @thardeck in #5655
• Confirm deletion upstream before uninstalling releases by @0xavi0 in #5585
• Don't require a kubeconfig for fleet apply --output by @0xavi0 in #5621
• Avoid duplicate Renovate presets by @thardeck in #5668
• Update Go toolchain (main) by @renovate-rancher[bot] in #5624
• Update GitHub Actions (main) by @renovate-rancher[bot] in #5656
• Update Kubernetes dependencies (main) by @renovate-rancher[bot] in #5671
• Update Renovate workflow to v1.0.7 by @thardeck in #5675
• Fix Renovate workflow checksum by @thardeck in #5676
• Add WaitingForDependency bundle state by @0xavi0 in #5549
• Bump Renovate vault to 1.0.9 by @thardeck in #5692
• Free disk space before the single-cluster e2e jobs by @p-se in #5688
• Update Rancher reference and Fleet platform support metadata and CI for Kubernetes 1.37 by @thardeck in #5697
• Update module github.com/moby/go-archive to v0.3.0 [SECURITY] (main) by @renovate-rancher[bot] in #5699
• fix: scope namespace metadata to matched target customizations by @immanuwell in #5319

Full Changelog: v0.17.0-alpha.1...v0.17.0-alpha.2

What's Changed

• fix: apply HelmReleaseName truncation in releaseKey for GC comparison by @nilsalex in #5302
• fix(ci): restrict permissions to read in workflows by @d3flex in #5366
• feat(gitrepo): announce GitRepoRestriction deprecation by @d3flex in #5347
• Update module github.com/rancher/fleet/pkg/apis to v0.15.4 (main) by @renovate-rancher[bot] in #5391
• Adds basic skeleton and tests for agentmanagement by @0xavi0 in #5373
• Fix false-positive diffs for controller-injected webhook caBundle by @susesamu in #5369
• test(gitcloner): drop network-dependent capability detection tests by @p-se in #5409
• ci: pin k3s to v1.35.6 for Rancher E2E test by @d3flex in #5411
• fix(policy): introduce CreateNamespace option by @p-se in #5351
• Add new release branch to release against rancher action by @thardeck in #5418
• Split pkg/helmvalues into its own Go module by @0xavi0 in #5396
• Update module golang.org/x/sync to v0.22.0 (main) by @renovate-rancher[bot] in #5417
• Update GitHub Actions (main) by @renovate-rancher[bot] in #5416
• Update dependency goreleaser/goreleaser to v2.17.0 (main) by @renovate-rancher[bot] in #5428
• Update GitHub Actions (main) by @renovate-rancher[bot] in #5425
• Bump oras-go, x/crypto, and Go toolchain by @thardeck in #5434
• Update module github.com/rancher/fleet/pkg/apis to v0.15.4 (main) by @renovate-rancher[bot] in #5437
• Remove obsolete integration test go.mod reference by @thardeck in #5441
• Add initial Renovate configuration by @renovate-rancher[bot] in #5442
• Simplify GoReleaser dockers_v2 config by @thardeck in #5435
• Add Renovate/Dependabot auto-approve workflow by @thardeck in #5424
• Use GitHub App token for bot PR auto-merge by @thardeck in #5450
• agentmanagement: config and cluster testing coverage. by @0xavi0 in #5405
• Add v0.16 Rancher 2.15 support by @thardeck in #5453
• Update module golang.org/x/net to v0.57.0 (main) by @renovate-rancher[bot] in #5451
• Update rancher/renovate-config action to v1.0.5 (main) by @renovate-rancher[bot] in #5455
• Update module helm.sh/helm/v4 to v4.2.3 (main) by @renovate-rancher[bot] in #5454
• Update module github.com/prometheus/common to v0.70.0 (main) by @renovate-rancher[bot] in #5458
• Fix GitHub workflow lint errors by @thardeck in #5456
• Wait for cluster existence before running further checks by @weyfonk in #5461
• Update module github.com/rancher/fleet/pkg/apis to v0.16.0 (main) by @renovate-rancher[bot] in #5464
• Update GitHub Actions (main) (major) by @renovate-rancher[bot] in #5465
• Bump Fleet version in installation documentation by @rancherbot in #5463
• feat(controller): prevent hot-reload of cross-version config during upgrade by @d3flex in #5397
• Approve Renovate auto-merge PRs by @thardeck in #5459
• Test Renovate by @renovate-rancher[bot] in #5471
• Test Renovate - Revert "Update dependency crust-gather/crust-gather to v0.16.0 (#5471)" by @thardeck in #5472
• Update module github.com/klauspost/compress to v1.19.1 (main) by @renovate-rancher[bot] in #5474
• Update dependency crust-gather/crust-gather to v0.16.0 (main) by @renovate-rancher[bot] in #5473
• Update GitHub Actions (main) by @renovate-rancher[bot] in #5475
• Update module github.com/go-logr/logr to v1.4.4 (main) by @renovate-rancher[bot] in #5476
• Update module github.com/prometheus/client_golang to v1.24.0 (main) by @renovate-rancher[bot] in #5479
• Update module github.com/ulikunitz/xz to v0.5.16 (main) by @renovate-rancher[bot] in #5478
• Use port forwarding for fetching metrics from benchmark tests by @weyfonk in #5412
• Gate Renovate approval on green CI by @thardeck in #5487
