chore(deps): bump the go group with 5 updates

[dependabot]

Bumps the go group with 5 updates:

Package	From	To
github.com/fluxcd/flux2/v2	2.9.3	2.9.4
github.com/fluxcd/image-automation-controller/api	1.2.3	1.2.4
github.com/fluxcd/image-reflector-controller/api	1.2.3	1.2.4
github.com/fluxcd/notification-controller/api	1.9.2	1.9.3
github.com/fluxcd/source-controller/api	1.9.3	1.9.4

Updates github.com/fluxcd/flux2/v2 from 2.9.3 to 2.9.4

Release notes

Sourced from github.com/fluxcd/flux2/v2's releases.

v2.9.4

Highlights

Flux v2.9.4 is a patch release that ships various fixes to the Flux controllers, covering source-watcher tarball extraction and glob expansion limits, the refspecs accepted by ImageUpdateAutomation, the HTTP request limits of the notification-controller servers, and Helm repository index loading, OCI chart digest pinning, Bucket error handling and GCS static authentication in source-controller. On the CLI side, flux migrate -f now supports migrating repositories to Flux 2.9. Users are encouraged to upgrade for the best experience.

Note that this release contains CRD schema changes for ArtifactGenerator and ImageUpdateAutomation; both CRDs must be updated along with the controllers.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Confine tarball extraction and bound glob expansion (source-watcher)
• Disallow force-update and deletion via refspecs (image-automation-controller)
• Unify HTTP server request limits (notification-controller)
• Align Helm repository index loading with upstream Helm v4 (source-controller)
• Improve error handling in Bucket reconciliation (source-controller)
• Pin OCI chart verification by digest (source-controller)
• Limit GCS static authentication to service account keys (source-controller)
• Restrict the allow-webhooks network policy to the receiver port (flux CLI)

Improvements:

• Add support for migrating repositories to 2.9 in flux migrate -f (flux CLI)
• Update fluxcd/pkg dependencies, which align the ECR host detection with upstream (source-controller, image-reflector-controller, flux CLI)
• Update Bitbucket Cloud receiver guidance (notification-controller)

Components changelog

• source-controller v1.9.4
• source-watcher v2.2.3
• notification-controller v1.9.3
• image-reflector-controller v1.2.4
• image-automation-controller v1.2.4

CLI changelog

• [release/v2.9.x] Add support for 2.9 in migrate -f by @​fluxcdbot in fluxcd/flux2#6021
• Update fluxcd/pkg dependencies by @​fluxcdbot in fluxcd/flux2#6026
• [release/v2.9.x] fix: restrict allow-webhooks netpol to receiver port by @​fluxcdbot in fluxcd/flux2#6029
• Update toolkit components by @​fluxcdbot in fluxcd/flux2#6031

Full Changelog: fluxcd/flux2@v2.9.3...v2.9.4

Commits

• 889be9d Merge pull request #6031 from fluxcd/update-components-release/v2.9.x
• 3825429 Update toolkit components
• ffe365a Merge pull request #6029 from fluxcd/backport-6028-to-release/v2.9.x
• 8ac865c fix: restrict allow-webhooks netpol to receiver port
• c49a486 Merge pull request #6026 from fluxcd/update-pkg-deps/release/v2.9.x
• 4942d15 Update fluxcd/pkg dependencies
• a2d0b29 Merge pull request #6021 from fluxcd/backport-6020-to-release/v2.9.x
• f4ad9e5 Add support for 2.9 in migrate -f
• See full diff in compare view

Updates github.com/fluxcd/image-automation-controller/api from 1.2.3 to 1.2.4

Release notes

Sourced from github.com/fluxcd/image-automation-controller/api's releases.

v1.2.4

Changelog

v1.2.4 changelog

Container images

• docker.io/fluxcd/image-automation-controller:v1.2.4
• ghcr.io/fluxcd/image-automation-controller:v1.2.4

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/image-automation-controller/api's changelog.

1.2.4

Release date: 2026-08-07

This patch release restricts the refspecs accepted by the ImageUpdateAutomation API. The .spec.git.push.refspec field now carries a validation pattern that rejects deletion refspecs with an empty source, such as :refs/heads/branch, and force-update refspecs prefixed with +. The refspec push no longer inherits the force flag from the push branch configuration, so force pushing stays governed by the GitForcePushBranch feature gate.

Note that this release contains a CRD schema change, the ImageUpdateAutomation CRD must be updated along with the controller.

Fixes:

• Disallow force-update and deletion via refspecs #1082

Commits

• 434e26a Merge pull request #1083 from fluxcd/release-v1.2.4
• cae4f3a Release v1.2.4
• a0f06bf Add changelog entry for v1.2.4
• 0c19fde Merge pull request #1082 from fluxcd/backport-1081-to-release/v1.2.x
• d4b13a8 Make refspec respect force-push feature gate
• 1079d9a Deny force-update and deletion via Refspecs
• See full diff in compare view

Updates github.com/fluxcd/image-reflector-controller/api from 1.2.3 to 1.2.4

Release notes

Sourced from github.com/fluxcd/image-reflector-controller/api's releases.

v1.2.4

Changelog

v1.2.4 changelog

Container images

• docker.io/fluxcd/image-reflector-controller:v1.2.4
• ghcr.io/fluxcd/image-reflector-controller:v1.2.4

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/image-reflector-controller/api's changelog.

