Flux v2.9.5 released on 31-08-2026
Flux v2.9.5 is out now. Operators get stricter kubeconfig validation and Secrets hardening in helm-controller and kustomize-controller, plus upstream Helm and dependency updates that bring Kubernetes client libraries to v1.36.4.
For the full changelog, component versions and upgrade guidance, visit the Flux project pages on GitHub and follow the published upgrade procedure.
What’s in this release
- Validate kubeconfigs from .spec.kubeConfig Secrets, rejecting local file references in certificate-authority, tokenFile, client-certificate and client-key; credentials and certificates must be embedded inline (helm-controller, kustomize-controller).
- Move back to upstream Helm v4.2.4 (helm-controller, source-controller) and update fluxcd/pkg dependencies across controllers and the CLI, bringing Kubernetes client libraries to v1.36.4.
- kustomize-controller purges leftover temporary directories at startup and fixes a panic on negative-length substring expressions in post-build substitution so behaviour matches Bash.
Upgrade notes
- Breaking change: kubeconfigs that reference files on the local filesystem are now rejected. Clusters and CI/CD workflows using file-backed kubeconfigs must convert to inline credentials and certificates; follow the Upgrade Procedure for Flux v2.7+ (https://github.com/fluxcd/flux2/discussions/5572) for migration steps.
- No specific rollback instructions are listed in the release notes; test the upgrade in staging and consult the full compare-based changelog (https://github.com/fluxcd/flux2/compare/v2.9.4…v2.9.5) if you need to review component changes.
Share any notes or issues you hit while upgrading — the community and maintainers will want to hear about migration pain points and verification steps that worked for you.