• Update module github.com/prometheus/common to v0.70.1 (main) by @renovate-rancher[bot] in #5489
• Update module github.com/go-git/go-billy/v5 to v5.9.1 (main) by @renovate-rancher[bot] in #5490
• feat(webhook): warn on unauthenticated webhook calls by @d3flex in #5419
• Fix Schedule race condition and flaky e2e tests by @0xavi0 in #5436
• Skip unsplit Fleet submodules in release preflight by @thardeck in #5462
• Validate GitRepo defaults from GitRepoRestriction and Policy against allow-lists by @p-se in #5285
• Update module github.com/prometheus/client_golang to v1.24.1 (main) by @renovate-rancher[bot] in #5504
• Update dependency goreleaser/goreleaser to v2.17.1 (main) by @renovate-rancher[bot] in #5506
• Update GitHub Actions (main) by @renovate-rancher[bot] in #5503
• Update dependency crust-gather/crust-gather to v0.16.2 (main) by @renovate-rancher[bot] in #5505
• Update dependency rancher/cli to v2.14.3 (main) by @renovate-rancher[bot] in #5502
• Revert parts of PR #5462 by @0xavi0 in #5511
• Reduce Fleet Helm values go.mod MinimumGroupSize to two by @thardeck in #5513
• Enable Helm values Kubernetes updates by @thardeck in #5514
• Run Ginkgo suites through go test by @thardeck in #5469
• Update module github.com/go-git/go-git/v5 to v5.19.2 (main) by @renovate-rancher[bot] in #5517
• Update Kubernetes dependencies (main) by @renovate-rancher[bot] in #5516
• Disable SARIF upload on forks by @thardeck in #5527
• Test leading comments in Helm templates by @thardeck in #5520
• Update dependency rancher/cli to v2.15.0 (main) by @renovate-rancher[bot] in #5522
• Update dependency rancherlabs/slsactl to v0.1.36 (main) by @renovate-rancher[bot] in #5521
• Update GitHub Actions (main) by @renovate-rancher[bot] in #5530
• Update module github.com/google/go-containerregistry to v0.21.8 (main) by @renovate-rancher[bot] in #5529
• Enable Helm values Wrangler updates by @thardeck in #5546
• Merge Wrangler Renovate updates by @thardeck in #5548
• Update module github.com/rancher/wrangler/v3 to v3.7.1 (main) by @renovate-rancher[bot] in #5543
• Remove logrus usage by @thardeck in #5540
• Keep k3d test clusters from garbage-collecting local images by @p-se in #5552
• Automerge updates on main by @thardeck in #5557
• feat(codegen): generate fleet.yaml JSON Schema via reflection by @d3flex in #5507
• Update module github.com/klauspost/compress to v1.19.2 (main) by @renovate-rancher[bot] in #5554
• Match automerge rules on all branches by @thardeck in #5569
• Remove logrus codegen by @thardeck in #5570
• feat(cli): surface helm values hash in monitor snapshot by @d3flex in #5467
• Update go toolchain directive to v1.26.6 [SECURITY] (main) by @renovate-rancher[bot] in #5562
• Update dependency crust-gather/crust-gather to v0.16.3 (main) by @renovate-rancher[bot] in #5571
• Update module github.com/testcontainers/testcontainers-go to v0.44.0 (main) by @renovate-rancher[bot] in #5563
• Enable security automerge overrides by @thardeck in #5577
• Fix renovate auto-approve no-op handling by @thardeck in #5542
• Expect non-static rancher/mirrored-library-busybox tag by @weyfonk in #5579
• Require Renovate automerge marker by @thardeck in #5593
• Increase Renovate PR lookup by @thardeck in #5594
• fix(e2e): use retry to prevent false negative on imagescan_test.go by @d3flex in #5591
• Remove getHostByName from template function map by @thardeck in #5606
• Drop reserved labels during agent-initiated cluster registration by @0xavi0 in #5605
• Update module github.com/google/go-containerregistry to v0.21.9 (main) by @renovate-rancher[bot] in #5553
• Skip bumping Fleet modules Rancher does not use by @thardeck in #5616
• Update module github.com/onsi/ginkgo/v2 to v2.32.1 (main) by @renovate-rancher[bot] in #5575
• Update module github.com/stretchr/testify to v1.12.0 (main) by @renovate-rancher[bot] in #5576
• Enable Renovate automerge by @thardeck in #5618
• Use main branch for Renovate config by @thardeck in #5619
• fix(webhook): evaluate SSH URLs from webhook payloads by @d3flex in #5439
• Update dependency crust-gather/crust-gather to v0.17.0 (main) by @renovate-rancher[bot] in #5612
• Update golang.org/x dependencies (main) by @renovate-rancher[bot] in #5592
• Simplify automerge rules by @thardeck in #5628
• Fix automerge for release branch dependency updates by @thardeck in #5634
• Bump Fleet version in installation documentation by @rancherbot in #5631
• feat(agent): report agent version and surface version mismatch by @p-se in #5404
• Revert "Fix automerge for release branch dependency updates" by @thardeck in #5643
• Update dependency crust-gather/crust-gather to v0.17.1 (main) by @renovate-rancher[bot] in #5622
• Update module helm.sh/helm/v4 to v4.2.4 (main) by @renovate-rancher[bot] in #5623

New Contributors

• @nilsalex made their first contribution in #5302

Full Changelog: v0.16.0-rc.4...v0.17.0-alpha.1

What's Changed

• fix(manageagent) reconcile agent when agentPullSecret is modified by @d3flex in #5795
• [v0.16] Warn on unmatched Helm repo regex by @thardeck in #5819
• Update Kubernetes dependencies to v0.36.5 (release/v0.16) by @renovate-rancher[bot] in #5832
• [v0.16] Add Helm chart image HIP-0015 annotations by @thardeck in #5852
• Update Kubernetes dependencies (release/v0.16) by @renovate-rancher[bot] in #5848

Full Changelog: v0.16.2...v0.16.3-alpha.1

What's Changed

• Gate downstream resource cloning by service account RBAC (CVE-2026-88808) by @p-se in #5788
• Constrain Helm values file paths (CVE-2026-93537) by @thardeck in #5776
• Confine webhook-triggered Spec mutation to verified requests (CVE-2026-93539) by @thardeck in #5782
• Deploy charts that define CRDs and use lookup (#5689) by @0xavi0 in #5710
• Add WaitingForDependency bundle state (#5549) by @0xavi0 in #5691
• Don't require a kubeconfig for fleet apply --output (#5621) by @0xavi0 in #5667
• Confirm deletion upstream before uninstalling releases (#5585) by @0xavi0 in #5665
• Update module golang.org/x/crypto to v0.56.0 (CVE-2026-78662, CVE-2026-56855) by renovate in #5745
• Update module go.opentelemetry.io/otel to v1.44.0 (GHSA-5wrp-cwcj-q835, GHSA-995v-fvrw-c78m) by renovate in #5744
• Update Kubernetes dependencies to v0.36.4 by renovate in #5729
• Update Go to v1.26.8 by renovate in #5715

Full Changelog: v0.16.1...v0.16.2

What's Changed

• Update module go.opentelemetry.io/otel to v1.44.0 [SECURITY] (release/v0.16) by @renovate-rancher[bot] in #5744
• [v0.16] Backport test(gitcloner): drop network-dependent capability detection tests (#… by @thardeck in #5774
• Update module golang.org/x/crypto to v0.56.0 [SECURITY] (release/v0.16) by @renovate-rancher[bot] in #5745
• [v0.16] Confine webhook-triggered Spec mutation to verified requests by @thardeck in #5782
• [v0.16] Constrain Helm values file paths by @thardeck in #5776
• [v0.16] gate downstream resource cloning by service account RBAC by @p-se in #5788

