Flux v2.8.7 released on 12-05-2026
Flux v2.8.7 is out now. Cluster operators should upgrade for a kustomize-controller fix that stops annotated, non‑namespaced resources being deleted and recreated on each reconciliation, and for a go-git dependency update that addresses CVE‑2026‑45022.
See the full changelog and upgrade guidance on the project’s GitHub: changelog, the release metadata at release and the Upgrade Procedure for Flux v2.7+ for step‑by‑step guidance.
What’s in this release
- kustomize-controller v1.8.5: fixes handling of objects annotated with
kustomize.toolkit.fluxcd.io/ssa: IfNotPresentthat were being deleted and recreated for non‑namespaced resources. - Security update: go-git upgraded to v5.19.0 in source-controller and image-automation-controller, addressing CVE‑2026‑45022 (GHSA-389r-gv7p-r3rp).
- Component and CLI dependency bumps: helm-controller v1.5.4, image-automation-controller v1.1.3, kustomize-controller v1.8.5, notification-controller v1.8.4, source-controller v1.8.4 and an update to toolkit components via @fluxcdbot.
Upgrade notes
- No breaking changes are reported for this patch; follow the Upgrade Procedure for Flux v2.7+ when moving from v2.6 to ensure a smooth upgrade.
- Rollback: the previous release is v2.8.6 — consult the full changelog for the exact commits and component versions to revert to if necessary.
Share any deployment notes or unexpected behaviour after upgrading — feedback from users helps spot edge cases and keeps cluster automation reliable.