1.2.4

Release date: 2026-08-07

This patch release updates the fluxcd/pkg dependencies, which align the ECR host detection with upstream. The registry host is now matched in full against the pattern used by the AWS ECR Credential Helper, and the detection covers the European Sovereign Cloud (amazonaws.eu) along with the dual-stack hostnames used for IPv6 access, including the public registry at ecr-public.aws.com.

Improvements:

• Update fluxcd/pkg dependencies #926

Commits

• ff2d314 Merge pull request #927 from fluxcd/release-v1.2.4
• cde7b52 Release v1.2.4
• 7881da2 Add changelog entry for v1.2.4
• ca9da2c Merge pull request #926 from fluxcd/update-pkg-deps/release/v1.2.x
• 3465666 Update fluxcd/pkg dependencies
• See full diff in compare view

Updates github.com/fluxcd/notification-controller/api from 1.9.2 to 1.9.3

Release notes

Sourced from github.com/fluxcd/notification-controller/api's releases.

v1.9.3

Changelog

v1.9.3 changelog

Container images

• docker.io/fluxcd/notification-controller:v1.9.3
• ghcr.io/fluxcd/notification-controller:v1.9.3

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/notification-controller/api's changelog.

1.9.3

Release date: 2026-08-07

This patch release unifies the request limits of the two HTTP servers exposed by the controller. The event server and the receiver server now share the same request body limit of 3 MiB, enforced by a common helper that rejects oversized bodies with HTTP 413, with the receiver limit applied before the receiver lookup and payload validation. Both servers now set a read timeout of 30s, a read header timeout of 10s and a maximum header size of 256 KiB. The event rate limiter store sweeps stale entries at the configured --rate-limit-interval and purges them after twice that interval, and sethvargo/go-limiter has been updated to v1.2.0 to reduce lock contention in the store. In addition, the Bitbucket Cloud receiver documentation has been updated.

Fixes:

• Unify HTTP server request limits #1363

Improvements:

• Update Bitbucket Cloud receiver guidance #1350

Commits

• 0b6fcb1 Merge pull request #1365 from fluxcd/release-v1.9.3
• f84ab00 Release v1.9.3
• b050ec0 Add changelog entry for v1.9.3
• 47792f2 Merge pull request #1363 from fluxcd/backport-1361-to-release/v1.9.x
• 2d7f884 Tune rate limiter sweep and bump go-limiter
• 192cb6c Unify and harden HTTP server request limits
• e49e406 fix: limit the event server request body size
• 15199b3 Merge pull request #1350 from fluxcd/backport-1346-to-release/v1.9.x
• 7a70d4f docs: update Bitbucket Cloud receiver guidance
• See full diff in compare view

Updates github.com/fluxcd/source-controller/api from 1.9.3 to 1.9.4

Release notes

Sourced from github.com/fluxcd/source-controller/api's releases.

v1.9.4

Changelog

v1.9.4 changelog

Container images

• docker.io/fluxcd/source-controller:v1.9.4
• ghcr.io/fluxcd/source-controller:v1.9.4

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/source-controller/api's changelog.

1.9.4

Release date: 2026-08-07

This patch release aligns Helm repository index loading with upstream Helm v4 by skipping empty entries, improves the error handling in the Bucket reconciler for optional fields in Azure responses, resolves OCI Helm charts by digest so that verification and download operate on the same content, and limits GCS static authentication to secrets holding service account keys. It also updates the fluxcd/pkg dependencies, which align the ECR host detection with upstream.

Fixes:

• Align index loading with upstream Helm v4 #2121
• Improve error handling in Bucket reconciliation #2123
• Pin OCI chart verification by digest #2125
• Limit GCS static authentication to service account keys #2130

Improvements:

• Update fluxcd/pkg dependencies #2131

Commits

• 6b10a9e Merge pull request #2132 from fluxcd/release-v1.9.4
• 5e277c3 Release v1.9.4
• d687f6d Add changelog entry for v1.9.4
• 9dbb071 Merge pull request #2131 from fluxcd/update-pkg-deps/release/v1.9.x
• f20cec3 Update fluxcd/pkg dependencies
• aaae31a Merge pull request #2130 from fluxcd/backport-2126-to-release/v1.9.x
• 66b3951 fix: restrict GCS static auth to SA keys
• 6b6b3ee Merge pull request #2125 from fluxcd/backport-2124-to-release/v1.9.x
• 2a7329f fix: pin OCI chart verification by digest
• cd41ce8 Merge pull request #2123 from fluxcd/backport-2122-to-release/v1.9.x
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions