Flux v2.8.7 released on 12-05-2026
Flux v2.8.7 is out now. It fixes a kustomize-controller issue that caused non‑namespaced resources annotated with kustomize.toolkit.fluxcd.io/ssa: IfNotPresent to be deleted and recreated, and it updates go-git to remove a CVE affecting source-controller and image-automation-controller.
See the Flux project on GitHub for the full changelog and upgrade instructions; follow the Upgrade Procedure for Flux v2.7+ when moving from v2.6 for a smooth migration.
What’s in this release
- kustomize-controller bugfix: correct handling of objects annotated with kustomize.toolkit.fluxcd.io/ssa: IfNotPresent to stop unintended deletion/recreation of non‑namespaced resources.
- Security update: go-git upgraded to v5.19.0 to address CVE-2026-45022 (GHSA-389r-gv7p-r3rp) for source-controller and image-automation-controller.
- Component and dependency bumps: helm-controller v1.5.4, image-automation-controller v1.1.3, kustomize-controller v1.8.5, notification-controller v1.8.4, source-controller v1.8.4, flux2 CLI/toolkit updates and fluxcd/pkg dependency updates across controllers.
Upgrade notes
- No breaking changes are listed for this patch; follow the Upgrade Procedure for Flux v2.7+ when upgrading from v2.6: Upgrade Procedure for Flux v2.7+.
- If you need to roll back, redeploy the previous release (for example v2.8.6) and consult the full changelog for differences: v2.8.6…v2.8.7 compare.
Let us know how the upgrade goes and report any issues or observations on Flux’s GitHub discussions or issue tracker.
