Flux v2.9.5 released on 31-08-2026
Flux v2.9.5 is out now. It returns helm-controller and source-controller to upstream Helm v4.2.4, hardens kubeconfig handling in helm-controller and kustomize-controller, and fixes kustomize-controller cleanup and a post-build substitution crash.
Users should consult the GitHub release notes and the Upgrade Procedure for Flux v2.7+ for full details and migration steps: https://github.com/fluxcd/flux2/discussions/5572
What’s in this release
- helm-controller and source-controller moved back to upstream Helm v4.2.4, dropping the temporary Flux fork.
- kubeconfig validation hardened for .spec.kubeConfig Secrets in helm-controller and kustomize-controller: references to local filesystem files (certificate-authority, tokenFile, client-certificate, client-key) are rejected; credentials and certificates must be embedded inline.
- kustomize-controller now purges leftover temporary directories at startup and fixes a panic on negative-length substring expressions in post-build substitution. Dependency updates bring Kubernetes client libraries to 1.36.4; component versions include source-controller v1.9.5, kustomize-controller v1.9.5, helm-controller v1.6.4, source-watcher v2.2.4, notification-controller v1.9.4, image-reflector-controller v1.2.5 and image-automation-controller v1.2.5.
Upgrade notes
- Kubeconfig Secrets that reference local files will now be rejected. Migrate those Secrets to embed certificates and tokens inline before upgrading; see the Upgrade Procedure for Flux v2.7+ for recommended steps: https://github.com/fluxcd/flux2/discussions/5572
- If you need to inspect changes or roll back, consult the full changelog and the compare view between v2.9.4 and v2.9.5: https://github.com/fluxcd/flux2/compare/v2.9.4…v2.9.5
Share comments on your upgrade experience via the Flux GitHub discussions or issue tracker so others can benefit from any migration notes you discover.