Full Changelog: v0.16.2-rc.1...v0.16.2-rc.2

What's Changed

• Update go toolchain directive to v1.26.7 (release/v0.16) by @renovate-rancher[bot] in #5625
• [v0.16] - Confirm deletion upstream before uninstalling releases (#5585) by @0xavi0 in #5665
• [v0.16] - Don't require a kubeconfig for fleet apply --output (#5621) by @0xavi0 in #5667
• Update Kubernetes dependencies (release/v0.16) by @renovate-rancher[bot] in #5672
• Free disk space before the multi-cluster e2e job (#5645) by @thardeck in #5678
• [v0.16] - Fix Schedule race condition and flaky e2e tests (#5436) by @0xavi0 in #5670
• [v0.16] Free disk space before the single-cluster e2e jobs (#5688) by @p-se in #5693
• [v0.16] - Add WaitingForDependency bundle state (#5549) by @0xavi0 in #5691
• [v0.16] - Deploy charts that define CRDs and use lookup (#5689) by @0xavi0 in #5710
• [v0.16] fix(agent): apply pod-security labels from namespaceLabels again by @p-se in #5705
• Update go toolchain directive to v1.26.8 (release/v0.16) by @renovate-rancher[bot] in #5715
• Update Kubernetes dependencies to v0.36.4 (release/v0.16) by @renovate-rancher[bot] in #5729

Full Changelog: v0.16.1-rc.2...v0.16.2-rc.1

What's Changed

• Drop reserved labels during agent-initiated cluster registration by @0xavi0 in #5604
• Remove getHostByName from template function map (GHSA-x9m6-xcjr-hpjp) by @thardeck in #5607
• Warn on unauthenticated webhook calls by @0xavi0 in #5518
• Introduce CreateNamespace option to Policy (#5414) by @p-se in #5415
• Fix false-positive diffs for controller-injected webhook caBundle (#5368) by @0xavi0 in #5402
• Apply HelmReleaseName truncation in releaseKey for garbage collection comparison (#5399) by @0xavi0 in #5398
• Announce GitRepoRestriction deprecation (#5306) by @d3flex in #5395
• Update vulnerable Go modules by @thardeck in #5599
• Update Go to v1.26.6 by renovate in #5564
• Update module github.com/go-git/go-git/v5 to v5.19.2 by renovate in #5531
• Update module github.com/klauspost/compress to v1.18.7 (GHSA-259r-337f-4rfw) by renovate in #5486
• Update Kubernetes dependencies to v0.36.3 by renovate in #5492

Full Changelog: v0.16.0...v0.16.1

What's Changed

• Drop reserved labels during agent-initiated cluster registration by @0xavi0 in #5604
• Remove getHostByName from template function map by @thardeck in #5607
• Warn on unauthenticated webhook calls by @0xavi0 in #5518
• Introduce CreateNamespace option to Policy (#5414) by @p-se in #5415
• Fix false-positive diffs for controller-injected webhook caBundle (#5368) by @0xavi0 in #5402
• Apply HelmReleaseName truncation in releaseKey for garbage collection comparison (#5399) by @0xavi0 in #5398
• Announce GitRepoRestriction deprecation (#5306) by @d3flex in #5395
• Update vulnerable Go modules by @thardeck in #5599
• Update Go to v1.26.6 by renovate in #5564
• Update module github.com/go-git/go-git/v5 to v5.19.2 by renovate in #5531
• Update module github.com/klauspost/compress to v1.18.7 (GHSA-259r-337f-4rfw) by renovate in #5486
• Update Kubernetes dependencies to v0.36.3 by renovate in #5492

Full Changelog: v0.16.0...v0.16.1-rc.2

What's Changed

• [v0.16] Disable SARIF upload on forks by @thardeck in #5528
• Update dependency rancherlabs/slsactl to v0.1.36 (release/v0.16) by @renovate-rancher[bot] in #5523
• Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] (release/v0.16) by @renovate-rancher[bot] in #5531
• [v0.16] - Split pkg/helmvalues into its own Go module (#5396) by @0xavi0 in #5539
• Update go toolchain directive to v1.26.5 [SECURITY] (release/v0.16) by @renovate-rancher[bot] in #5544
• Update dependency rancher/cli to v2.15.0 (release/v0.16) by @renovate-rancher[bot] in #5574
• Update go toolchain directive to v1.26.6 [SECURITY] (release/v0.16) by @renovate-rancher[bot] in #5564
• [v0.16] Expect non-static rancher/mirrored-library-busybox tag by @weyfonk in #5586
• Update vulnerable Go modules by @thardeck in #5599
• Remove getHostByName from template function map by @thardeck in #5607
• [v0.16] - Drop reserved labels during agent-initiated cluster registration by @0xavi0 in #5604

Full Changelog: v0.16.1-beta.2...v0.16.1-rc.1