Flux v2.8.8 released on 20-05-2026
Flux v2.8.8 is out now. It delivers key security and dependency updates — notably go-git v5.19.1 which addresses CVE-2026-45571 and CVE-2026-45570 — and several reliability fixes across the controllers.
See the full changelog and component notes on the Flux GitHub for details and follow the Upgrade Procedure for Flux v2.7+ when moving from v2.6 or later.
What’s in this release
- Security: go-git upgraded to v5.19.1 to fix CVE-2026-45571 and CVE-2026-45570; fluxcd/pkg and other dependencies refreshed.
- Helm-controller (v1.5.5): reliability fixes including a configurable HTTP timeout for artifact fetching, a fix for unbounded memory growth, stopping force-application of non-CRD files in crds/, and a fix for Helm test action with long release names.
- Source-controller (v1.8.5) and image controllers: improved path handling, support for Helm semver build-metadata in OCIRepository tags, support for GCP sovereign cloud artifact registries, and Kubernetes client libs bumped to 1.36.1.
Upgrade notes
- If you are upgrading from v2.6+, follow the “Upgrade Procedure for Flux v2.7+” for a smooth transition: https://github.com/fluxcd/flux2/discussions/5572
- For rollbacks or component-specific guidance, consult the full changelog and the individual component changelogs on GitHub: https://github.com/fluxcd/flux2/compare/v2.8.7…v2.8.8
Share your experience after upgrading — report any issues or observations on the Flux GitHub so other users can benefit.
